Connected business operations. Flexible deployment.
Learn how to securely migrate Odoo user roles, groups, and access controls during version upgrades or system replacements. This guide covers technical strategies, risk mitigation, and validation steps to ensure business continuity and data security.
Preserving user roles and access controls during an Odoo migration requires a structured approach that combines technical data mapping, rigorous security testing, and strict change management. The primary risk is the silent loss of permissions or the creation of security gaps due to changes in Odoo's security architecture between versions. To mitigate this, organizations must treat access control migration as a distinct workstream, not merely a data transfer task. This involves auditing the current security matrix, mapping legacy groups to target version equivalents, validating custom security rules, and performing comprehensive user acceptance testing in a staging environment. Failure to do so can result in unauthorized data access, operational bottlenecks, and compliance violations. The recommended approach is to export the current security configuration, analyze it against the target version's documentation, and manually verify critical access paths before cutover.
Odoo's security model is multi-layered, relying on three main components: Access Control Lists (ACLs), Record Rules, and Groups. ACLs define which users can create, read, write, or delete records of a specific model. Record Rules provide row-level security, filtering which records a user can see based on dynamic conditions. Groups bundle these permissions together, allowing administrators to assign a set of rights to a user. During a migration, these components may change. For example, a group name might be deprecated, or a record rule might reference a field that has been renamed or removed in the new version. Understanding these layers is essential for accurate migration planning.
ACLs are defined in the security/ir.model.access.csv files within each module. When migrating, you must verify that all models referenced in these files still exist in the target version. If a model is removed or renamed, the ACL will fail, potentially locking users out of critical functions. Additionally, new models introduced in the target version may require new ACL definitions to ensure proper access control. This requires a detailed comparison of the source and target module structures.
Record rules are more complex because they often involve Python expressions or SQL-like conditions that reference specific fields. If a field is renamed, deprecated, or its data type changes, the record rule may break or behave unexpectedly. For instance, a rule that filters records based on a 'company_id' field might fail if the field is replaced by a 'company_ids' many2many field. These rules must be manually reviewed and updated to ensure they continue to enforce the intended data segregation.
The first step in preserving access controls is a comprehensive audit of the current system. This involves documenting all existing groups, the users assigned to them, and the specific permissions each group holds. This audit should be conducted using Odoo's built-in tools or custom scripts that export the security configuration to a structured format, such as CSV or JSON. The goal is to create a baseline security matrix that serves as the reference point for the migration.
| Component | Audit Action | Risk if Ignored |
|---|---|---|
| Groups | List all groups and their hierarchy | Loss of role-based access |
| ACLs | Map models to permissions | Users unable to access core modules |
| Record Rules | Document all row-level filters | Data leakage or visibility issues |
| User Assignments | Export user-to-group mappings | Users losing access to assigned roles |
Once the audit is complete, map the source groups to the target version's groups. This mapping is rarely one-to-one. Odoo frequently restructures its group hierarchy to align with new business processes or module changes. For example, a group named 'Sales Manager' in version 14 might be split into 'Sales Manager' and 'Sales Team Leader' in version 16. The migration team must decide how to handle these changes, either by creating custom groups in the target version or by adjusting user assignments to fit the new structure.
The technical execution of security migration involves updating the database to reflect the new security configuration. This is typically done through a combination of automated scripts and manual adjustments. Automated scripts can handle the bulk of the work, such as updating group names and reassigning users. However, manual adjustments are required for custom security rules and any non-standard configurations. It is crucial to perform this step in a staging environment that mirrors the production system's data and configuration.
Custom security rules are the most challenging aspect of security migration. These rules are often written in Python and may reference internal Odoo APIs that change between versions. The migration team must review each custom rule, test it in the staging environment, and update it as needed. This process requires a deep understanding of Odoo's security framework and the specific business logic implemented in the custom rules. It is recommended to involve senior Odoo developers in this task to ensure accuracy and security.
Learn how to harmonize manufacturing processes across multiple sites using modern ERP architecture, master data governance, and phased implementation strategies to reduce complexity and improve operational visibility.
A practical guide for CIOs and ERP consultants on migrating service contracts and maintenance schedules. Covers data mapping, validation, testing, and cutover strategies to ensure operational continuity.
Learn how to implement ERP governance in professional services to align delivery and finance, ensuring accurate project profitability and scalable decision-making.
Discuss your workflows, modules and deployment options with our team.
Back to resources