Email, SMS, and Authenticator App (TOTP) verification with QR code setup wizard

10 one-time backup recovery codes to prevent permanent lockouts

Trusted devices with configurable duration (30-day default) for frictionless repeat logins

Group-based enforcement and granular policy controls for staged rollouts

Admin dashboard with graph and pivot views for adoption tracking and one-click reset

Brute-force protection with login attempt tracking and temporary lockout

Smart resend cooldowns, configurable TTL, and attempt limits

Masked contact hints and clear error messaging for end users

Twilio-ready SMS gateway with test mode for staging and QA environments

Portal user support with public verification page and countdown timers

Installation & Setup

1. Install the module: Go to Apps -> Search for "oe_2fa_auth" -> Click Install
2. Configure permissions: Navigate to Settings -> Users & Companies -> Grant access to administrators who will manage 2FA policies
3. Initial configuration: Open Settings -> General Settings -> Two-Factor Authentication and set TTL, resend limits, trusted device duration, and Twilio credentials

Basic Usage

1. Enroll users: Open each user record, enable Two-Factor Authentication, and choose Authenticator App, Email, or SMS as the primary method
2. Generate backup codes: After enrollment, generate one-time recovery codes and instruct users to store them securely
3. Monitor adoption: Use the admin dashboard to track enrollment rates, method distribution, and verification status across the organization
4. Enforce by group: Assign 2FA requirements to specific user groups in General Settings to phase in security without disrupting all users at once

Tips & Best Practices

• Enable SMS test mode in staging and QA environments to validate flows without sending real messages or incurring Twilio charges
• Roll out 2FA by department using group-based enforcement - start with IT and finance, then expand to all users
• Schedule periodic audits to disable 2FA for deactivated accounts and archive old verification logs
• Combine with oe_access_hub to centralize security policy management across modules

Important Notes

Ensure outbound mail and SMS gateways are operational before launching company-wide MFA. If Twilio credentials rotate, update system parameters immediately to avoid delivery failures. Users must have valid email addresses or phone numbers on their user records for OTP delivery to succeed.

Q: Which Odoo versions and authentication methods are supported?

A: ``oe_2fa_auth`` targets Odoo 18 Community and Enterprise editions. Supported methods include TOTP authenticator apps (Google Authenticator, Authy, Microsoft Authenticator), Email OTP via your configured outgoing mail server, and SMS OTP via Twilio with test mode for staging environments.

Q: How do we onboard hundreds of users quickly?

A: Start with settings defaults, enable 2FA for a pilot group (e.g., IT admins), then expand by department using group-based enforcement. Share the enrollment instructions with users and use the admin dashboard to track progress. Backup codes ensure no one is locked out during rollout.

Q: Can we extend the module with additional SMS providers or authentication methods?

A: Yes. Inherit the relevant methods to connect other SMS gateways or add custom authentication channels. The module is designed with extension points for additional providers and verification methods.

Q: What happens if a user loses their phone or cannot access their primary method?

A: Backup recovery codes provide a fallback. Each code is one-time use and users are prompted to regenerate them after use. Administrators can also disable 2FA for a specific user from the user form in emergencies.

Why Choose Odoo Engineering