<a class="reference external image-reference" href="http://www.gnu.org/licenses/agpl-3.0-standalone.html"><img alt="License: AGPL-3" src="https://img.shields.io/badge/licence-AGPL--3-blue.svg"> </a> <a name="oauth-provider"></a> <h2>OAuth Provider</h2> <p>This module allows you to turn Odoo into an OAuth 2 provider.</p> <p>It's meant to provide the basic authentication feature, and some data access routes. But you are encouraged to create custom routes, in other modules, to give structured data for any specific need.</p> <a name="installation"></a> <h3>Installation</h3> <p>To install this module, you need to:</p> <ol class="arabic simple"> <li>Install the oauthlib python module</li> <li>Install the module like any other in Odoo</li> <li>For the token retrieval to work on a multi-database instance, you should add this module in the server_wide_modules list</li> </ol> <a name="configuration"></a> <h3>Configuration</h3> <p>This module requires you to configure two things :</p> <ol class="arabic simple"> <li>The scopes are used to define restricted data access</li> <li>The clients are used to declare applications that will be allowed to request tokens and data</li> </ol> <p>To configure scopes, you need to:</p> <ol class="arabic simple"> <li>Go to Settings &gt; Users &gt; OAuth Provider Scopes</li> <li>Create some scopes:</li> </ol> <blockquote> <ul class="simple"> <li>The scope name and description will be displayed to the user on the authorization page.</li> <li>The code is the value provided by the OAuth clients to request access to the scope.</li> <li>The model defines which model the scope is linked to (access to user data, partners, sales orders, etc.).</li> <li>The filter allows you to determine which records will be accessible through this scope. No filter means all records of the model are accessible.</li> <li>The field names allows you to define which fields will be provided to the clients. An empty list only returns the id of accessible records.</li> </ul> </blockquote> <p>To configure clients, you need to:</p> <ol class="arabic simple"> <li>Go to Settings &gt; Users &gt; OAuth Provider Clients</li> <li>Create at least one client:</li> </ol> <blockquote> <ul class="simple"> <li>The name will be displayed to the user on the authorization page.</li> <li>The client identifier is the value provided by the OAuth clients to request authorizations/tokens.</li> <li>The application type adapts the process to four pre-defined profiles:<ul> <li>Web Application : Authorization Code Grant</li> <li>Mobile Application : Implicit Grant</li> <li>Legacy Application : Resource Owner Password Credentials Grant</li> <li>Backend Application : User Credentials Grant (not implemented yet)</li> </ul> </li> <li>The skip authorization checkbox allows the client to skip the authorization page, and directly deliver a token without prompting the user (useful when the application is trusted).</li> <li>The allowed scopes list defines which data will be accessible by this client applicaton.</li> <li>The allowed redirect URIs must match the URI sent by the client, to avoid redirecting users to an unauthorized service. The first value in the list is the default redirect URI.</li> </ul> </blockquote> <p>For example, to configure an Odoo's <em>auth_oauth</em> module compatible client, you will enter these values :</p> <ul class="simple"> <li>Name : Anything you want</li> <li>Client identifier : The identifier you want to give to this client</li> <li>Application Type : Mobile Application (Odoo uses the implicit grant mode, which corresponds to the mobile application profile)</li> <li>Allowed Scopes : Nothing required, but allowing access to current user's email and name is used by Odoo to fill user's information on signup</li> <li>Allowed Redirect URIs : <a class="reference external" href="http://odoo.example.com/auth_oauth/signin">http://odoo.example.com/auth_oauth/signin</a></li> </ul> <a name="usage"></a> <h3>Usage</h3> <p>This module will allow OAuth clients to use your Odoo instance as an OAuth provider.