TIP: You can type at any time to perform a new search.
Two-Factor Authentication (TOTP)
auth_totp · odoo/odoo
Security findings
Migration considerations
- Raw `cr.execute()` INSERT/UPDATE/DELETE bypasses the ORM (no compute/constrains/tracking/mail): `UPDATE res_users SET totp_secret = %s WHERE id=%s` - re-check the table/column names still match after upgrading. migration-raw-sql-write · source
Migration review checklist, not a compatibility verdict. No target version is selected: apply version-specific advice only when migrating to that version or later.
- Repository
- odoo/odoo · module folder
- Module version
- 0.1.0
- Category
- Extra Tools
- Folder size
- 0.73 MB
- License
- LGPL-3
- Application
- No
- Auto-installable
- Yes
- Website
- None
- Last tracking update
- 2026-09-28 18:31:13
- Authors
- Odoo S.A.
- Maintainers
- Odoo S.A.
- Committers
- Xavier Morel, Raphael Collet, odoo, Odoo Translation Bot, Denis Ledoux, Aaron Bohy, Julien Castiaux, Victor Feyens, Tiffany Chang (tic), Gorash, Pierre Paridans, Miquel Raïch, amdi-odoo, Dylan Kiss (dyki), Antoine Boonen, Chong Wang (cwg), Chrysanthe (chgo), Harsh Shah, thle-odoo, Pierre Pulinckx, Krzysztof Magusiak (krma), Julien Launois (jula), Julien Piron, SebVrc
- Odoo dependencies
- Python dependencies
- None
- System dependencies
- None
- Required by
- auth_timeout, auth_totp_mail, auth_totp_portal
- Description
Two-Factor Authentication (TOTP) ================================ Allows users to configure two-factor authentication on their user account for extra security, using time-based one-time passwords (TOTP). Once enabled, the user will need to enter a 6-digit code as provided by their authenticator app before being granted access to the system. All popular authenticator apps are supported. Note: logically, two-factor prevents password-based RPC access for users where it is enabled. In order to be able to execute RPC scripts, the user can setup API keys to replace their main password.
Code Analysis
Views touched (5)
| XML ID | Name | Model | Type | Status |
|---|---|---|---|---|
auth_totp_form |
Two-Factor Authentication | ir.ui.view | qweb | New |
res_users_view_search |
res.users.view.search.inherit.auth.totp | res.users | search | Inherits base.view_users_search |
view_totp_field |
users preference: totp | res.users | form | Inherits base.view_users_form_simple_modif |
view_totp_form |
user form: add totp status | res.users | form | Inherits base.view_users_form |
view_totp_wizard |
auth_totp wizard | auth_totp.wizard | form | New |
HTTP endpoints (1)
| Route(s) | Handler | Auth | Type | Methods | Flags |
|---|---|---|---|---|---|
/web/login/totp |
Home.web_totp |
public | http | GET, POST | sudo website |
Models touched (5)
New fields (3)
-
ipCharreadonly=True -
limit_typeSelectionreadonly=True args: [('send_email', 'Send Email'), ('code_check', 'Code Checking')] -
user_idMany2one → res.usersreadonly=Truerequired=True args: 'res.users'
No public methods.
New fields (0)
No new fields.
Public methods (0)No public methods.
New fields (5)
-
codeCharsize=7store=Falsestring='Verification Code' -
qrcodeBinaryattachment=Falsecompute='_compute_qrcode'readonly=Truestore=True -
secretCharreadonly=Truerequired=True -
urlCharcompute='_compute_qrcode'readonly=Truestore=True -
user_idMany2one → res.usersreadonly=Truerequired=True args: 'res.users'
-
enable(self)@check_identity
New fields (0)
No new fields.
Public methods (0)No public methods.
New fields (4)
-
totp_enabledBooleancompute='_compute_totp_enabled'search='_totp_enable_search'string='Two-factor authentication' -
totp_last_counterIntegercopy=Falsegroups=fields.NO_ACCESS -
totp_secretCharcompute='_compute_totp_secret'copy=Falsegroups=fields.NO_ACCESSinverse='_inverse_token' -
totp_trusted_device_idsOne2many → auth_totp.devicestring='Trusted Devices' args: 'auth_totp.device', 'user_id'
-
action_totp_disable(self)@check_identity -
action_totp_enable_wizard(self)@check_identity -
change_password(self, old_passwd, new_passwd)@api.model -
init(self) -
revoke_all_devices(self)@check_identity
Loading…
Loading…
Loading…
Loading…
Loading…
Loading…