Skip to main content

Odoo

This guide explains how to connect Odoo Community (versions 18 and 19) to VaultysHub using OpenID Connect, with the free module auth_oidc from OCA (Odoo Community Association).

Why an OCA module?

The standard Odoo module, OAuth Authentication (auth_oauth), only requires a direct access token (response_type=token), which VaultysHub does not provide. auth_oidc adds the authorization code flow with PKCE, and verifies the identity token's signature with VaultysHub's public keys.

Prerequisites​

  • Odoo Community 18 or 19, served over HTTPS (e.g., https://odoo.example.com)
  • The auth_oidc module (branch 18.0 or 19.0 of OCA/server-auth) in the addons path, and the Python library python-jose
  • Administrator access to Odoo and VaultysHub

Configuration in VaultysHub​

  1. Applications → Add: name Odoo, URL https://odoo.example.com/web/login
  2. Type OIDC, then:
    • Redirect URI: https://odoo.example.com/auth_oauth/signin
    • Allowed scope: openid, email, profile
    • Subject identifier (sub): Email address
    • Require PKCE: can be enabled (the module sends a PKCE S256)
  3. Note the Client ID ([appid]) and the Client Secret, then assign the application to the relevant users.

Configuration in Odoo​

1. Install the module​

Add auth_oidc to the addons path, install python-jose (pip install python-jose), then install the OpenID Connect Authentication module from Applications (or odoo -i auth_oidc).

2. Declare VaultysHub​

Settings → Users & Companies → OAuth Providers → New:

FieldValue
Provider NameVaultysHub
Auth FlowOpenID Connect (authorization code flow)
Client ID / Client Secretthose of the VaultysHub application
Authorization URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/auth
Token URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/token
JWKS URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/jwks
UserInfo URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo
Scopeopenid email profile
Token mapsub:user_id
Button labelLog in with VaultysHub
Enabledchecked

The module reads the user from the identity token: VaultysHub places email, email_verified, and name there.

3. Public address and reverse proxy​

The redirect URI is constructed from the request address:

  • run Odoo with --proxy-mode behind a reverse proxy (headers X-Forwarded-Host / X-Forwarded-Proto);
  • set web.base.url to the public address, and web.base.url.freeze to True (Settings → Technical → System Parameters).

4. Account creation (optional)​

By default, only an Odoo user already linked to the provider can log in. To create the account on the first pass:

  1. Settings → Permissions → Customer Signup: Free Access (parameter auth_signup.invitation_scope = b2c).
  2. Created accounts copy the model user from the parameter base.template_portal_user_id, which is a default portal user. To create internal users, create an inactive user with the desired rights (e.g., Employee) and specify their ID in this parameter.

VaultysHub does not pass groups: rights are managed in Odoo.

Test​

Open https://odoo.example.com/web/login → Log in with VaultysHub, validate with your VaultysID: you return logged in to Odoo.

Troubleshooting​

  • “Invalid redirect URI”: Odoo is not in --proxy-mode, or web.base.url does not match the public address. The sent URI must be exactly https://odoo.example.com/auth_oauth/signin.
  • “Access denied” / “Sign up is not allowed”: the user does not exist in Odoo and free signup is disabled (step 4).
  • Certificate error to VaultysHub: auth_oidc uses requests, which has its own certificate store (REQUESTS_CA_BUNDLE for an internal authority).

Resources​