Setting Up Password Policies and 2FA in Odoo: Enhanced Security

# Install auth_totp module (OCA - open source)
pip install odoo-addon-auth-totp

# Or from GitHub
git clone https://github.com/OCA/server-auth.git
cd server-auth/auth_totp

# Add to your custom module
from odoo import models, fields, api
from odoo.exceptions import AccessDenied

class ResUsers(models.Model):
    _inherit = 'res.users'
    
    require_2fa = fields.Boolean(
        string='Require 2FA',
        default=True,
        company_dependent=True,
        help='Force user to enable 2FA'
    )
    
    @api.model
    def create(self, vals):
        """Enforce 2FA for new users."""
        user = super().create(vals)
        
        # Require 2FA if policy enabled
        if user.company_id.require_2fa and not user.totp_enabled:
            user.message_post(
                body="Security Notice: 2FA is required. Please enable it in your preferences."
            )
        return user

pip install odoo-addon-password-security odoo-addon-auth-totp

SELECT login, totp_enabled, last_login
FROM res_users
WHERE active = true
  AND totp_enabled = false
ORDER BY last_login DESC;

# Result: Identify users not yet set up

# Send email when user logs in from new device
from odoo import models

class ResUsers(models.Model):
    _inherit = 'res.users'
    
    def _check_login_location(self):
        """Alert user of login from new location."""
        # Get IP address
        request_ip = request.environ.get('REMOTE_ADDR')
        user_ips = self.env['user.login.ip'].search([
            ('user_id', '=', self.id)
        ])
        
        # Check if IP is new
        if request_ip not in user_ips.mapped('ip'):
            # Send alert email
            self.env['mail.mail'].create({
                'subject': 'New login to Odoo',
                'email_to': self.email,
                'body': f'Login detected from new location: {request_ip}'
            }).send()
            
            # Store IP
            self.env['user.login.ip'].create({
                'user_id': self.id,
                'ip': request_ip,
            })