HTTPS certificate (IoT)

# HTTPS certificate (IoT)

Hypertext Transfer Protocol Secure (HTTPS) is the secure and encrypted version of Hypertext
Transfer Protocol (HTTP), which is the primary protocol used for data communication between a web
browser and a website. It secures communications by using an encryption protocol known as Transport
Layer Security (TLS), previously called Secure Sockets Layer (SSL). The security of HTTPS relies on TLS / SSL certificates, which authenticate the provider and verify their
identity.
The use of HTTPS is required to communicate with certain network devices, particularly payment
terminals. If the HTTPS certificate is not valid, some devices cannot interact with the IoT
system.
In this documentation and throughout Odoo, the term HTTPS certificate refers to a valid
SSL certificate that allows an HTTPS connection.

## HTTPS certificate generation

The HTTPS certificate is generated automatically. When the IoT system is (re-)started (e.g., after
it is connected to the Odoo database), a request is sent to https://www.odoo.com , which returns
the HTTPS certificate if the IoT system and database meet the eligibility criteria:
- The database must be a production instance. The database instance should not be a copy, a
duplicate, a staging, or a development environment.
The database must be a production instance. The database instance should not be a copy, a
duplicate, a staging, or a development environment.
- The Odoo subscription must be ongoing ( In Progress status) and have an IoT
box subscription line.
The Odoo subscription must be ongoing ( In Progress status) and have an IoT
box subscription line.
When the certificate has been received:
- The IoT systemâs homepage address is updated to a new HTTPS URL ending with .odoo-iot.com . Click
the URL to establish a secure HTTPS connection.
The IoT systemâs homepage address is updated to a new HTTPS URL ending with .odoo-iot.com . Click
the URL to establish a secure HTTPS connection.
`.odoo-iot.com`
- The HTTPS certificate banner displays the certificateâs validity period. To view this
information, click the ( cogs ) button on the IoT systemâs homepage.
The HTTPS certificate banner displays the certificateâs validity period. To view this
information, click the ( cogs ) button on the IoT systemâs homepage.

## HTTPS certificate generation issues and errors

### The HTTPS certificate does not generate

Potential causes include the following:
- No IoT box subscription is linked to your account.
No IoT box subscription is linked to your account.
- The IoT box subscription was added after connecting the IoT
system to the database. In this case, refresh the IoT systemâs homepage or reboot/ restart the IoT system to regenerate the HTTPS certificate.
The IoT box subscription was added after connecting the IoT
system to the database. In this case, refresh the IoT systemâs homepage or reboot/ restart the IoT system to regenerate the HTTPS certificate.
- The firewall is preventing the HTTPS certificate from generating correctly. In this case,
deactivate the firewall until the certificate is successfully generated. Note Some devices, such as routers with a built-in firewall, can prevent the HTTPS certificate from
generating.
The firewall is preventing the HTTPS certificate from generating correctly. In this case,
deactivate the firewall until the certificate is successfully generated.
Some devices, such as routers with a built-in firewall, can prevent the HTTPS certificate from
generating.

### The IoT systemâs homepage can be accessed using its IP address but not thexxx.odoo-iot.comURL

`xxx.odoo-iot.com`
Contact your system or network administrator to address the issue. Network-related problems are
beyond the scope of Odoo support services.
- If the router allows manual DNS configuration, update the settings to
use Google DNS .
If the router allows manual DNS configuration, update the settings to
use Google DNS .
- If the router does not support this, you need to update the DNS settings directly on each device
that interacts with the IoT system to use Google DNS . Instructions for configuring DNS on individual
devices can be found on the respective manufacturerâs website.
If the router does not support this, you need to update the DNS settings directly on each device
that interacts with the IoT system to use Google DNS . Instructions for configuring DNS on individual
devices can be found on the respective manufacturerâs website.
- Some IoT devices, such as payment terminals, likely do not require DNS changes, as they are
typically pre-configured with custom DNS settings.
Some IoT devices, such as payment terminals, likely do not require DNS changes, as they are
typically pre-configured with custom DNS settings.
- On some browsers, an error code mentioning the DNS (such as DNS_PROBE_FINISHED_NXDOMAIN ) is
displayed.
On some browsers, an error code mentioning the DNS (such as DNS_PROBE_FINISHED_NXDOMAIN ) is
displayed.
`DNS_PROBE_FINISHED_NXDOMAIN`

### Errors

A specific error code is displayed on the IoT systemâs homepage if any issues occur during the
generation or reception of the HTTPS certificate.
When you access the IoT systemâs homepage, it automatically checks for an HTTPS certificate and
attempts to generate one if it is missing. If an error appears, refresh the page to see if the
issue is resolved.

