diff --git a/auth_oauth_autologin/README.rst b/auth_oauth_autologin/README.rst new file mode 100644 index 0000000000..19767e9cae --- /dev/null +++ b/auth_oauth_autologin/README.rst @@ -0,0 +1,120 @@ +==================== +Auth Oauth Autologin +==================== + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:435818516444b963cf87e2c9fdb478ece9d33f578cde5960255b34cb5ffd84cd + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github + :target: https://github.com/OCA/server-auth/tree/18.0/auth_oauth_autologin + :alt: OCA/server-auth +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-auth-18-0/server-auth-18-0-auth_oauth_autologin + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=18.0 + :alt: Try me on Runboat + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This modules implements an automatic redirection to the configured OAuth +provider login page, if there is one and only one enabled. This +effectively makes the regular Odoo login screen invisible in normal +circumstances. + +**Table of contents** + +.. contents:: + :local: + +Configuration +============= + +Configure OAuth providers in Settings > Users and Companies, and make +sure there is one and only one that has both the enabled and automatic +login flags set. + +When this is done, users visiting the login page (/web/login), or being +redirected to it because they are not authenticated yet, will be +redirected to the identity provider login page instead of the regular +Odoo login page. + +Be aware that this module does not actively prevent users from +authenticating with an login and password stored in the Odoo database. +In some unusual circumstances (such as identity provider errors), the +regular Odoo login may still be displayed. Securely disabling Odoo login +and password, if needed, should be the topic of another module. + +Also be aware that this has a possibly surprising effect on the logout +menu item. When the user logs out of Odoo, a redirect to the login page +happens. The login page in turn redirects to the identity provider, +which, if the user is already authenticated there, automatically logs +the user back in Odoo, in a fresh session. + +Usage +===== + +When configured, the Odoo login page redirects to the OAuth identify +provider for authentication and login in Odoo. To access the regular +Odoo login page, visit ``/web/login?no_autologin``. + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +------- + +* ACSONE SA/NV + +Contributors +------------ + +- `Trobz `__: + + - Tuan Nguyen + +Maintainers +----------- + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +.. |maintainer-sbidoul| image:: https://github.com/sbidoul.png?size=40px + :target: https://github.com/sbidoul + :alt: sbidoul + +Current `maintainer `__: + +|maintainer-sbidoul| + +This module is part of the `OCA/server-auth `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auth_oauth_autologin/__init__.py b/auth_oauth_autologin/__init__.py new file mode 100644 index 0000000000..91c5580fed --- /dev/null +++ b/auth_oauth_autologin/__init__.py @@ -0,0 +1,2 @@ +from . import controllers +from . import models diff --git a/auth_oauth_autologin/__manifest__.py b/auth_oauth_autologin/__manifest__.py new file mode 100644 index 0000000000..becaca7ce6 --- /dev/null +++ b/auth_oauth_autologin/__manifest__.py @@ -0,0 +1,16 @@ +# Copyright 2021 ACSONE SA/NV +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +{ + "name": "Auth Oauth Autologin", + "summary": """ + Automatically redirect to the OAuth provider for login""", + "version": "18.0.1.0.0", + "license": "AGPL-3", + "author": "ACSONE SA/NV,Odoo Community Association (OCA)", + "maintainers": ["sbidoul"], + "website": "https://github.com/OCA/server-auth", + "depends": ["auth_oauth"], + "data": ["views/auth_oauth_provider.xml"], + "demo": [], +} diff --git a/auth_oauth_autologin/controllers/__init__.py b/auth_oauth_autologin/controllers/__init__.py new file mode 100644 index 0000000000..12a7e529b6 --- /dev/null +++ b/auth_oauth_autologin/controllers/__init__.py @@ -0,0 +1 @@ +from . import main diff --git a/auth_oauth_autologin/controllers/main.py b/auth_oauth_autologin/controllers/main.py new file mode 100644 index 0000000000..5f53abbd24 --- /dev/null +++ b/auth_oauth_autologin/controllers/main.py @@ -0,0 +1,33 @@ +# Copyright 2021 ACSONE SA/NV +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +from urllib.parse import parse_qsl, urlparse + +from odoo import http +from odoo.http import request + +from odoo.addons.auth_oauth.controllers.main import OAuthLogin + + +class OAuthAutoLogin(OAuthLogin): + def _autologin_disabled(self, redirect): + url = urlparse(redirect) + params = dict(parse_qsl(url.query, keep_blank_values=True)) + return "no_autologin" in params or "oauth_error" in params or "error" in params + + def _autologin_link(self): + providers = [p for p in self.list_providers() if p.get("autologin")] + if len(providers) == 1: + return providers[0].get("auth_link") + + @http.route() + def web_login(self, *args, **kw): + # Odoo 18 uses deep links, so the full URL path is available to the server. + # We can perform a server-side redirect if autologin is enabled. + if request.httprequest.method == "GET" and not self._autologin_disabled( + request.httprequest.url + ): + auth_link = self._autologin_link() + if auth_link: + return request.redirect(auth_link, 303, local=False) + return super().web_login(*args, **kw) diff --git a/auth_oauth_autologin/i18n/auth_oauth_autologin.pot b/auth_oauth_autologin/i18n/auth_oauth_autologin.pot new file mode 100644 index 0000000000..38ee1973b8 --- /dev/null +++ b/auth_oauth_autologin/i18n/auth_oauth_autologin.pot @@ -0,0 +1,33 @@ +# Translation of Odoo Server. +# This file contains the translation of the following modules: +# * auth_oauth_autologin +# +msgid "" +msgstr "" +"Project-Id-Version: Odoo Server 18.0+e\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2025-11-21 04:41+0000\n" +"PO-Revision-Date: 2025-11-21 04:41+0000\n" +"Last-Translator: \n" +"Language-Team: \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: \n" +"Plural-Forms: \n" + +#. module: auth_oauth_autologin +#: model:ir.model.fields,field_description:auth_oauth_autologin.field_auth_oauth_provider__autologin +msgid "Automatic Login" +msgstr "" + +#. module: auth_oauth_autologin +#: model:ir.model.fields,help:auth_oauth_autologin.field_auth_oauth_provider__autologin +msgid "" +"If exactly one enabled provider has this checked, the login screen redirects" +" to the OAuth provider." +msgstr "" + +#. module: auth_oauth_autologin +#: model:ir.model,name:auth_oauth_autologin.model_auth_oauth_provider +msgid "OAuth2 provider" +msgstr "" diff --git a/auth_oauth_autologin/i18n/it.po b/auth_oauth_autologin/i18n/it.po new file mode 100644 index 0000000000..4cbd4c62a3 --- /dev/null +++ b/auth_oauth_autologin/i18n/it.po @@ -0,0 +1,35 @@ +# Translation of Odoo Server. +# This file contains the translation of the following modules: +# * auth_oauth_autologin +# +msgid "" +msgstr "" +"Project-Id-Version: Odoo Server 18.0+e\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2025-11-21 04:32+0000\n" +"PO-Revision-Date: 2025-11-21 04:32+0000\n" +"Last-Translator: \n" +"Language-Team: \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: \n" +"Plural-Forms: \n" + +#. module: auth_oauth_autologin +#: model:ir.model.fields,field_description:auth_oauth_autologin.field_auth_oauth_provider__autologin +msgid "Automatic Login" +msgstr "Accesso automatico" + +#. module: auth_oauth_autologin +#: model:ir.model.fields,help:auth_oauth_autologin.field_auth_oauth_provider__autologin +msgid "" +"If exactly one enabled provider has this checked, the login screen redirects" +" to the OAuth provider." +msgstr "" +"Se un solo provider abilitato ha selezionato questa opzione, la schermata di" +" accesso reindirizza al provider OAuth." + +#. module: auth_oauth_autologin +#: model:ir.model,name:auth_oauth_autologin.model_auth_oauth_provider +msgid "OAuth2 provider" +msgstr "Fornitore OAuth2" diff --git a/auth_oauth_autologin/models/__init__.py b/auth_oauth_autologin/models/__init__.py new file mode 100644 index 0000000000..4bc62d3ab5 --- /dev/null +++ b/auth_oauth_autologin/models/__init__.py @@ -0,0 +1 @@ +from . import auth_oauth_provider diff --git a/auth_oauth_autologin/models/auth_oauth_provider.py b/auth_oauth_autologin/models/auth_oauth_provider.py new file mode 100644 index 0000000000..6abefad5e9 --- /dev/null +++ b/auth_oauth_autologin/models/auth_oauth_provider.py @@ -0,0 +1,16 @@ +# Copyright 2021 ACSONE SA/NV +# License: AGPL-3.0 or later (http://www.gnu.org/licenses/agpl) + +from odoo import fields, models + + +class AuthOauthProvider(models.Model): + _inherit = "auth.oauth.provider" + + autologin = fields.Boolean( + string="Automatic Login", + help=( + "If exactly one enabled provider has this checked, " + "the login screen redirects to the OAuth provider." + ), + ) diff --git a/auth_oauth_autologin/pyproject.toml b/auth_oauth_autologin/pyproject.toml new file mode 100644 index 0000000000..4231d0cccb --- /dev/null +++ b/auth_oauth_autologin/pyproject.toml @@ -0,0 +1,3 @@ +[build-system] +requires = ["whool"] +build-backend = "whool.buildapi" diff --git a/auth_oauth_autologin/readme/CONFIGURE.md b/auth_oauth_autologin/readme/CONFIGURE.md new file mode 100644 index 0000000000..7a720b57dc --- /dev/null +++ b/auth_oauth_autologin/readme/CONFIGURE.md @@ -0,0 +1,20 @@ +Configure OAuth providers in Settings \> Users and Companies, and make +sure there is one and only one that has both the enabled and automatic +login flags set. + +When this is done, users visiting the login page (/web/login), or being +redirected to it because they are not authenticated yet, will be +redirected to the identity provider login page instead of the regular +Odoo login page. + +Be aware that this module does not actively prevent users from +authenticating with an login and password stored in the Odoo database. +In some unusual circumstances (such as identity provider errors), the +regular Odoo login may still be displayed. Securely disabling Odoo login +and password, if needed, should be the topic of another module. + +Also be aware that this has a possibly surprising effect on the logout +menu item. When the user logs out of Odoo, a redirect to the login page +happens. The login page in turn redirects to the identity provider, +which, if the user is already authenticated there, automatically logs +the user back in Odoo, in a fresh session. diff --git a/auth_oauth_autologin/readme/CONTRIBUTORS.md b/auth_oauth_autologin/readme/CONTRIBUTORS.md new file mode 100644 index 0000000000..56787ffce2 --- /dev/null +++ b/auth_oauth_autologin/readme/CONTRIBUTORS.md @@ -0,0 +1,2 @@ +- [Trobz](https://trobz.com): + - Tuan Nguyen \<\> diff --git a/auth_oauth_autologin/readme/DESCRIPTION.md b/auth_oauth_autologin/readme/DESCRIPTION.md new file mode 100644 index 0000000000..415e3f901e --- /dev/null +++ b/auth_oauth_autologin/readme/DESCRIPTION.md @@ -0,0 +1,4 @@ +This modules implements an automatic redirection to the configured OAuth +provider login page, if there is one and only one enabled. This +effectively makes the regular Odoo login screen invisible in normal +circumstances. diff --git a/auth_oauth_autologin/readme/USAGE.md b/auth_oauth_autologin/readme/USAGE.md new file mode 100644 index 0000000000..06f26e76c8 --- /dev/null +++ b/auth_oauth_autologin/readme/USAGE.md @@ -0,0 +1,3 @@ +When configured, the Odoo login page redirects to the OAuth identify +provider for authentication and login in Odoo. To access the regular +Odoo login page, visit `/web/login?no_autologin`. diff --git a/auth_oauth_autologin/static/description/index.html b/auth_oauth_autologin/static/description/index.html new file mode 100644 index 0000000000..17d07d9463 --- /dev/null +++ b/auth_oauth_autologin/static/description/index.html @@ -0,0 +1,459 @@ + + + + + +Auth Oauth Autologin + + + +
+

