This module adds support for MFA using TOTP (time-based, one-time passwords). It allows users to enable/disable MFA and manage authentication apps/devices via the “Change My Preferences” view and an associated wizard.
After logging in normally, users with MFA enabled are taken to a second screen where they have to enter a password generated by one of their authentication apps and are presented with the option to remember the current device. This creates a secure, HTTP-only cookie that allows subsequent logins to bypass the MFA step.
Table of contents
By default, the trusted device cookies introduced by this module have a Secure flag. This decreases the likelihood of cookie theft via eavesdropping but may result in cookies not being set by certain browsers unless your Odoo instance uses HTTPS. If necessary, you can disable this flag by going to Settings > Parameters > System Parameters and changing the auth_totp.secure_cookie key to 0.
If necessary, a user’s trusted devices can be revoked by disabling and re-enabling MFA for that user.
Bugs are tracked on GitHub Issues. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us smashing it by providing a detailed and welcomed feedback.
Do not contact contributors directly about support or help with technical issues.
This module is maintained by the OCA.
OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use.
This module is part of the OCA/server-auth project on GitHub.
You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.