#### ERR_IOT_HTTPS_CHECK_NO_SERVER

`ERR_IOT_HTTPS_CHECK_NO_SERVER`
The server configuration is missing, i.e., the Odoo instance is not connected to
the IoT system.

#### ERR_IOT_HTTPS_CHECK_CERT_READ_EXCEPTION

`ERR_IOT_HTTPS_CHECK_CERT_READ_EXCEPTION`
An error occurred while attempting to read the existing HTTPS certificate.
Verify that the HTTPS certificate file is readable.

#### ERR_IOT_HTTPS_LOAD_NO_CREDENTIAL

`ERR_IOT_HTTPS_LOAD_NO_CREDENTIAL`
The contract and/or database UUID is missing form the IoT.
Verify that both values are correctly configured. To update them, access the IoT boxâs or Windows virtual IoTâs homepage ,
click the ( cogs ) button, then click Credential .

#### ERR_IOT_HTTPS_LOAD_REQUEST_EXCEPTION

`ERR_IOT_HTTPS_LOAD_REQUEST_EXCEPTION`
An unexpected error occurred while the IoT system tried to reach https://www.odoo.com . This is
likely due to network-related issues, such as:
- The IoT system does not have Internet access.
The IoT system does not have Internet access.
- Network restrictions (e.g., firewalls or VPNs) are preventing communication with https://www.odoo.com .
Network restrictions (e.g., firewalls or VPNs) are preventing communication with https://www.odoo.com .
- To access the full request exception details with information regarding the error, enable
the developer mode , click the IoT systemâs card in the IoT app, and click Download logs on the IoT systemâs form .
To define the log levels recorded in the IoT systemâs log file, access the IoT boxâs or Windows virtual IoTâs homepage,
click the ( cogs ) button, then Log level at the
bottom of the page.
To access the full request exception details with information regarding the error, enable
the developer mode , click the IoT systemâs card in the IoT app, and click Download logs on the IoT systemâs form .
To define the log levels recorded in the IoT systemâs log file, access the IoT boxâs or Windows virtual IoTâs homepage,
click the ( cogs ) button, then Log level at the
bottom of the page.
- To address network-related issues, contact your system or network administrator; these issues
are beyond the scope of Odoo support services.
To address network-related issues, contact your system or network administrator; these issues
are beyond the scope of Odoo support services.

#### ERR_IOT_HTTPS_LOAD_REQUEST_STATUS

`ERR_IOT_HTTPS_LOAD_REQUEST_STATUS`
The IoT system successfully reached https://www.odoo.com but received an unexpected HTTP response (status codes) .
This error code includes the HTTP status. For example, ERR_IOT_HTTPS_LOAD_REQUEST_STATUS 404 means
the server returned a âPage Not Foundâ response.
`ERR_IOT_HTTPS_LOAD_REQUEST_STATUS404`
- Open https://www.odoo.com in a web browser to check if the website is temporarily down for
maintenance.
Open https://www.odoo.com in a web browser to check if the website is temporarily down for
maintenance.
- If https://www.odoo.com is down for maintenance, wait for it to resume. If the website is operational, open a support ticket and make
sure to include the 3-digit HTTPS status code in the ticket.

#### ERR_IOT_HTTPS_LOAD_REQUEST_NO_RESULT

`ERR_IOT_HTTPS_LOAD_REQUEST_NO_RESULT`
The IoT system successfully connected to https://www.odoo.com , but the server refused to
provide the HTTPS certificate.
Check that the IoT system and database meet the eligibility requirements for an HTTPS certificate.


