Package: odoo13-addon-auth-jwt
JWT bearer token authentication.Table of contentsInstallationUsageKnown issues / RoadmapBug TrackerCreditsAuthorsContributorsMaintainersInstallationThis module requires thepyjwtlibrary to be installed.UsageThis module lets developpers add a newjwtauthentication method on Odoo
controller routes.To use it, you must:Create anauth.jwt.validatorrecord to configure how the JWT token will
be validated.Add anauth="jwt_{validator-name}"orauth="public_or_jwt_{validator-name}"attribute to the routes you want to protect where{validator-name}corresponds to
the name attribute of the JWT validator record.Theauth_jwt_demomodule provides examples.The JWT validator can be configured with the following properties:name: the validator name, to match theauth="jwt_{validator-name}"route property.audience: a comma-separated list of allowed audiences, used to validate
theaudclaim.issuer: used to validate theissclaim.Signature type (secret or public key), algorithm, secret and JWK URI
are used to validate the token signature.In addition, theexpclaim is validated to reject expired tokens.If theAuthorizationHTTP header is missing, malformed, or contains
an invalid token, the request is rejected with a 401 (Unauthorized) code.If the token is valid, the request executes with the configured user id. By
default the user id selection strategy isstatic(i.e. the same for all
requests) and the selected user is configured on the JWT validator. Additional
strategies can be provided by overriding the_get_uid()method and
extending theuser_id_strategyselection field.The selected user isnotstored in the session. It is only available inrequest.uid(and thus it is the one used inrequest.env). To avoid any
confusion and mismatches between the bearer token and the session, this module
rejects requests made with an authenticated user session.Additionally, if apartner_id_strategyis configured, a partner is searched
and if found, its id is stored in therequest.jwt_partner_idattribute. Ifpartner_id_requiredis set, a 401 (Unauthorized) is returned if no partner
was found. Otherwiserequest.jwt_partner_idis left falsy. Additional
strategies can be provided by overriding the_get_partner_id()method
and extending thepartner_id_strategyselection field.The decoded JWT payload is stored inrequest.jwt_payload.Thepublic_auth_jwtmethod delegates authentication to the standard Odoopublicmethod when the Authorization header is not set. If it is set, the regular JWT
authentication is performed as described above. This method is useful for public
endpoints that need to work for anonymous users, but can be enhanced when an
authenticated user is know. A typical use case is a “add to cart” endpoint that can work
for anonymous users, but can be enhanced by binding the cart to a known customer when
the authenticated user is known.Known issues / RoadmapCORS support is problematic in Odoo before 14.0.
This means the demo SPA inauth_jwt_demodoes not work as is.
To make it work, you need to serve it from the same URL as Odoo,
or backporthttps://github.com/odoo/odoo/pull/56029.This might also be worked around inauth_jwtby detecting
the cors preflight request and not requiring auth in that case.This is left for future work, as my current focus is Odoo 14.0.Bug TrackerBugs are tracked onGitHub Issues.
In case of trouble, please check there if your issue has already been reported.
If you spotted it first, help us smashing it by providing a detailed and welcomedfeedback.Do not contact contributors directly about support or help with technical issues.CreditsAuthorsACSONE SA/NVContributorsStéphane Bidoul <stephane.bidoul@acsone.eu>MaintainersThis module is maintained by the OCA.OCA, or the Odoo Community Association, is a nonprofit organization whose
mission is to support the collaborative development of Odoo features and
promote its widespread use.Currentmaintainer:This module is part of theOCA/server-authproject on GitHub.You are welcome to contribute. To learn how please visithttps://odoo-community.org/page/Contribute.