OdooWiki OCA HUB

Authentification - System Administrator Passkey

auth_admin_passkey folder_open OCA/server-auth open_in_new
base License: AGPL-3

This module extends the functionality of users module to support loging in with an extra system administrator password in other user accounts.

  • System Administrator has now the possibility to login in with any login
  • According to the configuration, Odoo will send a mail to user and admin to indicate them
  • According to the configuration, password can be stored encrypted in configuration file

auto_awesome What this module does

AI-generated from the code · Odoo 18.0

Lets a system administrator log in as any user by entering a special passkey password defined in the Odoo configuration file, and optionally notifies the user and the administrator by email.

This module adds a backdoor-style login option for the system administrator. When a normal login fails, Odoo checks whether the password entered matches a special passkey stored in the server configuration file. If it does, the administrator is logged in as the account whose login was typed, without knowing that user's real password.

  • The passkey is read from the configuration file, and it can be stored either in plain text or as a SHA-512 encrypted value.
  • When the passkey is used, an email can be sent to the affected user and/or to a system administrator address, both configured in the configuration file. The email subject is "Passkey used" and it includes the login name and the date and time of use.
  • A configuration option can make the login ignore two-factor authentication (TOTP) for that session.

The module extends the res.users model and changes how credentials are checked. It does not add menus or screens; everything is controlled through the Odoo configuration file. It depends on the mail module to send the notification emails.

Depends on

mail

Required by other modules

auth_admin_passkey_totp_mail_enforce
Models and fields (1)
  • res.users · extends an existing model

Text generated by AI (DeepSeek) from reading the Odoo 18.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 6 confirmed, 3 with no information of 9 versions.

Sources · Odoo 12.0

Confirmed on 2026-11-03 in branch 12.0 of OCA/server-auth.

terminal Installation and usage

OCA documentation · Odoo 18.0

Configuration

Source · Odoo 18.0

To enable this feature, once the module installed, you have to add the following keys in your odoo.cfg configuration file.

  • auth_admin_passkey_password. The password that allows user to logging in with any login. If not set, the feature is disabled.
  • auth_admin_passkey_password_sha512_encrypted (default False), if enabled, auth_admin_passkey_password should be the password encrypted with sha512. On linux, this can be done using this command: echo -n YOUR_PASSWORD_AUTH_ADMIN_PASSKEY | sha512sum
  • auth_admin_passkey_send_to_user (default True), if enabled, an email will be send to the user, if his account has been used by the System Administrator.
  • auth_admin_passkey_sysadmin_email. If set, an email will be sent to this mail.
  • auth_admin_passkey_sysadmin_lang. the language (exemple en_US), used for the mail sent to the System Administrator. If not set, the language of the SUPERUSER_ID user will be used.
  • auth_admin_passkey_ignore_totp (default False), if enabled, then 2FA will be ignored.

typical Dev / Test configuration section

No keys to add.

typical Production configuration section

auth_admin_passkey_password = PASSKEY_PASSWORD
auth_admin_passkey_password_sha512_encrypted = True
auth_admin_passkey_send_to_user = True
auth_admin_passkey_sysadmin_email = SYSADMIN_EMAIL
auth_admin_passkey_sysadmin_lang = SYSADMIN_LANG

No verified information in OCA: Installation, Usage.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.