How do we ensure that an Odoo environment is set up as securely as possible, without compromising flexibility in daily practice? From our work on the NEN 7510 certification, we at Open2Bizz have been increasingly considering the security of Odoo environments and data management.
An important part of this is managing user rights. Employees must have access to the functionalities and data they need, but extra rights do not need to be automatically available permanently. In practice, there are often situations where someone temporarily needs more rights. For example, think of an employee who takes over a colleague's tasks during a vacation, or someone who temporarily needs export rights to carry out a one-time export.
Therefore, we have looked at how we can make the assignment of these temporary rights simpler and safer.
Only access when needed
With good rights management, it is important not to give users more access than necessary by default. When someone temporarily takes over a specific task, it is therefore not desirable to assign the corresponding rights indefinitely.
With temporary rights, this can be set up in a controlled manner. The user only gets access to a specific rights group for a predetermined period. After that, access is automatically revoked.
This not only makes rights management clearer, but also reduces the chance that users unnecessarily retain access to certain functionalities or data for too long.
Easily set temporary rights
To make this practically applicable, we have developed an extension that allows temporary rights to be managed directly from the user in Odoo.
On the user card, a smart button is available for this purpose. From this smart button, it can be indicated which rights group should be temporarily assigned to the user.
The following data is recorded, among other things:
Which rights group is assigned
From which date the rights are active
Until which date the rights are active
This provides immediate insight into which temporary rights have been assigned to a user and for what period they are valid.
Automatic withdrawal of rights
An important part of the solution is that the withdrawal of rights is not dependent on a manual action.
As soon as the set end date of the temporary rights is reached, the assigned rights are automatically withdrawn.
From practical solution to safer rights management
With this extension, we want to make it easier for organizations to apply the principle of minimal access rights. Employees gain access to what they need for their work, but extra rights do not need to remain permanently available automatically.
Especially within organizations that work with sensitive information, good management of user rights is an important part of information security.
As an Odoo partner, we therefore look not only at the functionality of an Odoo environment but also at how this environment can be set up securely and manageably. Temporary rights are a practical example of this: more flexibility for employees, without compromising controlled access.
Curious how you can gain more control over access within Odoo?
Discuss your situation with our Odoo specialists.