Skip to Content

PMIS Federation Administration

Alpha License: LGPL-3 PMISuite/federation Version: 18.0

Delegated organization/instance management for PMIVerse Federation on Odoo 18 Community. Administrators appoint managers; managers act only within their grants.

Features

  • Exact user, organization, and instance delegations with permanent targets.

  • Membership approval/suspension in the backend and manager portal.

  • Remote name/email editing through Hub's profile synchronization.

  • Immediate derived-access changes when delegations are created or archived.

  • Record-level authorization and CSRF protection for portal actions.

Delegation and access

Depends on pmis_federation_hub and belongs on the master. Managers are active internal users with the Federation Company Manager group and access to the local Directory Owner company.

Federation > Manager Delegations identifies the exact organization and instance for each grant. Group membership alone grants no unassigned target access. Company rules continue to apply, including to administrators in the manager group. Archived grants remove derived access; immutable targets cannot be reassigned.

Managers approve/suspend existing memberships and edit a remote profile only when delegated over every organization on the account. Identity verification, account assignment, and service configuration remain administrator-owned. When an administrator enables Disable Accounts After Full Suspension on a target instance, the final assigned suspension can automatically request disablement of its confirmed federation-created account. Managers cannot configure this policy.

Manager portal

Manage Company Instances at /my/federation/manage exposes delegated accounts and memberships. It displays 20 accounts per page and up to 100 related visible memberships, with a notice when more are available in the backend.

Profile updates require active verified links, approved memberships, and an eligible outgoing connection. Queue Pending Update queues existing desired values after prerequisites become available, without changing immutable payloads or duplicating uncertain deliveries. Reviewed retries remain administrator-owned.

A submitted record ID does not grant authority. Missing targets, unauthorized records, and invalid transitions are rejected.

Permission boundaries

  • Managers cannot appoint themselves, create memberships, verify identity links, retarget grants, or archive remote accounts.

  • Profile editing does not change master credentials or local business groups.

  • Manager suspension can request disablement under the administrator's opt-in full-suspension policy. Managers cannot invoke the separate manual disable workflow or change its review-deadline policy.

Development

See Hub and the repository-wide development backlog.

Localization

English source strings and a Slovenian catalog (i18n/sl.po) are included.

Bug Tracker

Bugs are tracked on PMISuite Repository Issues.

Credits

Authors

Contributors

  • Matjaž Mozetič

Maintainers

LUXIM MATMOZ

Current maintainer:

sysadminmatmoz

Luxim is an independent R&D and deployment company focused on solving complex problems in the Odoo ecosystem.

Odoo Community Association

Luxim is an active member of OCA (Odoo Community Association).