[5188][ADD] auth_oauth_enforced #60

nobuQuartile · 2025-01-15T05:06:28Z

yostashiro

@nobuQuartile Can you please rename the module to auth_oauth_enforced? Please also fix the pre-commit error.

nobuQuartile · 2025-01-15T06:57:50Z

@yostashiro
Thank you for your review. The name you created is nice. I rename the module.
I changed the reference to axls-custom in the readme to thc-oca. I checked if all URLs were working and found that only “https://github.com/qrtl/thc-oca/tree/16.0/auth_oauth_enforced” URL was not working. But I think this will be available when this module is merged.

yostashiro

@nobuQuartile Please add CONFIGURE.md (and USAGE.md and CONTEXT.md as appropriate).

yostashiro · 2025-01-15T07:01:33Z

auth_oauth_enforced/readme/DESCRIPTION.md

+This module controls login methods by email domain, requiring OAuth for
+specified domains, as defined in company
+settings.


Let's avoid random line breaks.

Suggested change

This module controls login methods by email domain, requiring OAuth for

specified domains, as defined in company

settings.

This module controls login methods by email domain, requiring OAuth for specified

domains, as defined in company settings.

yostashiro

@nobuQuartile The commits shouldn't have squashed for this PR. It makes it hard to see what changes you have made.

yostashiro · 2025-01-20T12:00:32Z

auth_oauth_enforced/readme/CONTEXT.md

@@ -0,0 +1 @@
+To streamline security practices, many companies are adopting an OAuth-only login policy, reducing risks associated with managing multiple passwords. However, in B2B scenarios—such as when third-party service providers like accounting firms require access to Odoo—enforcing OAuth exclusively can lead to operational inefficiencies, as third parties may need to create and manage dedicated accounts for this purpose. To overcome this challenge, implementing domain-specific OAuth enforcement offers a more flexible and targeted solution.


Make it more concise as it sounds a bit too verbose (the last sentence sounds very ChatGPTish and we don't want that), and apply the 88-char max length for better readability, although it's not required by the linter.

yostashiro · 2025-01-20T12:06:09Z

auth_oauth_enforced/readme/USAGE.md

+1. Navigate to Settings → Companies → Update Info to open your company's form view.
+2. In the General Information tab, locate the field Force OAuth Domains.
+3. Enter the domain names you want to block in login IDs. You can specify multiple domains by separating them with commas (,).


These steps should be in CONFIGURE.md.

Step 3 sounds incorrect.

yostashiro · 2025-01-20T12:12:38Z

auth_oauth_enforced/readme/USAGE.md

+1. Navigate to Settings → Companies → Update Info to open your company's form view.
+2. In the General Information tab, locate the field Force OAuth Domains.
+3. Enter the domain names you want to block in login IDs. You can specify multiple domains by separating them with commas (,).
+4. Once configured, users with emails from the blocked domains will be restricted from logging in. Additionally, if a user tries to access the company's admin panel with a password instead of OAuth, they will see the notification: "You are not allowed to login with password. Please use OAuth login."


This sounds incorrect or doesn't clearly tell what the module does.

nobuQuartile · 2025-01-23T08:00:46Z

I fixed some point.

nobuQuartile · 2025-01-23T08:13:44Z

I fixed some point.

nobuQuartile · 2025-01-23T09:31:37Z

I fixed the USAGE.

yostashiro · 2025-01-23T09:43:46Z

auth_oauth_enforced/readme/USAGE.md

+Users with a blocked domain in their login ID cannot log in with a password
+and will receive a notification on the login page if they attempt this,
+instructing them to use OAuth instead.


For better flow (IMO).

Suggested change

Users with a blocked domain in their login ID cannot log in with a password

and will receive a notification on the login page if they attempt this,

instructing them to use OAuth instead.

On the login page, users with a blocked domain in their login will receive an error

message directing them to use OAuth login instead, if they attempt to log in with a

password.

yostashiro · 2025-01-23T09:55:28Z

auth_oauth_enforced/readme/CONFIGURE.md

@@ -0,0 +1,4 @@
+1. Navigate to Settings → Companies → Update Info to open your company's form view.


Suggested change

1. Navigate to Settings → Companies → Update Info to open your company's form view.

1. Navigate to *Settings > Users & Companies > Companies*.

yostashiro · 2025-01-23T09:56:30Z

auth_oauth_enforced/readme/CONFIGURE.md

@@ -0,0 +1,4 @@
+1. Navigate to Settings → Companies → Update Info to open your company's form view.
+2. In the General Information tab, locate the field Force OAuth Domains.
+3. Enter the domain names you want to block for email-based login IDs. 


Suggested change

3. Enter the domain names you want to block for email-based login IDs.

3. Enter the domain names you wish to block for password-based login, i.e., users with

a login that matches the domains listed here will not be able to log in with a password.

yostashiro · 2025-01-23T10:00:53Z

auth_oauth_enforced/readme/CONTEXT.md

+For example, some companies may have wanted to enforce OAuth for their users.
+On the other hand, there may be those who prefer not to enforce OAuth for users
+such as stakeholders accessing the portal.


Suggested change

For example, some companies may have wanted to enforce OAuth for their users.

On the other hand, there may be those who prefer not to enforce OAuth for users

such as stakeholders accessing the portal.

