Skip to content

[20.0][MIG] auth_saml: Migration to 20.0 - #1040

Open
astirpe wants to merge 89 commits into
OCA:20.0from
astirpe:20_mig_auth_saml
Open

astirpe wants to merge 89 commits into
OCA:20.0from
astirpe:20_mig_auth_saml

Conversation

@astirpe

@astirpe astirpe commented Oct 15, 2026

Copy link
Copy Markdown
Member

Includes #1020

max3903 and others added 30 commits October 15, 2026 14:30
The following line of code for 11.0:
 - https://github.com/odoo/odoo/blob/52d6f0e3ee90874fc93fec9cdff74ec71d3b991f/addons/auth_oauth/controllers/main.py#L69

is assigning the key "auth_link" for "list_providers" method.

The following template is expecting this key:
 - https://github.com/odoo/odoo/blob/52d6f0e3ee90874fc93fec9cdff74ec71d3b991f/addons/auth_oauth/views/auth_oauth_templates.xml#L5

So, it raise a KeyError compiling "template_auth_oauth_providers_N"

This change is fixing adding that expected key in order to avoid this KeyError
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: server-auth-11.0/server-auth-11.0-auth_saml
Translate-URL: https://translation.odoo-community.org/projects/server-auth-11-0/server-auth-11-0-auth_saml/
[FIX] dependencies
add requirement on lasso
- Default behavior is now to allow password and SAML together.
  Otherwise, users could keep getting their passwords removed without warning.
- General cleanup.
- Remove relations to field `password_crypt` because in v12 the
  `password` field is always encrypted instead.

Co-Authored-By: Alexandre Díaz <alexandre.diaz@tecnativa.com>
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: server-auth-12.0/server-auth-12.0-auth_saml
Translate-URL: https://translation.odoo-community.org/projects/server-auth-12-0/server-auth-12-0-auth_saml/
Currently translated at 100.0% (37 of 37 strings)

Translation: server-auth-15.0/server-auth-15.0-auth_saml
Translate-URL: https://translation.odoo-community.org/projects/server-auth-15-0/server-auth-15-0-auth_saml/fr/
🚑 Fix the disallow password for users with SAML ids
Added tests to ensure the feature works correctly.
Admin user is also an exception from not having a password. In Odoo 15.0, this is the standard user to connect for administrative task, not the super user.
✨ Improve provider form and list views
✨⏩ port of 11.0 automatic redirection from 11.0 version. Use disable_autoredirect as a parameter query to disable automatic redirection (for example https://example.com/web/login?disable_autoredirect=)
💄 Add certificate file name fields to improve the UI
📝 Add required on several fields of the SAML provider; without them the server will crash and there is not enough information to make SAML work.
✨ Split signing to have finer control and be compatible with more IDP.
🔨 Integrate token into res.users.saml, removing auth_saml.token. No need for a separate table, and no more need to create lines in the table.
📝 Avoid server errors when user try metadata page without necessary parameters.
🚑 Replace method call from odoo.http.redirect_with_hash to request.redirect as the former does not exists in Odoo 15.0 anymore.
📚 Improved the module documentation
👕 pylint fixes and other fixes or minor changes
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: server-auth-15.0/server-auth-15.0-auth_saml
Translate-URL: https://translation.odoo-community.org/projects/server-auth-15-0/server-auth-15-0-auth_saml/
vincent-hatakeyama and others added 16 commits October 15, 2026 14:30
When using mapping, not writing the value systematically avoids getting
security mail on login/email changes when there is no change.
Also use SQL for blanking passwords avoids the security update mails.
Currently translated at 100.0% (93 of 93 strings)

Translation: server-auth-18.0/server-auth-18.0-auth_saml
Translate-URL: https://translation.odoo-community.org/projects/server-auth-18-0/server-auth-18-0-auth_saml/it/
- custom message when response is too old
- avoid using werkzeug.urls method, they are deprecated
- add missing ondelete cascade when user is deleted
- attribute mapping is now also duplicated when the provider is duplicated
- factorize getting SAML attribute value, allowing using subject.nameId in mapping attributes too
- add an opton to reactivate user when finding an user and creation is
  enabled
Currently translated at 100.0% (93 of 93 strings)

Translation: server-auth-19.0/server-auth-19.0-auth_saml
Translate-URL: https://translation.odoo-community.org/projects/server-auth-19-0/server-auth-19-0-auth_saml/fr/
@astirpe
astirpe marked this pull request as ready for review October 15, 2026 13:38
@astirpe astirpe mentioned this pull request Oct 15, 2026
10 tasks
@CasVissers-360ERP

Copy link
Copy Markdown
Contributor

@astirpe Font Awesome is no longer available in 20.0 so the login icon doesn't work. Can you check?

@CasVissers-360ERP

Copy link
Copy Markdown
Contributor

Nevermind just saw your comment. Let me know when it can be retested.

@astirpe

astirpe commented Oct 19, 2026

Copy link
Copy Markdown
Member Author

@CasVissers-360ERP
Yes, thanks! In the last commit I changed the css_class field default value and added a migration script for databases upgraded from 19.0. Could you check?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.