Face Kiosk Attendance
Self-hosted browser face-match clock-in that posts straight to hr.attendance, with raw images never leaving the device.
Why this module
Face Kiosk Attendance
Embeddings, not images
The browser computes a 128-dim face embedding locally and sends only that number array to the server. Raw webcam frames never persist server-side, so there is no image store to breach or to govern.
No subscription kiosk
Enrolment, templates, matches, and attendance all live inside your own Odoo. The match controller, template model, and enrolment wizard ship in the module; there is no third-party service in the clock-in path.
Convenience, not anti-spoofing
This identifies an enrolled face for attendance convenience. A printed photo or a screen can match and a modified client can submit any embedding, so it is not a liveness or security control. Passive liveness is a separate module.
Day in the life
A shift change at the front desk
An employee steps in front of a paired tablet at the welcome screen. The browser captures a face, builds the embedding, and posts it with the device token. The server confirms the device, checks the optional site geofence, cosine-matches the embedding against active consented templates for that company, and applies the company match threshold. On a hit it opens or closes the employee's hr.attendance record and shows the name and action. A near miss below threshold is logged and raises a low-confidence attendance exception for a manager to review.
Edge cases
The cases most modules quietly ignore.
In the shipped code today, each one a place where a cheaper module silently does the wrong thing.
When a face consent is withdrawn, every active template tied to it is deactivated in the same transaction and the cascade is written to the kiosk audit trail with the count, so a later compliance review can prove when it happened.
A retention sweep cron extends the base sweep: expired face consents have their still-active templates deactivated, so a lapsed consent cannot keep matching at the kiosk.
The device token resolves to one device, one site, one company. The match only searches active templates for that company, so a cross-company face match is impossible at the controller layer.
The match endpoint is DB-backed rate limited by token or client IP, so a leaked device token cannot hammer the matcher; over-budget callers get a 429.
When a site enables geofencing, a missing or out-of-radius location returns no-match with a logged reason rather than posting attendance, using a haversine distance against the site coordinates and radius.
A best match worse than the company threshold posts no attendance, records a match_fail event with the distance, and raises an identity_low_confidence attendance exception for review.
Stored templates whose length does not equal the incoming embedding are skipped during matching, and template creation validates that the JSON embedding is numeric and matches its declared dimension.
On a match the server finds the latest open attendance for the employee; if one is open it sets check_out, otherwise it creates a new check_in, so the same gesture clocks in or out correctly.
What is inside
Built to do the job, end to end.
- eh.hr.face.template. Stores the JSON embedding, declared dimension, model identity and version, capture method, quality score, company, and a required link to a granted face consent record. Validations reject non-numeric or mismatched-length embeddings.
- Match controller. The /eh_hr/kiosk/face/match route authenticates by device token, applies rate limiting and optional geofencing, normalises and cosine-matches the embedding against consented active templates, toggles hr.attendance, and logs every step.
- Public kiosk shell. The /eh_hr/kiosk/<site_code> route renders a standalone HTML page with pair, welcome, success, and failure screens. It loads face-api.js and the kiosk scripts directly with an mtime cache-bust, outside the Odoo web client.
- Enrolment wizard. An HR-admin wizard captures three to five samples through an OWL widget, requires a ticked consent acknowledgement, grants or reuses a face consent, and stores each sample as its own template row for varied lighting and angles.
- Employee templates view. Each employee carries face templates, an active-template count, and a computed face-enrolled flag derived from live templates, plus actions to enrol and to view or deactivate templates.
- Role-scoped access. Access rights separate HR user, manager, admin, and auditor groups, so reading templates, enrolling, and unlinking are granted to the right roles only.
Honest about the edges
What this does not do, so nothing surprises you.
- This is an attendance-convenience face match, not an anti-spoofing or liveness control. A printed photo, a screen, or a modified client can defeat it. For passive liveness, add the separate face liveness module.
- face-api.js is not bundled. The model files are large and you choose a release, so you run the supplied static lib setup once before the kiosk works.
- The match is a plain cosine scan over a company's active templates, fast for dozens to low hundreds of employees. Beyond roughly two thousand templates per company an indexed approach is the right answer.
- Requires the attendance base and core suite modules; it relies on their consent, kiosk site and device, rate-limit, audit event, and attendance-exception models.
- Geofencing depends on the browser providing a location and the site being configured with coordinates and a radius; it is optional and off by default.
- The kiosk shell is a standalone public page authenticated by a paired device token, not an Odoo login, so device pairing and token security are operational responsibilities.
face recognition attendance odoo, biometric clock in odoo 18, kiosk attendance odoo community, face-api.js odoo, contactless attendance, no badge time clock, hr attendance kiosk, self hosted face attendance, employee clock in kiosk, geofenced attendance odoo, consent managed biometric, odoo 18 attendance module
Need this fitted to the way you work?
ERP Heritage delivers end to end Odoo work: Odoo Implementation, Customization and Development, Integration, Migration, Consultation, Support and Training. We help teams put this module into production, shape it to their process, and keep it running.
We work with businesses across Australia (Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra) and the Middle East (Dubai, Abu Dhabi, Riyadh, Jeddah, Doha, Kuwait City, Muscat). Start a conversation at erpheritage.com.au or email info@erpheritage.com.au.
Languages
Available in 19 languages
The interface ships translated out of the box. Switch language in Odoo and the fields, menus, and messages follow.
Modules teams pair with this one.
Premium ERP Heritage modules that extend the same stack, each built to the same engineering bar.
Interactive drag and drop Gantt planner for Odoo 18 Community project tasks with a deterministic server side sche...
Employment Hero Connector is the integration core of the ERP Heritage Employment Hero suite, providing per compan...
The United Kingdom country pack for the ERP Heritage Employment Hero integration
Sync Employment Hero employees, departments and payroll bank details into standard Odoo Community HR over the pla...
Inbound webhook receiver for the Employment Hero people and payroll platform on Odoo 18 Community
Real-time fiscalisation of customer invoices and credit notes with the Mauritius Revenue Authority e-Invoicing (E...
Please log in to comment on this module