Skip to main content

Users and roles

These are the accounts that sign in to the management Web UI. They are separate from the Odoo users inside a database, which are managed per database.

The four roles

RoleCan
AdministratorEverything, including users, licences and server-level operations
ReadOnlyAdministratorSee everything an administrator can, change nothing
OperatorDay-to-day operations on the instances they are scoped to
ViewerRead-only, on the instances they are scoped to

The first account created during setup is an Administrator and is protected: it cannot later be deleted, disabled or demoted. Locking every administrator out of the console is the one failure with no remedy from inside the console, so the product refuses to allow it.

Instance scoping

Operators and Viewers can be limited to particular instances. This is what makes a shared console workable for a hosting company: a customer's operator sees their own instances and nothing else.

Scoping is by instance id, and it applies to what the API returns, not only to what the UI draws.

Where the boundary really is

Role enforcement happens on the API using the user identity the Web UI forwards. The API key is the machine boundary: anything holding a valid API key is a trusted caller, and roles refine what that caller may do on behalf of a user.

Treat the API key as equivalent to administrator access, and do not hand it to someone you only meant to give Viewer.

Managing users

Users in the Web UI. Adding a user, setting their role, scoping them to instances and requiring multi-factor authentication all happen there.

Break-glass recovery from the host

When nobody can sign in, the CLI can repair accounts locally:

Local only
# odoocli user list
Local only
# odoocli user password-reset admin
Local only
# odoocli user totp-disable admin
Local only
# odoocli user unlock admin

These are deliberately local-only and require root on the server. They are the way back in when MFA is lost or an account is locked out, and they are the reason shell access to the host must be protected at least as carefully as the console itself.