Auth Oauth Autologin

+ + +

Beta License: AGPL-3 OCA/server-auth Translate me on Weblate Try me on Runboat

+

This modules implements an automatic redirection to the configured OAuth +provider login page, if there is one and only one enabled. This +effectively makes the regular Odoo login screen invisible in normal +circumstances.

+

Table of contents

+ +
+

Configuration

+

Configure OAuth providers in Settings > Users and Companies, and make +sure there is one and only one that has both the enabled and automatic +login flags set.

+

When this is done, users visiting the login page (/web/login), or being +redirected to it because they are not authenticated yet, will be +redirected to the identity provider login page instead of the regular +Odoo login page.

+

Be aware that this module does not actively prevent users from +authenticating with an login and password stored in the Odoo database. +In some unusual circumstances (such as identity provider errors), the +regular Odoo login may still be displayed. Securely disabling Odoo login +and password, if needed, should be the topic of another module.

+

Also be aware that this has a possibly surprising effect on the logout +menu item. When the user logs out of Odoo, a redirect to the login page +happens. The login page in turn redirects to the identity provider, +which, if the user is already authenticated there, automatically logs +the user back in Odoo, in a fresh session.

+
+
+

Usage

+

When configured, the Odoo login page redirects to the OAuth identify +provider for authentication and login in Odoo. To access the regular +Odoo login page, visit /web/login?no_autologin.

+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • ACSONE SA/NV
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+ +Odoo Community Association + +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

Current maintainer:

