Bitwerf · Odoo apps

OpenID Connect Provider

Let your other apps sign users in with their Odoo account, through standard OpenID Connect.

Watch the short demo video

Wikis, help centers, dashboards and in-house tools can often sign people in with OpenID Connect. This module makes Odoo the identity provider for them: register an app, give it the discovery URL, its Client ID and secret, and your users sign in with their Odoo login. Odoo asks the user's consent, signs an ID token and shares only the data you allow for that app.

What it does

Standard OpenID Connect

Discovery document, published signing keys (JWKS), authorization code flow, token, user info, revocation and sign-out endpoints. ID tokens are signed with RS256 and carry issuer, subject, audience, expiry, nonce and access token hash, so OpenID Connect client libraries can check them.

Consent once per user and app

Users see which app asks and what it will receive, and choose Allow or Cancel. The answer is remembered per app until an administrator revokes it. Mark your own apps as trusted to skip the page.

You choose what each app receives

Name and login, email address, phone number and postal address are switched on per app. Switching one off also stops it for tokens the app already holds. Optionally tell an app that email addresses are verified.

You choose who may sign in

Internal users only, or internal and portal users, and optionally only members of chosen groups. Users outside those rules get a clear page instead of a sign-in, and their access tokens stop working at once.

Server, browser and mobile apps

Server apps authenticate with a client secret (HTTP Basic or form fields); browser and mobile apps use PKCE (S256) without a secret, and you can require PKCE for server apps too. Discovery, keys, token and user info answer browser apps (CORS).

Tokens that cannot be replayed

Codes work once and for two minutes. A code or refresh token used twice ends everything issued from that sign-in, and refresh tokens change at every use (or are switched off per app). Codes, tokens and client secrets are stored only as SHA-256 fingerprints; a new secret is shown once.

Silent sign-in and fresh sign-in

prompt=none answers without any page (login_required, consent_required), prompt=login and max_age make the user sign in to Odoo again, and auth_time tells the app when that happened. login_hint fills in the login field.

Sign-out, sign-ins and keys

Apps can send users to the sign-out endpoint and back to a registered address. The Sign-ins list shows who uses which app, since when and how often, with a Revoke button. Signing keys rotate with one click; the previous key stays published for a week.

How to use it

1. Install the module and open Settings > Users & Companies > OpenID Connect Apps. Create an app with its name and redirect URI, and choose the data it may receive.
2. Click New Client Secret and copy the secret and the Client ID into the app. Browser and mobile apps use the PKCE type and need no secret.
3. In the app, set up OpenID Connect with the discovery URL from the Endpoints tab, for example https://erp.example.com/.well-known/openid-configuration, and the scopes openid profile email.
4. Users click the app's sign-in button, log in to Odoo when needed and allow the app once.
5. Follow who signed in under Settings > Users & Companies > OpenID Connect Sign-ins, and revoke a sign-in when needed.

Screenshots

The consent page a user sees the first time an app asks to sign them in with their Odoo account.

Sign-ins: which user uses which app, what they share, when they last signed in, and Revoke.

Need it to work differently?

We build custom Odoo modules and changes to this one at a fixed price, from €950 excluding VAT. Small modules are usually delivered within five working days, tested on your Odoo version. Describe what you need to hello@bizzkitt.ai.

All Odoo apps by Bitwerf

Bitwerf is a trade name of BizzKitt B.V., Frederikstraat 67, 3034 LD Rotterdam, the Netherlands (KvK 42149345, VAT NL869932354B01). Questions: hello@bizzkitt.ai · Support · Privacy · Terms