Skip to main content

Multi-factor authentication and passkeys

TOTP

Time-based one-time codes from an authenticator app. Set up during first-run setup, or later from the account page.

An administrator can require MFA for an account. If someone loses their authenticator, the way back is from the host:

Local only
# odoocli user totp-disable admin

Passkeys and trusted devices

Passkeys (WebAuthn) let a device authenticate without a shared secret. A registered device can also be marked trusted, which changes how often it is challenged.

Both require a secure context, which is why the management Web UI serves HTTPS with a self-signed certificate out of the box rather than plain HTTP.

Reach the console by name, not by address

A passkey's relying-party id must be a domain name. The console's certificate carries DNS names only.

Browsing to https://192.0.2.10:5220 will let you sign in with a password and then fail to register or use a passkey, in a way that looks like a browser problem. Use the host name.

Serving the console over plain HTTP

Possible, and it costs you passkeys:

Local only
# odoocli server config endpoints

Set the Web UI's HTTPS option off and re-run server install. Do this only where something else terminates TLS in front of the console.

The console's certificate does not auto-renew

It is issued by server install for the server's host name, and reissued the next time you run server install. It is not part of the maintenance scheduler's certificate renewal, which covers instance certificates.

Put a reminder on it, or simply re-run server install as part of your regular upgrade routine, which is idempotent anyway.

Account lockout

Repeated failed sign-ins lock an account. Clearing that is an administrator action in the console, or from the host:

Local only
# odoocli user unlock admin

Sign-in failures also feed Fail2Ban, which acts on the address rather than the account.