Securing Odoo at Scale: Layered Authentication & Privacy Best Practices (Odoo 18 & 19) From OAuth2 to OpenID Connect — building a multi-layered security model that protects user identity, data, and APIs. Security in modern Odoo deployments is no longer just about login forms and passwords. It is about building a layered defense system that protects: User identity (authentication) Access control (authorization) Data in transit and at rest API interactions and integrations With the rise of distributed systems and SaaS integrations, relying on a single authentication method is no longer enough. Enterprises now combine OpenID Connect (OIDC) providers like AWS Cognito or Keycloak with OAuth2 providers like GitHub. This is where our latest contribution to the OCA server-auth repository introduces a Hybrid Authentication Model — ...
How to Authenticate Odoo with AWS Cognito, OpenID & GitHub This guide covers the full setup to transform Odoo into a secure JWT-powered portal. Step 1: AWS Cognito Setup (The Identity Provider) Before touching Odoo, you must configure your User Pool. Create a User Pool : Set your sign-in attributes (Email/Username). Create an App Client : Crucial : Check "Generate client secret" (required for Authorization Code Grant). Managed Login Settings : Callback URL : http://localhost:8069/auth_oauth/signin (or your ngrok/domain). OAuth Flows : Select Authorization code grant . Scopes : Select openid , email , and profile . Note your credentials : You need the Client ID , Client Secret , and User Pool ID . Step 2: Install Required OCA Modules Standard Odoo OAuth is limited. For Cognito/OpenID, you need the OCA Server-Auth suite. Download the OCA Repository : Clone https://github.com . Add to Addons Path : Include the server-auth folder in your odoo.conf . Install the fo...