Migration to version 12.0

[OCA-git-bot]

Todo

https://github.com/OCA/maintainer-tools/wiki/Migration-to-version-12.0

Modules to migrate

• auth_admin_passkey - By @fkantelberg - [12.0][MIG] auth_admin_passkey #116
• auth_api_key - By @sbidoul - [12.0][MIG] auth_api_key from 10 to 12 #56
• auth_brute_force Not needed as Odoo includes now this feature in core. More details in Migration to version 12.0 #38 (comment)
• auth_from_http_remote_user
• auth_keycloak - By @shepilov-vladislav - 12.0 mig auth keycloak #152
• auth_ldaps - By @alexey-pelykh - [12.0][MIG] auth_ldaps #42
• auth_oauth_multi_token - By @sla-subteno-it - 12.0 mig auth oauth multi token #62 - By @fmdl - 12.0 mig auth oauth multi token #106
• auth_saml - By @gurneyalex - [12.0][MIG] auth_saml #64 By @yajo - [12.0][MIG] auth_saml #64
• auth_session_timeout - By @jarroyomorales - [12.0][MIG] auth_session_timeout #109
• auth_signup_verify_email - By @SalahAdDin - [MIG] auth_signup_verify_email: Migration to 12.0 #69 By @Tardo - [12.0][MIG] auth_signup_verify_email #108
• auth_totp - By @fkantelberg - [12.0][mig] auth_totp #114
• auth_totp_password_security - By @fkantelberg - [12.0][mig] auth_totp_password_security #115
• auth_u2f - By @fkantelberg - [12.0][MIG] Module auth_u2f #90
• auth_user_case_insensitive - By @Retropikzel - [MIG] auth_user_case_insensitive: Migration to 12.0 #104
• keychain - By @hparfr - [12.0][MIG] keychain - WIP #39
• password_security - By @pnajman-modoolar - [12.0][MIG] password_security #66 - By @shepilov-vladislav - [12.0][MIG] password_security #83
• users_ldap_mail - By @Tardo - [12.0][MIG] users_ldap_mail #151
• users_ldap_groups - By @alexey-pelykh - [12.0][MIG] users_ldap_groups #46
• users_ldap_populate - By @Tardo - [12.0][MIG] users_ldap_populate #132

[alexey-pelykh]

auth_ldaps via #42 + certificate validation setting

[alexey-pelykh]

Enhanced users_ldap_mail alternative in #45

[alexey-pelykh]

users_ldap_groups in #46

[probabble]

Hey folks, my org just started using Odoo and they set us up with v12, but I'd love to start using these modules as soon as possible (SAML especially!). What if anything can I do to accelerate this upgrade process?

[pedrobaeza]

Well, you can migrate it by your means and contribute it back here or finance any contributor for doing it.

[gurneyalex]

hello @pedrobaeza One of my customers needs auth_saml in 12.0, I see noone's on it -> I take this migration in charge if this is ok with you

[pedrobaeza]

Yes, Alexandre, of course! I'm only taking note of that assignments and watch if there's duplicated work, which doesn't be the case.

[alexey-pelykh]

@gurneyalex as a matter of fact, we also need it, yet that's lower priority right now, so feel free to ping me on the review or anything else

[yajo]

auth_brute_force is not needed in v12 after odoo/odoo@a8d868e was merged. It's upstream now.

[pedrobaeza]

Well, at least we will need some migration scripts. I don't see now any table where storing banned IPs. How is that achieved?

[yajo]

The behavior is different. Has pros and cons. For example, in OCA bans and login attempts were recorded in the database, browsable, unbannable, whitelistable by the admin. With upstream changes, this is all just automatic, stored in a volatile cache that will disappear on next reboot, and transparent to users, but it implements a cooldown that lets the user come back after certain time and be able to login again without disturbing the sysadmin.

Honestly, I think that production-grade brute force protection should be handled through fail2ban or similar tools, as recommended by Odoo, but current upstream behavior seems good enough for most cases.

I think we can drop auth_brute_force. If someone wants to migrate it, though, then its scope should change to extend the weak points of odoo 12 implementation, using the new hooks we have in place, and removing workarounds for odoo/odoo#24187 which is now merged in v12 too.

[emagdalenaC2i]

Please, check auth_api_key - By @sbidoul - #56 that is already merged

There is a PR for the migration of auth_user_case_insensitive - By @Retropikzel - #104