Keycloak auth integration (auth_keycloak)

Security findings

Migration considerations

auth_keycloak_create_wiz — For a target of Odoo 17.0+: view 'auth_keycloak_create_wiz' uses `attrs=`/`states=`, which are no longer supported. Convert modifiers to direct Python boolean expressions in `invisible`/`readonly`/`required`; preserve the original AND/OR logic. migration-view-attrs-states · source
auth_keycloak_sync_wiz — For a target of Odoo 17.0+: view 'auth_keycloak_sync_wiz' uses `attrs=`/`states=`, which are no longer supported. Convert modifiers to direct Python boolean expressions in `invisible`/`readonly`/`required`; preserve the original AND/OR logic. migration-view-attrs-states · source
view_oauth_provider_form — For a target of Odoo 17.0+: view 'view_oauth_provider_form' uses `attrs=`/`states=`, which are no longer supported. Convert modifiers to direct Python boolean expressions in `invisible`/`readonly`/`required`; preserve the original AND/OR logic. migration-view-attrs-states · source
view_users_form — For a target of Odoo 17.0+: view 'view_users_form' uses `attrs=`/`states=`, which are no longer supported. Convert modifiers to direct Python boolean expressions in `invisible`/`readonly`/`required`; preserve the original AND/OR logic. migration-view-attrs-states · source

Migration review checklist, not a compatibility verdict. No target version is selected: apply version-specific advice only when migrating to that version or later.

Repository: OCA/server-auth · module folder · Try on Runboat
Module version: 1.0.0
Category: Tools
Folder size: 0.15 MB
License: AGPL-3
Application: No
Auto-installable: No
Website: https://github.com/OCA/server-auth
Last tracking update: 2026-10-03 22:30:51
Authors: Camptocamp, Odoo Community Association (OCA)
Maintainers: Camptocamp, Odoo Community Association (OCA)
Committers: Holger Brunn, OCA Transbot, OCA-git-bot, oca-travis

Odoo dependencies

odoo/odoo:

- auth_oauth

- base

- web

- base_setup

- auth_signup

- mail

- bus

- web_tour

Python dependencies

None

System dependencies

None

Required by

None

Description

Code Analysis info_outline

Views touched (4)

XML ID	Name	Model	Type	Status
`auth_keycloak_create_wiz`	auth.keycloak.create.wiz.form	auth.keycloak.create.wiz	form	New
`auth_keycloak_sync_wiz`	auth.keycloak.sync.wiz.form	auth.keycloak.sync.wiz	form	New
`view_oauth_provider_form`	auth.oauth.provider.form	auth.oauth.provider	form	Inherits auth_oauth.view_oauth_provider_form
`view_users_form`	keycloack res.users.form	res.users	form	Inherits base.view_users_form

HTTP endpoints (0)

No HTTP endpoints found for this module.

Models touched (5)

New fields (1)

user_ids Many2many → res.users
comodel_name='res.users' default=<expr>

Public methods (1)

button_create_user(self)
@api.multi

Create users on Keycloak. 1. get a token 2. loop on given users 3. push them to Keycloak if: a. missing on Keycloak b. they do not have an Oauth UID already 4. brings you to update users list

New fields (6)

endpoint Char
readonly=True related='provider_id.users_endpoint'
login_match_key Selection
default='username:login' help="Keycloak user field to match users' login." selection=[('username:login', 'username'), ('email:partner_id.email', 'email')]
management_enabled Boolean
readonly=True related='provider_id.users_management_enabled'
provider_id Many2one → auth.oauth.provider
comodel_name='auth.oauth.provider' required=True string='Provider'
pwd Char
readonly=True related='provider_id.superuser_pwd'
user Char
readonly=True related='provider_id.superuser'

Public methods (0)

No public methods.

New fields (0)

No new fields.

Public methods (1)

button_sync(self)
@api.multi

Sync Keycloak users w/ Odoo users. 1. get a token 2. retrieve ALL users 3. find matching Odoo users 4. update them w/ their own Keycloak ID 5. get back to filtered list of updated users

New fields (5)

client_secret Char
superuser Char
help='A super power user that is able to CRUD users on KC.' placeholder='admin' required=False
superuser_pwd Char
help='"Superuser" user password' placeholder='I hope is not "admin"' required=False
users_endpoint Char
help='User endpoint' placeholder='http://keycloak.mycompany.com/auth/admin/realms/{realm}/users' required=False
users_management_enabled Boolean
compute='_compute_users_management_enabled'

Public methods (0)

No public methods.

New fields (0)

No new fields.

Public methods (1)

button_push_to_keycloak(self, vals)
@api.multi

Quick action to push current users to Keycloak.

Loading…

Status: Open migration PR — not merged yet for this version
CI status: green — ready to merge
Open since: 72 days ago
Last activity: 65 days ago
Repository: OCA/server-auth
Pull request: [15.0][MIG] auth_keycloak (#976)

build Migration considerations

Code Analysis info_outline

Views touched (4)

HTTP endpoints (0)

Models touched (5)

auth.keycloak.sync.mixin New model AbstractModel 6 fields 0 methods KeycloakSyncMixin Synchronize Keycloak users mixin.

auth.oauth.provider Extends Model 5 fields 0 methods OAuthProvider · inherits auth.oauth.provider

res.users Extends Model 0 fields 1 method ResUsers · inherits res.users

Migration considerations