IoT box SSH connection

# IoT box SSH connection

SSH connections are only available for IoT boxes , not the Windows
virtual IoT .
- This feature should only be used with trusted parties, as it provides administrative
access to the IoT box, which can create security issues.
This feature should only be used with trusted parties, as it provides administrative
access to the IoT box, which can create security issues.
- Managing an SSH connection is not covered under the standard Odoo support scope. Visit
the Odoo Support page for additional information about what is
covered.
Managing an SSH connection is not covered under the standard Odoo support scope. Visit
the Odoo Support page for additional information about what is
covered.
To provide an SSH connection to an IoT box, you must generate a
password:
- Access the IoT boxâs homepage by opening the IoT app and clicking the IP address displayed
on the IoT boxâs card.
Access the IoT boxâs homepage by opening the IoT app and clicking the IP address displayed
on the IoT boxâs card.
- Click the ( cogs ) button at the top-right, then Remote
Debug .
Click the ( cogs ) button at the top-right, then Remote
Debug .
- In the Remote Debugging popup that opens, click Generate and save the
password securely. Once you close the popup, the password will no longer be available.
In the Remote Debugging popup that opens, click Generate and save the
password securely. Once you close the popup, the password will no longer be available.
- Enter the Authentication Token provided by the user attempting to connect to the IoT
box.
Enter the Authentication Token provided by the user attempting to connect to the IoT
box.
- Click Enable Remote Debugging .
Click Enable Remote Debugging .
- IoT box
- IoT system connection to Odoo
IoT system connection to Odoo


IoT system updates

# IoT system updates

Due to the complexity of IoT systems, the term updating can refer to several processes, including:
- Updating the IoT systemâs image and/or core code ;
Updating the IoT systemâs image and/or core code ;
- Updating the handlers , which include the interfaces and drivers.
Updating the handlers , which include the interfaces and drivers.

## Image and core code update

To check if the IoT box is up-to-date (and update it if needed), access the IoT boxâs
homepage , click the ( cogs ) button at the
top-right, then Update in the Version section.
Enable the developer mode to view the current versions of the IoT
boxâs image and core code.
To update the IoT boxâs image, flash its SD card. Flashing can be performed using balenaEtcher , a free and open-source tool for writing disk
images to SD cards.
- Updating the IoT systemâs image is often required after upgrading the Odoo database to a
newer version.
Updating the IoT systemâs image is often required after upgrading the Odoo database to a
newer version.
- A computer with a micro SD card reader/adapter is required to flash the micro SD card.
A computer with a micro SD card reader/adapter is required to flash the micro SD card.
- An alternative software for flashing the micro SD card is Raspberry Pi Imager .
An alternative software for flashing the micro SD card is Raspberry Pi Imager .
- Download balenaEtcher.
Download balenaEtcher.
- Insert the IoT boxâs micro SD card into the computer or adapter.
Insert the IoT boxâs micro SD card into the computer or adapter.
- Open balenaEtcher, click Flash from URL , and enter the following URL: http://nightly.odoo.com/master/iotbox/iotbox-latest.zip .
Open balenaEtcher, click Flash from URL , and enter the following URL: http://nightly.odoo.com/master/iotbox/iotbox-latest.zip .
`http://nightly.odoo.com/master/iotbox/iotbox-latest.zip`
- Click Select target and select the SD card.
Click Select target and select the SD card.
- Click Flash and wait for the process to finish.
Click Flash and wait for the process to finish.
To update the IoT boxâs core code, click Update under IoT Box Update in the Update popup.
This process may take over 30 minutes. Do not turn off or unplug the IoT box during
this time, as doing so could leave the device in an inconsistent state, requiring the IoT
box to be reflashed with a new image.
To update the Windows virtual IoTâs image and code, uninstall the program and reinstall the latest
package.

