This module forces internal users to configure two-factor authentication (a TOTP authenticator app) before they log in.
Enforcement works like the password expiry flow of password_security: nobody is logged out when the module is installed, but on their next login users are held in a mandatory step and cannot reach the backend until they have enabled an authenticator app.
Members of the Exempt from 2FA enforcement group are never forced. Portal and public users are out of scope at the moment.
auto_awesome What this module does
AI-generated from the code · Odoo 18.0Forces internal users to set up an authenticator app (two-factor authentication) before they can access Odoo. Users who are not exempt are held on a setup page at login until they scan a QR code and enter a valid 6-digit code.
When this module is installed, internal users who have not yet enabled two-factor authentication are stopped at login and shown a mandatory setup page instead of the normal backend. On that page they see a QR code and a secret key, instructions to install an authenticator app, and a field to enter the 6-digit verification code. They must enter a correct code to activate two-factor authentication and continue to Odoo; if the code is wrong, an error message appears and they can try again. They can also cancel and log out.
The module adds a hidden group called "Exempt from 2FA enforcement". Users in this group are never forced to set up two-factor authentication. Portal and public users are not affected.
The enforcement is checked on the res.users model: a user is considered enforced if they are internal and not in the exempt group. The setup page is available at the URL /web/login/totp/setup. Once the code is verified, the secret is saved on the user and they are redirected to their normal landing page. No existing users are logged out when the module is installed; enforcement happens at their next login.
Depends on
Text generated by AI (DeepSeek) from reading the Odoo 18.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub
Availability by version
Reviewed: 2026-11-03Confirmation status: 1 confirmed, 8 with no information of 9 versions.
Sources · Odoo 18.0
Confirmed on 2026-11-03 in branch 18.0 of OCA/server-auth.
terminal Installation and usage
OCA documentation · Odoo 18.0Usage
Source · Odoo 18.0Once installed, any enforced internal user without an authenticator app configured will, on their next login:
- Enter their login and password as usual.
- Be redirected to a mandatory setup page showing a QR code and secret key.
- Scan the code with an authenticator app and enter the generated code.
- Be handed over to the standard two-factor step to complete the login.
No verified information in OCA: Installation, Configuration.
Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.
Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.