Alfresco, OpenERP/Odoo integrations (was: Re: SSO)

Peter Schober peter.schober at
Mon Dec 16 09:42:58 EST 2019

* Landry BIAO <iloumon53 at> [2019-12-16 00:42]:
> Hi everybody.  I want to perform single sign-on for web applications
> (Alfresco and odoo) using shibboleth.  But I can't do it.

Well, noone here is going to do it for you just because you "can't".
(With the possible exception of you hiring someone.)

>From a technical standpoint it's not even clear what you're asking:
About integrating the Shibboleth SP software with those applications?
Or merely "using" a Shibboleth IDP (as an instance of any SAML IDP)
with SAML SP integrations that may exist for these applications
(possibly only as part of their "enterprise" versions)?

As often is the case none of these integrations seem overly obvious
(especially not for newcomers) and there's no guide for them yet at:

So fully aware that everything below will not be of much help to you
here's my take on these two applications -- not that anyone is going
to find that burried in a thread with the meaningless subject "SSO":


Alfresco claims support for SAML WebSSO:
though that seems rather limited (as usual).
So this seems like an excercise in following their documentation (to
extract their own requirements) and the documentation of the
Shibboleth IDP (on how to satisfy conctete technical requirements).

But Alfresco also has support for "external authentication"
In conjunction with httpd and mod_proxy_ajp this should allow use of
the Shibboleth SP with Alfresco. (Which would certainly be my own
preference because I know how to use httpd and Shibboleth.)


Odoo isn't the easiest to integrate SAML with, from a quick look.
It seems you can buy a SAML SSO module (random search result):
that uses Entr'ouvert's LASSO.

Other than that it's a Python web application using the 'Werkzeug'
WSGI library, so while their documentation at
"Odoo includes built-in HTTP servers, using either multithreading or
you can also run it with a WSGI application server of your choice:

That latter approach would allow use of Apache httpd as both TLS
terminator and web server, with uWSGI (which has a good httpd
integration via mod_proxy_uwsgi) or mod_wsgi as application servers
respectively. Both allow use of environment variables set by the
Shibboleth SP, though how Odoo can be made to accept/consume those
would require a closer look.

Other than that Odoo also allows proxying via HTTP (and passing
attributes via HTTP Request Headers to Odoo's own HTTP server)
though that approach is not recommended by the Shibboleth project.


More information about the users mailing list