Forced Two-Factor Authentication (2FA)

What kw_2fa does vs. Odoo's built-in TOTP

Odoo's built-in auth_totp (which this module builds on) gives users an option to enable 2FA. Each user can choose to enable or skip it via their profile settings. Admins can suggest it but cannot truly force it.

kw_2fa enforces it — no opt-out. That's the entire point.

How enforcement works

The key override is in models/res_users.py:22-25:

def _mfa_type(self):
    if self.id == self.env.ref('base.user_root').id:
        return super()._mfa_type()  # admin can bypass
    return 'totp'  # everyone else: TOTP forced

And line 27-29:

def _mfa_url(self):
    if not self.totp_enabled:
        return '/kw_2fa/setup_totp'  # redirect to QR setup, not login

So:

1. Any user without TOTP set up → intercepted after password login → sent to QR code setup page
2. Any user with TOTP set up → must enter code on every login (no skip, no remember)

Settings / Configuration

There are no UI settings to toggle — enforcement is absolute by design. The only things you can change are in the source code:

• To also enforce on admin: remove the if self.id == ... guard in _mfa_type()
• To exclude specific users: add additional conditions to _mfa_type()

To use it: install the module. That's it — it activates immediately for all non-admin users.