Sometimes, you may want to enforce OAuth login for your employees for security reasons,

while it may not be appropriate to do so for portal users. This module intends to

address this need.

yostashiro · 2025-01-23T10:04:35Z

auth_oauth_enforced/readme/DESCRIPTION.md

+This module controls login methods by email domain, requiring OAuth for
+specified domains, as defined in company settings.


Suggested change

This module controls login methods by email domain, requiring OAuth for

specified domains, as defined in company settings.

This module enforces OAuth login for users with specific domains listed in the company

settings.

nobuQuartile · 2025-01-24T05:45:23Z

@yostashiro
I fixed the parts you mentioned & rebase it.

yostashiro · 2025-02-20T03:13:35Z

auth_oauth_enforced/models/res_users.py

+
+    @api.model
+    def _is_allowed_password_login(self):
+        force_domains = self.company_id.force_oauth_domains


Suggested change

force_domains = self.company_id.force_oauth_domains

# Skip enforcing the password login in Odoo.sh staging instances as their URIs are not predictable.

if self.env["ir.config_parameter"].sudo().get_param("database.is_neutralized"):

return True

force_domains = self.company_id.force_oauth_domains

nobuQuartile · 2025-02-28T09:36:49Z

@yostashiro
Sorry for the late update the code.
After testing in a modified development environment, OAuth was forced without any problems.
I will applies to Odoo.sh development environment.

nobuQuartile · 2025-03-03T06:59:27Z

I have the behaviour test in the staging env.
I've confirmed that users with e-mail domains where this module enforces OAuth can log in with a password.

nobuQuartile · 2025-03-03T09:58:08Z

The ticket number has been changed. Please update the commit message when this PR is merged.

yostashiro reviewed Jan 15, 2025

View reviewed changes

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch 2 times, most recently from b8bbef1 to f249ccc Compare January 15, 2025 06:48

nobuQuartile changed the title ~~[4777][ADD] auth_oauth_force_oauth~~ [4777][ADD] auth_oauth_enforced Jan 15, 2025

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch from f249ccc to afe7cf9 Compare January 15, 2025 06:51

yostashiro reviewed Jan 15, 2025

View reviewed changes

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch 2 times, most recently from d217c65 to 4e095ae Compare January 15, 2025 07:47

nobuQuartile requested review from AungKoKoLin1997 and kanda999 January 20, 2025 09:34

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch 2 times, most recently from fafe793 to daabfd5 Compare January 20, 2025 09:44

yostashiro reviewed Jan 20, 2025

View reviewed changes

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch 2 times, most recently from da15744 to a8d5063 Compare January 23, 2025 07:59

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch 4 times, most recently from 7c225d2 to 0612927 Compare January 23, 2025 08:12

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch 2 times, most recently from bf5a0ad to 049bc8e Compare January 23, 2025 09:23

yostashiro reviewed Jan 23, 2025

View reviewed changes

[4777][ADD] auth_oauth_enforced

a8d13ef

nobuQuartile force-pushed the 4777-add-auth_oauth_force_oauth branch from 3b0a54a to a8d13ef Compare January 24, 2025 05:45

yostashiro approved these changes Jan 24, 2025

View reviewed changes

yostashiro reviewed Feb 20, 2025

View reviewed changes

upd

5c0ef10

nobuQuartile changed the title ~~[4777][ADD] auth_oauth_enforced~~ [5188][ADD] auth_oauth_enforced Mar 3, 2025

		@@ -0,0 +1 @@
		To streamline security practices, many companies are adopting an OAuth-only login policy, reducing risks associated with managing multiple passwords. However, in B2B scenarios—such as when third-party service providers like accounting firms require access to Odoo—enforcing OAuth exclusively can lead to operational inefficiencies, as third parties may need to create and manage dedicated accounts for this purpose. To overcome this challenge, implementing domain-specific OAuth enforcement offers a more flexible and targeted solution. No newline at end of file

		@@ -0,0 +1,4 @@
		1. Navigate to Settings → Companies → Update Info to open your company's form view.

	1. Navigate to Settings → Companies → Update Info to open your company's form view.
	1. Navigate to Settings > Users & Companies > Companies.

	3. Enter the domain names you want to block for email-based login IDs.
	3. Enter the domain names you wish to block for password-based login, i.e., users with
	a login that matches the domains listed here will not be able to log in with a password.

		This module controls login methods by email domain, requiring OAuth for
		specified domains, as defined in company settings. No newline at end of file

-        force_domains = self.company_id.force_oauth_domains
+        # Skip enforcing the password login in Odoo.sh staging instances as their URIs are not predictable.
+        if self.env["ir.config_parameter"].sudo().get_param("database.is_neutralized"):
+            return True
+        force_domains = self.company_id.force_oauth_domains

[5188][ADD] auth_oauth_enforced #60

Are you sure you want to change the base?

[5188][ADD] auth_oauth_enforced #60

Uh oh!

Conversation

nobuQuartile commented Jan 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yostashiro left a comment

Choose a reason for hiding this comment

Uh oh!

nobuQuartile commented Jan 15, 2025

Uh oh!

yostashiro left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yostashiro left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nobuQuartile commented Jan 23, 2025

Uh oh!

nobuQuartile commented Jan 23, 2025

Uh oh!

nobuQuartile commented Jan 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nobuQuartile commented Jan 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nobuQuartile commented Feb 28, 2025

Uh oh!

nobuQuartile commented Mar 3, 2025

Uh oh!

nobuQuartile commented Mar 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nobuQuartile commented Jan 15, 2025 •

edited

Loading