Enforce Two-Factor Authentication

auth_totp_enforce · OCA/server-auth

    Repository
    OCA/server-auth · module folder · Try on Runboat
    Module version
    1.0.0
    Category
    Authentication
    Folder size
    0.05 MB
    License
    AGPL-3
    Application
    No
    Auto-installable
    No
    Website
    https://github.com/OCA/server-auth
    Last tracking update
    2026-08-05 18:15:24
    Authors
    Odoo Community Association (OCA), ForgeFlow
    Maintainers
    Odoo Community Association (OCA), ForgeFlow
    Committers
    Lois Rilo, OCA-git-bot, oca-ci, LauraCForgeFlow
    Odoo dependencies
    odoo/odoo:
    - auth_totp
    - web
    - base
    Python dependencies
    None
    System dependencies
    None
    Required by
    None
    Description
    This module forces internal users to configure two-factor authentication
(a TOTP authenticator app) before they log in.

Enforcement works like the password expiry flow of `password_security`: nobody
is logged out when the module is installed, but on their next login users are
held in a mandatory step and cannot reach the backend until they have enabled
an authenticator app.

Members of the **Exempt from 2FA enforcement** group are never forced. Portal
and public users are out of scope at the moment.

    Code Analysis ⓘ

    Views touched (1)
    XML IDNameModelTypeStatus
    auth_totp_setup_form Two-Factor Authentication Setup ir.ui.view qweb New
    HTTP endpoints (1)
    Route(s)HandlerAuthTypeMethodsFlags
    /web/login/totp/setup Home.web_totp_setup public http GET, POST sudo website
    Models touched (1)

    New fields (0)

    No new fields.

    Public methods (0)

    No public methods.