Odoo 19 Authentication System
Overview of login methods, account protection, and session control options in Odoo
The auth documentation set in Odoo 19 covers traditional password login, LDAP, OAuth2, Passkey, two-factor authentication, password policies, account signup, and session timeout controls.
The goal is to help businesses choose the right security level for each audience: internal employees, administrators, portal customers, and partners.
Main feature groups
Key points
• LDAP / Active Directory: Synchronize authentication with the company’s centralized identity system.
• OAuth2: Sign in with Google, Microsoft, GitHub, or another external identity provider.
• Passkey: Passwordless login with WebAuthn, Face ID, Touch ID, or hardware security keys.
• TOTP 2FA and Email 2FA: Add a second security layer for internal or portal accounts.
• Password Policy: Enforce minimum length, display password requirements, and block weak passwords.
• Signup: Support public signup or invitation-only onboarding, plus password reset by email.
• Timeout: Require re-authentication after time-based or inactivity-based expiry.
Choosing the right method
Recommendations by use case
| Scenario | Recommended solution | Why |
|---|---|---|
| Business already uses Active Directory | LDAP | Reuses existing accounts and centralized administration. |
| Company uses Google Workspace or Microsoft 365 | OAuth2 | Convenient login and less separate password management. |
| Managers or sensitive accounts | Passkey or TOTP 2FA | Stronger protection and lower phishing risk. |
| Customer or partner portal | Passkey Portal, TOTP Portal, Password Policy Portal | Balances sign-in convenience with protection for external accounts. |
| New-user registration flow | Signup + Password Policy Signup | Applies control from the moment the account is created. |
| Environment needs fast session lockout | Auth Timeout | Reduces risk when a session is left unattended. |
Basic rollout workflow
Steps
1. Identify the audiences that need protection: internal employees, administrators, portal customers, or new signups.
2. Choose the primary login method: LDAP for directory-based environments, OAuth2 for external providers, or Passkey for passwordless access.
3. Enable extra protection where needed: TOTP 2FA, email-based 2FA, or session timeout controls.
4. Apply password policy across backend, portal, and signup pages to prevent weak passwords from being created.
5. Test each flow: sign-in, password reset, user invitation, and re-authentication after timeout.
6. Train users on phishing, trusted devices, verification codes, and recovery when a device is lost.
Security best practices
Key points
• Always use HTTPS for OAuth2, Passkey, and any flow that handles sensitive login data.
• Require 2FA or Passkey for administrator accounts and groups with sensitive data.
• Limit trusted devices to personal devices and avoid enabling them on shared computers.
• Set password policy strong enough to matter, but not so strict that it causes unnecessary lockouts.
• Combine session timeout with inactivity timeout for areas containing financial or customer data.
• Regularly review security notification emails, new-device sign-ins, and unusual reset requests.