PMIS Federation Provider

Features

• Native Hub authentication with configured MFA.

• Explicit client registration for exact receiver instances and HTTPS callbacks.

• Authorization-code login with mandatory S256 PKCE.

• RS256 identity assertions bound to provider, client, receiver, and browser nonce.

• Current approved membership checks at login and authorization renewal.

• Single-use authorization codes and rotating renewal credentials.

• Externally owned signing keys with bounded key retirement.

• Public protocol metadata and verification keys, without publishing private keys.

Access and dependencies

Depends on pmis_federation_hub and auth_totp. Install this addon on each chosen Hub database. Company-scoped system administrators register receiver clients; native users authenticate on the provider. Receivers use pmis_federation_login and retain independent passwords and receiver-owned permissions.

Configuration

1. Verify native user/person mappings on the Hub.

2. Approve the relevant person memberships for the receiving instance.

3. Register the receiver under Federation > Provider Login Clients, choosing the provider and receiver instances, delegated organizations, and exact HTTPS callback.

4. Configure externally owned RSA signing keys and the original database's PMIS_FEDERATION_RUNTIME binding. Private keys belong in protected host configuration, never in directory records or login configuration views.

5. Configure the receiver's explicit trust, public verification keys, verified subject links, and local access policies.

Separate HTTPS hostnames and database routing preserve independent browser sessions. Installation alone does not establish provider trust or grant access.

See shared-login setup and ownership for runtime settings, multiple providers, key rollover, and exact protocol boundaries.

Usage

A user explicitly selects this provider on a registered receiver's login page. The provider uses native Odoo authentication and completes configured MFA before issuing a short-lived authorization code. An existing native provider session may authenticate that explicit action.

The receiver exchanges the code using PKCE, verifies the signed assertion, and applies its own verified account and permission policy. The provider cannot choose native receiver group or company IDs.

Authorization and boundaries

Approved receiver membership is checked again on renewal. Authorization lasts at most five minutes; renewal credentials rotate and expire within the eight-hour absolute lifetime. Native credential changes invalidate the bound authorization.

Receiver-local login and logout do not log the provider or other instances in or out. Receiver passwords are never accepted as provider credentials.

Password grants, implicit login, dynamic client registration, and arbitrary scopes are not supported. This addon does not provision Matrix accounts or provide cross-database messaging; those remain separate development stages.

Development

See the repository-wide development backlog.

Localization

English source strings and a Slovenian catalog (i18n/sl.po) are included.

Bug Tracker

Bugs are tracked on PMISuite Repository Issues.

Credits

Maintainers

Current maintainer:

Luxim is an independent R&D and deployment company focused on solving complex problems in the Odoo ecosystem.

Luxim is an active member of OCA (Odoo Community Association).