System parameter

By default this module does not allow the same user to connect from different browser sessions at the same time. It generates a new random pseudo-password (sso_key) that will be different at each session creation. To allow the same user to connect from different browser sessions, a system parameter can be configured with a secret. At session creation, the pseudo-password generated will be a hash based on the secret and the user id making the pseudo-password the same for each session of the same user. The system parameter key must be

http_remote_user.secret

and the value can be any string (Ex: 123456789abcdefgh).

Use case.

The module allows integration with external security systems [1] that can pass along authentication of a user via Remote_User HTTP header field. In many cases, this is achieved via server like Apache HTTPD or nginx proxying Odoo.

<VirtualHost *:80>
 ServerName MY_VHOST.com
 ProxyRequests Off
...

 RequestHeader unset Remote-User early
 ProxyPass / http://127.0.0.1:8069/  retry=10
 ProxyPassReverse  / http://127.0.0.1:8069/
 ProxyPreserveHost On
</VirtualHost>

How to test the module with Apache [2]

Apache can be used as a reverse proxy providing the authentication and adding the required field in the Http headers.

Install apache:

$ sudo apt-get install apache2

Define a new vhost to Apache by putting a new file in /etc/apache2/sites-available:

$ sudo vi  /etc/apache2/sites-available/MY_VHOST.com

with the following content:

<VirtualHost *:80>
  ServerName MY_VHOST.com
  ProxyRequests Off
  <Location />
    AuthType Basic
    AuthName "Test Odoo auth_from_http_remote_user"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/MY_VHOST.htpasswd
    Require valid-user

    RewriteEngine On
    RewriteCond %{LA-U:REMOTE_USER} (.+)
    RewriteRule . - [E=RU:%1]
    RequestHeader set Remote-User "%{RU}e" env=RU
  </Location>

  RequestHeader unset Remote-User early
  ProxyPass / http://127.0.0.1:8069/  retry=10
  ProxyPassReverse  / http://127.0.0.1:8069/
  ProxyPreserveHost On
</VirtualHost>

DEBUG openerp1 openerp.addons.auth_from_http_remote_user.controllers.
session:
Field 'HTTP_MY_REMOTE_USER' not found in http headers
{'HTTP_AUTHORIZATION': 'Basic YWRtaW46YWRtaW4=', ...,
'HTTP_REMOTE_USER': 'demo')

Enable the required apache modules:

$ sudo a2enmod headers
$ sudo a2enmod proxy
$ sudo a2enmod rewrite
$ sudo a2enmod proxy_http

Enable your new vhost:

$ sudo a2ensite MY_VHOST.com

Create the htpassword file used by the configured basic authentication:

$ sudo htpasswd -cb /etc/apache2/MY_VHOST.htpasswd admin admin
$ sudo htpasswd -b /etc/apache2/MY_VHOST.htpasswd demo demo

For local test, add the MY_VHOST.com in your /etc/vhosts file.

Finally reload the configuration:

$ sudo service apache2 reload

Open your browser and go to MY_VHOST.com. If everything is well configured, you are prompted for a login and password outside Odoo and are automatically logged in the system.

Bug Tracker

Bugs are tracked on GitHub Issues. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us smashing it by providing a detailed and welcomed feedback.

Credits

Maintainer

This module is maintained by the OCA.

OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use.

To contribute to this module, please visit https://odoo-community.org.