Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
en:2.0:single_sign_on:saml_odoo [2026/09/05 22:27] – [Quick Overview] kainhoferen:2.0:single_sign_on:saml_odoo [2026/09/05 23:14] (current) – [Caveats and Things to Consider] kainhofer
Line 119: Line 119:
  
   * Odoo does NOT automatically create a new user account if a successful login from an unknown Admidio account occurs. Instead, one first has to create a new user (or connect an existing user) and connect that user with the proper Admidio user account name. In Admidio's SAML client config, you can select whether to use the numeric user ID, the login name or the email as "User ID field". Whatever you choose determines which value must be entered in Odoo's user connection field.   * Odoo does NOT automatically create a new user account if a successful login from an unknown Admidio account occurs. Instead, one first has to create a new user (or connect an existing user) and connect that user with the proper Admidio user account name. In Admidio's SAML client config, you can select whether to use the numeric user ID, the login name or the email as "User ID field". Whatever you choose determines which value must be entered in Odoo's user connection field.
 +  * Odoo does not support SAML Single-Log-Out, so logging out from Odoo will not log the user out from Admidio or other SAML or OIDC clients.
 +  * Odoo's SAML User IDs are case-sensitive. If your Admidio username is "Member", you can log into Admidio using "member", but in Odoo's SAML user ID you must use the original "Member". 
   * To install the SAML plugin, odoo needs the "pysaml2" library installed first. It can for example be installed from the shell with <code>php3 install pysaml2</code>   * To install the SAML plugin, odoo needs the "pysaml2" library installed first. It can for example be installed from the shell with <code>php3 install pysaml2</code>
   * If odoo is behind a reverse proxy (e.g. Nginx Proxy Manager), correct proxy settings both in Odoo and the proxy itself is vital to make sure that the SAML endpoints in the metadata file and the actually called endpoints actually use https. Otherwise, login will fail without a helpful error message.   * If odoo is behind a reverse proxy (e.g. Nginx Proxy Manager), correct proxy settings both in Odoo and the proxy itself is vital to make sure that the SAML endpoints in the metadata file and the actually called endpoints actually use https. Otherwise, login will fail without a helpful error message.
     * In `odoo.conf` set <code>proxy_mode = 1</code>     * In `odoo.conf` set <code>proxy_mode = 1</code>
     * Make sure the reverse proxy sends all proper proxy headers, including X-FORWARDED-HOST, which is used by odoo to detect a reverse proxy setup. Nginx Proxy Manager by default does not send this header. It is also not easily possible to add this header in the "Advanced" tab of the Proxy Host in NPM. Instead, one has to add Custom Location for "/" and set the X-Forwarded-Host header there via <code>proxy_set_header X-Forwarded-Host $host;</code> You need to duplicate the forwarding host information from the main host:{{ :en:2.0:sso:sso_saml_odoo_12_npm_x-forwarded-host.png?direct&400 |}}     * Make sure the reverse proxy sends all proper proxy headers, including X-FORWARDED-HOST, which is used by odoo to detect a reverse proxy setup. Nginx Proxy Manager by default does not send this header. It is also not easily possible to add this header in the "Advanced" tab of the Proxy Host in NPM. Instead, one has to add Custom Location for "/" and set the X-Forwarded-Host header there via <code>proxy_set_header X-Forwarded-Host $host;</code> You need to duplicate the forwarding host information from the main host:{{ :en:2.0:sso:sso_saml_odoo_12_npm_x-forwarded-host.png?direct&400 |}}
  • en/2.0/single_sign_on/saml_odoo.txt
  • Last modified: 2026/09/05 23:14
  • by kainhofer