LDAP/Active Directory Authentication
Integrate Odoo with centralized LDAP/Active Directory user management
Overview
The auth_ldap module allows users to login to Odoo using LDAP/Active Directory accounts instead of separate Odoo passwords, enabling centralized management and password synchronization.
Full support for Active Directory (Windows Server), OpenLDAP, FreeIPA and other LDAP servers with secure TLS/STARTTLS connections.
Key Features
Key points
• LDAP/Active Directory authentication - Login with domain account instead of Odoo password
• Auto-create users - Odoo users created automatically on first login
• Multiple LDAP servers - Support multiple LDAP servers per company
• Change password on LDAP - Allow users to change password directly on LDAP server
• TLS/STARTTLS connection - Encrypt connection to protect credentials
• Template user - Copy permissions from template user to new users
• Flexible LDAP filter - Customize user search filter as needed
System Requirements
Module requires python-ldap library to connect to LDAP server.
Steps
1. Install library: sudo apt-get install python3-ldap (Ubuntu/Debian) or pip install python-ldap
2. Activate module: Go to Apps, search "Authentication via LDAP", click Install
3. Restart Odoo after installing module
Configure LDAP Server
Steps
1. Go to Settings → General Settings, scroll to LDAP Authentication section
2. Click Add a line to add new LDAP configuration
3. Fill LDAP server info: Server address (ldap.company.com), Port (389 for LDAP, 636 for LDAPS)
4. Enable Use TLS to encrypt connection (recommended)
5. Configure LDAP Bind DN (account to query LDAP): cn=admin,dc=company,dc=com or leave blank for anonymous bind
6. Enter LDAP Password for Bind DN
7. Configure LDAP Base (root DN to search users): ou=Users,dc=company,dc=com
8. Set LDAP Filter to find users, use %s for login. Example AD: (&(objectCategory=person)(objectClass=user)(sAMAccountName=%s))
9. Select Template User to copy permissions to new users
10. Enable Create User to auto-create users on first login
11. Click Test Connection to verify connection
12. Click Save to save configuration
Active Directory Configuration Example
| Fields | Trường dữ liệu | Description |
|---|---|---|
| LDAP Server | ad.company.com | Active Directory server address |
| LDAP Port | 389 | LDAP port (389) or LDAPS (636) |
| Use TLS | Yes | Enable STARTTLS for encryption |
| LDAP Bind DN | cn=odoo_service,ou=Service Accounts,dc=company,dc=com | Service account to query AD |
| LDAP Base | ou=Employees,dc=company,dc=com | Root DN containing users |
| LDAP Filter | (&(objectCategory=person)(objectClass=user)(sAMAccountName=%s)) | AD user search filter |
| Template User | Admin | Template user for permissions |
| Create User | Yes | Auto-create new users |
OpenLDAP Configuration Example
| Fields | Trường dữ liệu | Description |
|---|---|---|
| LDAP Server | ldap.company.com | OpenLDAP server address |
| LDAP Port | 389 | LDAP port |
| Use TLS | Yes | Enable STARTTLS |
| LDAP Bind DN | cn=admin,dc=company,dc=com | Admin DN |
| LDAP Base | ou=people,dc=company,dc=com | DN containing users |
| LDAP Filter | (uid=%s) | Search by uid |
| Template User | Admin | Template user |
| Create User | Yes | Auto-create |
LDAP Login Workflow
Steps
1. User enters username and password in Odoo login form
2. Odoo attempts authentication with LDAP servers in Sequence order
3. LDAP server validates username/password
4. If valid and Create User enabled: Odoo auto-creates new user from LDAP info
5. User logged into Odoo with permissions from Template User
6. Subsequent logins: Odoo re-authenticates with LDAP, no new user creation
Troubleshooting
Common Errors
| Error | Cause | Solution |
|---|---|---|
| Connection Test Failed | Wrong LDAP server address, firewall blocking port | Check server address, open port 389/636, test with telnet |
| Invalid credentials | Wrong LDAP Bind DN or password | Verify Bind DN and password, test with ldapsearch |
| User not found | Wrong LDAP Base or LDAP Filter | Check Base DN contains users, test filter with ldapsearch |
| TLS error | Invalid certificate, server lacks STARTTLS support | Check certificate, try disabling TLS to test, install CA cert |
| User created but no access | Template User lacks appropriate permissions | Check Template User permissions, grant necessary access |
| Multiple LDAP servers conflict | Wrong Sequence, user exists on multiple servers | Adjust Sequence, ensure user only on 1 server |
Best Practices
Key points
• Always enable TLS/STARTTLS to encrypt connection and protect passwords
• Create dedicated service account for Odoo, do not use admin account
• Limit Bind DN permissions to read-only user access, no write
• Configure LDAP Filter precisely to avoid finding wrong users
• Test thoroughly before applying to entire company
• Backup LDAP configuration before making changes
• Monitor Odoo logs to detect authentication errors
• Configure Template User with minimum necessary permissions