Skip to content

🔐 Enterprise Security & Single Sign-On (SSO)

The loyalty platform incorporates enterprise authentication mechanisms allowing staff to log in using their organizational Microsoft Entra ID (Azure AD) accounts or via secure Passwordless OTP verification.

1. Microsoft Entra ID OAuth 2.0 Integration

sequenceDiagram
    autonumber
    actor Staff as CPL Staff Member
    participant Browser as Browser Client
    participant Odoo as Odoo Web Server
    participant Entra as Microsoft Entra ID (Azure AD)

    Staff->>Browser: Click "Sign in with Microsoft"
    Browser->>Entra: Redirect to Microsoft Login Portal
    Staff->>Entra: Authenticate (MFA / Smart Card)
    Entra-->>Browser: Redirect to /auth_oauth/signin with Token
    Browser->>Odoo: Submit OAuth Token / JWT
    Note over Odoo: _auth_oauth_signin extracts claims<br/>(preferred_username / email / upn)
    alt User Already Exists
        Odoo->>Odoo: Match by email and link OAuth provider
    else Auto-Provision New Staff
        Odoo->>Odoo: Create res.users record with internal staff role
    end
    Odoo-->>Browser: 302 Redirect to /web (Authenticated Session)

Key Technical Implementations:

  • Server-Wide Module: auth_oauth is loaded as a server_wide_module in both odoo.conf and odoo_staging.conf to ensure /auth_oauth/signin is available before database selection.
  • Claim Mapping: Custom claims parsing extracts both upn and preferred_username to support organizational UPN variations seamlessly.
  • Auto-Linking: Existing Odoo user records with matching email addresses are linked automatically without manual admin intervention.

2. Passwordless OTP Login

For retail floor staff who do not have permanent email mailboxes: * Mobile number or staff ID is entered on the login screen. * A one-time verification token (OTP) is dispatched via SMS or internal mail server. * The form submission routes to the custom controller in real_rewards_security which verifies the token and issues an active Odoo web session.