[IMP] added option for TOTP/2FA bypass for admin passkey #550
Conversation
…otp configuration option 🐛 fix(res_users.py): set ignore_totp session variable based on the value of auth_admin_passkey_ignore_totp configuration option The README.rst file has been updated to include documentation for the new configuration option `auth_admin_passkey_ignore_totp`. When enabled, this option allows the 2FA (Two-Factor Authentication) feature to be ignored. In the res_users.py file, the `ignore_totp` session variable is now set based on the value of the `auth_admin_passkey_ignore_totp` configuration option. If the option is enabled, the `ignore_totp` session variable is set to True. This ensures that the `_mfa_url` method returns None when `ignore_totp` is True, effectively bypassing the 2FA check.
|
Hi @codeagencybe could you take a look on red CI ? |
|
@codeagencybe Thanks for this contribution. Makes sense. |
|
@codeagencybe Can you fix pre-commit? |
|
@codeagencybe will you attend the comments above, to make pre-commit and tests green? |
| self._send_email_passkey(users[0]) | ||
| else: | ||
| raise | ||
|
|
||
| def _mfa_url(self): |
There was a problem hiding this comment.
Module should inherit auth_totp_mail_enforce to bypass.
There was a problem hiding this comment.
As an alternative to inheriting auth_totp_mail_enforce, we could make use of a glue module to combine this PR and auth_totp_mail_enforce. Here is a proposal of a glue module for V17: #625
|
Hello all. Apologies for late reply, seems like I don't receive any notifications from GitHub except from the last message from Cas. I will review everything shortly and update. |
| @@ -74,6 +75,12 @@ def _check_credentials(self, password, env): | |||
| password = hashlib.sha512(password.encode()).hexdigest() | |||
|
|
|||
| if password and file_password == password: | |||
| request.session['ignore_totp'] = config.get("auth_admin_passkey_ignore_totp", False) | |||
|
There hasn't been any activity on this pull request in the past 4 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days. |
github-actions
bot
added
the
stale
I have added a new option to bypass TOTP/2FA for admin passkey.
In the odoo.conf one needs to add the new parameter as below.
By default, this new option is always false, so it will not bypass TOTP/2FA if it has been set on a user login.
New odoo.conf parameter:
auth_admin_passkey_ignore_totp = TrueI have tested this new feature in several production setups and it's working perfectly.