Package: odoo11-addon-keychain
Keychain AccountThis module allows you to store credentials of external systems.All the crendentials are stored in one place: easier to manage and to audit.Multi-account made possible without effort.Store additionnal data for each account.Validation rules for additional data.Have different account for different environments (prod / test / env / etc).By default, passwords are encrypted with a key stored in Odoo config.
It’s far from an ideal password storage setup, but it’s way better
than password in clear text in the database.
It can be easily replaced by another system. See “Security” chapter below.Accounts may be: market places (Amazon, Cdiscount, …), carriers (Laposte, UPS, …)
or any third party system called from Odoo.This module is aimed for developers.
The logic to choose between accounts will be achieved in dependent modules.Uses casesPossible use case for deliveries: you need multiple accounts for the same carrier.
It can be for instance due to carrier restrictions (immutable sender address),
or business rules (each warehouse use a different account).ConfigurationAfter the installation of this module, you need to add some entries
in Odoo’s config file: (etc/openerp.cfg)> keychain_key = fyeMIx9XVPBBky5XZeLDxVc9dFKy7Uzas3AoyMarHPA=You can generate keys withpython -c ‘from cryptography.fernet import Fernet; print Fernet.generate_key()’.This key is used to encrypt account passwords.If you plan to use environments, you should add a key per environment:> keychain_key_dev = 8H_qFvwhxv6EeO9bZ8ww7BUymNt3xtQKYEq9rjAPtrc=> keychain_key_prod = y5z-ETtXkVI_ADoFEZ5CHLvrNjwOPxsx-htSVbDbmRc=keychain_key is used for encryption when no environment is set.Usage (for module dev)Add this keychain as a dependency in __manifest__.pySubclasskeychain.accountand add your module in namespaces:(see after for the name of namespace )classLaposteAccount(models.Model):_inherit='keychain.account'namespace=fields.Selection(selection_add=[('roulier_laposte','Laposte')])Add the default data (as dict):classLaposteAccount(models.Model):# ...def_roulier_laposte_init_data(self):return{"agencyCode":"","recommandationLevel":"R1"}Implement validation of user entered data:classLaposteAccount(models.Model):# ...def_roulier_laposte_validate_data(self,data):returnlen(data.get("agencyCode")>3)In your code, fetch the account:importrandomdef_get_auth(self):keychain=self.env['keychain.account']ifself.env.user.has_group('stock.group_stock_user'):retrieve=keychain.suspend_security().retrieveelse:retrieve=keychain.retrieveaccounts=retrieve([['namespace','=','roulier_laposte']])account=random.choice(accounts)return{'login':account.login,'password':account.get_password()}In this example, an account is randomly picked. Usually this is set according
to rules specific for each client.You have to restrict user access of your methods with suspend_security().Warning: _init_data and _validate_data should be prefixed with your namespace!
Choose python naming function compatible name.Switching from prod to devYou may adopt one of the following strategies:store your dev accounts in production db using the dev keyimport your dev accounts with Odoo builtin methods like a data.xml (in a dedicated module).import your dev accounts with your own migration/cleanup scriptetc.Note: only the password field is unreadable without the proper key, login and data fields
are available on all environments.You may also use a sametechnical_nameand differentenvironmentfor choosing at runtime
between accounts.Usage (for user)Go tosettings / keychain, create a record with the followingNamespace: type of account (ie: Laposte)Name: human readable label “Warehouse 1”Technical Name: name used by a consumer module (like “warehouse_1”)Login: login of the accountPassword_clear: For entering the password in clear text (not stored unencrypted)Password: password encrypted, unreadable without the key (in config)Data: a JSON string for additionnal values (additionnal config for the account, like:{“agencyCode”: “Lyon”, “insuranceLevel”: “R1”})Environment: usually prod or dev or blank (for all)Known issues / RoadmapAccount inheritence is not supported out-of-the-box (like defining common settings for all environments)Adapted to work withserver_environnementmodulesKey expiration or rotation should be done manuallyImport passwords from data.xmlSecurityThis discussion:https://github.com/OCA/server-tools/pull/644may help you decide if this module is suitable for your needs or not.Common sense: Odoo is not a safe place for storing sensitive data.
But sometimes you don’t have any other possibilities.
This module is designed to store credentials of data like carrier account, smtp, api keys…
but definitively not for credits cards number, medical records, etc.By default, passwords are stored encrypted in the db using
symetric encryptionFernet.
The encryption key is stored in openerp.tools.config.Threats even with this module installed:unauthorized Odoo user want to access data: access is rejected by Odoo security rulesauthorized Odoo user try to access data with rpc api: he gets the passwords encrypted, he can’t recover because the key and the decrypted password are not exposed through rpcdb is stolen: without the key it’s currently pretty hard to recover the passwordsOdoo is compromised (malicious module or vulnerability): hacker has access to python and can do what he wants with Odoo: passwords of the current env can be easily decryptedserver is compromised: idemIf your dev server is compromised, hacker can’t decrypt your prod passwords
since you have different keys between dev and prod.If you want something more secure: don’t store any sensitive data in Odoo,
use an external system as a proxy, you can still use this module
for storing all other data related to your accounts.Bug TrackerBugs are tracked onGitHub Issues. In case of trouble, please
check there if your issue has already been reported. If you spotted it first,
help us smashing it by providing a detailed and welcomed feedback.CreditsAkretionContributorsRaphaël Reverdy <raphael.reverdy@akretion.com>FundersThe development of this module has been financially supported by:AkretionMaintainerThis module is maintained by the OCA.OCA, or the Odoo Community Association, is a nonprofit organization whose
mission is to support the collaborative development of Odoo features and
promote its widespread use.To contribute to this module, please visithttps://odoo-community.org.