Multi-factor authentication and passkeys
TOTP
Time-based one-time codes from an authenticator app. Set up during first-run setup, or later from the account page.
An administrator can require MFA for an account. If someone loses their authenticator, the way back is from the host:
# odoocli user totp-disable adminPasskeys and trusted devices
Passkeys (WebAuthn) let a device authenticate without a shared secret. A registered device can also be marked trusted, which changes how often it is challenged.
Both require a secure context, which is why the management Web UI serves HTTPS with a self-signed certificate out of the box rather than plain HTTP.
A passkey's relying-party id must be a domain name. The console's certificate carries DNS names only.
Browsing to https://192.0.2.10:5220 will let you sign in with a password and then fail to
register or use a passkey, in a way that looks like a browser problem. Use the host name.
Serving the console over plain HTTP
Possible, and it costs you passkeys:
# odoocli server config endpointsSet the Web UI's HTTPS option off and re-run server install. Do this only where something else
terminates TLS in front of the console.
The console's certificate does not auto-renew
It is issued by server install for the server's host name, and reissued the next time you run
server install. It is not part of the maintenance scheduler's certificate renewal, which covers
instance certificates.
Put a reminder on it, or simply re-run server install as part of your regular upgrade routine,
which is idempotent anyway.
Account lockout
Repeated failed sign-ins lock an account. Clearing that is an administrator action in the console, or from the host:
# odoocli user unlock adminSign-in failures also feed Fail2Ban, which acts on the address rather than the account.