+

sbidoul

+

This module is part of the OCA/server-auth project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/auth_oauth_autologin/tests/__init__.py b/auth_oauth_autologin/tests/__init__.py new file mode 100644 index 0000000000..0f7752b96b --- /dev/null +++ b/auth_oauth_autologin/tests/__init__.py @@ -0,0 +1 @@ +from . import test_oauth_auto_login diff --git a/auth_oauth_autologin/tests/test_oauth_auto_login.py b/auth_oauth_autologin/tests/test_oauth_auto_login.py new file mode 100644 index 0000000000..3a1f4065f2 --- /dev/null +++ b/auth_oauth_autologin/tests/test_oauth_auto_login.py @@ -0,0 +1,148 @@ +# Copyright 2021 ACSONE SA/NV +# License: AGPL-3.0 or later (http://www.gnu.org/licenses/agpl) + +from unittest.mock import Mock, patch + +from odoo.http import Response +from odoo.tests import common + +from odoo.addons.website.tools import MockRequest + +from ..controllers.main import OAuthAutoLogin + +LOGIN_URL = "http://localhost/web/login" + + +class TestOauthAutoLogin(common.HttpCase): + def mock_redirect(self, redirect_url, code, local): + """Mock redirect to capture parameters""" + self.redirect_url = redirect_url + self.redirect_code = code + self.is_local_redirect = local + return Mock() + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_skip_auto_login_if_already_logged_in(self, mock_web_login): + """Test that auto login is skipped if user is logged in""" + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + with MockRequest(self.env) as request: + request.session = mock_session + result = OAuthAutoLogin().web_login.__wrapped__(OAuthAutoLogin()) + self.assertEqual(response, result) + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_skip_auto_login_if_no_autologin_parameter_exists(self, mock_web_login): + """Test that auto login is skipped if no_autologin parameter exists""" + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + with MockRequest(self.env) as request: + request.session = mock_session + mock_session.uid = False + request.httprequest.url = LOGIN_URL + "?no_autologin" + result = OAuthAutoLogin().web_login.__wrapped__(OAuthAutoLogin()) + self.assertEqual(response, result) + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_skip_auto_login_if_oauth_error_parameter_exists(self, mock_web_login): + """Test that auto login is skipped if oauth_error parameter exists""" + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + with MockRequest(self.env) as request: + request.session = mock_session + mock_session.uid = False + request.httprequest.url = LOGIN_URL + "?oauth_error=1" + result = OAuthAutoLogin().web_login.__wrapped__(OAuthAutoLogin()) + self.assertEqual(response, result) + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_skip_auto_login_if_error_parameter_exists(self, mock_web_login): + """Test that auto login is skipped if error parameter exists""" + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + with MockRequest(self.env) as request: + request.session = mock_session + mock_session.uid = False + request.httprequest.url = LOGIN_URL + "?error=test" + result = OAuthAutoLogin().web_login.__wrapped__(OAuthAutoLogin()) + self.assertEqual(response, result) + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_skip_auto_login_if_no_provider_has_autologin_set(self, mock_web_login): + """Test that auto login is skipped if error parameter exists""" + instance = OAuthAutoLogin() + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + provider = {} + provider["autologin"] = False + provider["auth_link"] = "https://keycloak.test" + providers = [provider] + with ( + MockRequest(self.env) as request, + patch.object(instance, "list_providers", return_value=providers), + ): + request.session = mock_session + mock_session.uid = False + request.httprequest.url = LOGIN_URL + result = instance.web_login.__wrapped__(instance) + self.assertEqual(response, result) + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_skip_auto_login_if_the_provider_has_no_auth_link(self, mock_web_login): + """Test that auto login is skipped if error parameter exists""" + instance = OAuthAutoLogin() + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + provider = {} + provider["autologin"] = True + providers = [provider] + with ( + MockRequest(self.env) as request, + patch.object(instance, "list_providers", return_value=providers), + ): + request.session = mock_session + mock_session.uid = False + request.httprequest.url = LOGIN_URL + result = instance.web_login.__wrapped__(instance) + self.assertEqual(response, result) + + @patch("odoo.addons.auth_oauth.controllers.main.OAuthLogin.web_login") + def test_oauth_auto_login_with_enabled_provider(self, mock_web_login): + """Test that auto login works if enabled""" + instance = OAuthAutoLogin() + mock_session = Mock() + response = Response() + mock_web_login.return_value = response + provider_1 = {} + provider_1["autologin"] = False + provider_1["auth_link"] = "https://keycloak1.test" + auth_link_2 = "https://keycloak2.test" + provider_2 = {} + provider_2["autologin"] = True + provider_2["auth_link"] = auth_link_2 + providers = [provider_1, provider_2] + with ( + MockRequest(self.env) as request, + patch.object(instance, "list_providers", return_value=providers), + ): + request.session = mock_session + mock_session.uid = False + request.httprequest.url = LOGIN_URL + request.httprequest.method = "GET" + request.redirect = self.mock_redirect + + instance.web_login.__wrapped__(instance) + + # Verify redirect was called correctly + self.assertEqual(auth_link_2, self.redirect_url) + self.assertEqual(303, self.redirect_code) + self.assertFalse(self.is_local_redirect) + + # Verify super was NOT called + self.assertFalse(mock_web_login.called) diff --git a/auth_oauth_autologin/views/auth_oauth_provider.xml b/auth_oauth_autologin/views/auth_oauth_provider.xml new file mode 100644 index 0000000000..ca3e06beaf --- /dev/null +++ b/auth_oauth_autologin/views/auth_oauth_provider.xml @@ -0,0 +1,23 @@ + + + + auth.oauth.autologin.provider.form + auth.oauth.provider + + + + + + + + + auth.oauth.autologin.provider.form + auth.oauth.provider + + + + + + + +