</p> <p>Once configured, you must give these information to your client application :</p> <ol class="arabic simple"> <li>Client identifier : Identifies the application (to be able to check allowed scopes and redirect URIs)</li> <li>Allowed scopes : The codes of scopes allowed for this client</li> <li>URLs for the requests :</li> </ol> <blockquote> <ul> <li><p class="first">Authorization request : <a class="reference external" href="http://odoo.example.com/oauth2/authorize">http://odoo.example.com/oauth2/authorize</a></p> </li> <li><p class="first">Token request : <a class="reference external" href="http://odoo.example.com/oauth2/token">http://odoo.example.com/oauth2/token</a></p> </li> <li><dl class="first docutils"> <dt>Token information request <span class="classifier-delimiter">:</span> <span class="classifier"><a class="reference external" href="http://odoo.example.com/oauth2/tokeninfo">http://odoo.example.com/oauth2/tokeninfo</a></span></dt> <dd><p class="first last">Parameters : access_token</p> </dd> </dl> </li> <li><dl class="first docutils"> <dt>User information request <span class="classifier-delimiter">:</span> <span class="classifier"><a class="reference external" href="http://odoo.example.com/oauth2/userinfo">http://odoo.example.com/oauth2/userinfo</a></span></dt> <dd><p class="first last">Parameters : access_token</p> </dd> </dl> </li> <li><dl class="first docutils"> <dt>Any other model information request (depending on the scopes) <span class="classifier-delimiter">:</span> <span class="classifier"><a class="reference external" href="http://odoo.example.com/oauth2/otherinfo">http://odoo.example.com/oauth2/otherinfo</a></span></dt> <dd><p class="first last">Parameters : access_token and model</p> </dd> </dl> </li> </ul> </blockquote> <p>For example, to configure the <em>auth_oauth</em> Odoo module as a client, you will enter these values :</p> <ul class="simple"> <li>Provider name : Anything you want</li> <li>Client ID : The identifier of the client configured in your Odoo Provider instance</li> <li>Body : Text displayed on Odoo's login page link</li> <li>Authentication URL : <a class="reference external" href="http://odoo.example.com/oauth2/authorize">http://odoo.example.com/oauth2/authorize</a></li> <li>Scope : A space separated list of scope codes allowed to the client in your Odoo Provider instance</li> <li>Validation URL : <a class="reference external" href="http://odoo.example.com/oauth2/tokeninfo">http://odoo.example.com/oauth2/tokeninfo</a></li> <li>Data URL : <a class="reference external" href="http://odoo.example.com/oauth2/userinfo">http://odoo.example.com/oauth2/userinfo</a></li> </ul> <a class="reference external image-reference" href="https://runbot.odoo-community.org/runbot/149/9.0"><img alt="Try me on Runbot" src="https://odoo-community.org/website/image/ir.attachment/5784_f2813bd/datas" /></a> <a name="known-issues-roadmap"></a> <h3>Known issues / Roadmap</h3> <ul class="simple"> <li>Implement the backend application profile (client credentials grant type)</li> <li>Add checkboxes on the authorization page to allow the user to disable some scopes for a token ? (I don't know if this is allowed in the OAuth protocol)</li> </ul> <a name="bug-tracker"></a> <h3>Bug Tracker</h3> <p>Bugs are tracked on <a class="reference external" href="https://github.com/OCA/server-tools/issues">GitHub Issues</a>. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us smashing it by providing a detailed and welcomed feedback.</p> <a name="credits"></a> <h3>Credits</h3> <a name="images"></a> <h4>Images</h4> <ul class="simple"> <li>Odoo Community Association: <a class="reference external" href="https://github.com/OCA/maintainer-tools/blob/master/template/module/static/description/icon.svg">Icon</a>.</li> </ul> <a name="contributors"></a> <h4>Contributors</h4> <ul class="simple"> <li>Sylvain Garancher &lt;<a class="reference external" href="mailto:sylvain.garancher&#64;syleam.fr">sylvain.garancher&#64;syleam.fr</a>&gt;</li> </ul> <a name="maintainer"></a> <h4>Maintainer</h4> <a class="reference external image-reference" href="https://odoo-community.org"><img alt="Odoo Community Association" src="https://odoo-community.org/logo.png" /></a> <p>This module is maintained by the OCA.</p> <p>OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use.</p> <p>To contribute to this module, please visit <a class="reference external" href="https://odoo-community.org">https://odoo-community.org</a>.</p>