## Handler (driver) update

To update the IoT systemâs handlers (i.e., drivers and interfaces) and synchronize them with the
configured server handlerâs code, for example, to resolve issues where devices are not functioning properly with the IoT system, proceed as follows:
- Access the IoT boxâs or Windows virtual IoTâs homepage and click the ( cogs ) button at
the top-right.
Access the IoT boxâs or Windows virtual IoTâs homepage and click the ( cogs ) button at
the top-right.
- Click Update in the Version section.
Click Update in the Version section.
- In the Update popup that opens, click Force Drivers Update .
In the Update popup that opens, click Force Drivers Update .
If you have an on-premise or Odoo.sh database, the configured server must be up-to-date to ensure the
handlersâ code includes the latest fixes and patches.
A handler update is also performed automatically every time the IoT system is restarted unless
the Automatic drivers update option is disabled in the Technical
information tab in the IoT systemâs form in Odoo.

Image and core code update
Handler (driver) update


IoT box

# IoT box

To start using an IoT box:
- Make sure you have a valid IoT box subscription in addition to
your Odoo subscription.
Make sure you have a valid IoT box subscription in addition to
your Odoo subscription.
- Connect your devices to the IoT box.
Connect your devices to the IoT box.
- Connect the IoT box to the network .
Connect the IoT box to the network .
- Connect the IoT box to your Odoo database .
Connect the IoT box to your Odoo database .
Video: How to Set Up and Use the Odoo IoT Box: A Beginnerâs Guide
Devices can also be connected after the IoT box is added to the network and/or connected to the
database; however, a reboot of the IoT box might be required.
Never make the IoT box accessible from the public Internet.
IoT systems are designed to provide your database with access to devices on your local network.
Exposing them to the public Internet would create a security risk .

## Network connection

The IoT box can be connected to the network via Ethernet or Wi-Fi .
All devices must be connected to the same network : the IoT box, the device(s) connected
to the IoT box, and the computer connected to Odoo.

### Ethernet

Plug the Ethernet cable into the IoT boxâs Ethernet port and an available port on your router, then
connect the IoT box to a power source.

### Wi-Fi

Make sure no Ethernet cable is connected to the IoT box and follow these steps:
- Connect the IoT box to a power source and wait a few minutes for it to power on.
Connect the IoT box to a power source and wait a few minutes for it to power on.
- Access your computerâs Wi-Fi settings and select the IoT boxâs network. The network name is in
the format IoTBox-xxxxxxxxxxxx (where xxxxxxxxxxxx is a unique identifier).
Access your computerâs Wi-Fi settings and select the IoT boxâs network. The network name is in
the format IoTBox-xxxxxxxxxxxx (where xxxxxxxxxxxx is a unique identifier).
`IoTBox-xxxxxxxxxxxx`
`xxxxxxxxxxxx`
- Connect to the IoT boxâs Wi-Fi network and sign into it; your browser should automatically
open and redirect to the IoT boxâs homepage . Note Depending on your operating system, the browser might not open and redirect to the IoT boxâs
homepage. In this case, open your browser manually and navigate to http://10.11.12.1 or any url starting with http (e.g., http://odoo.com ).
Connect to the IoT boxâs Wi-Fi network and sign into it; your browser should automatically
open and redirect to the IoT boxâs homepage .
Depending on your operating system, the browser might not open and redirect to the IoT boxâs
homepage. In this case, open your browser manually and navigate to http://10.11.12.1 or any url starting with http (e.g., http://odoo.com ).
`http://10.11.12.1`
`http://odoo.com`
- On the IoT boxâs homepage, click Configure next to the Internet Status section.
On the IoT boxâs homepage, click Configure next to the Internet Status section.
- Wait a few minutes for the available networks to be scanned, select the network, enter the
Wi-Fiâs password, and click Connect .
Wait a few minutes for the available networks to be scanned, select the network, enter the
Wi-Fiâs password, and click Connect .
Once connected to the Wi-Fi network, the IoT box stops emitting its Wi-Fi signal, and the
computer should automatically reconnect to its original network. If it does not, reconnect to it
manually.

## IoT box homepage

To access the IoT boxâs homepage, open a web browser on the same network as the IoT box and
navigate to the IoT boxâs IP address.
The IoT boxâs IP address can be retrieved by:
- connecting the IoT box to an external monitor: the IP address is displayed on the screen.
connecting the IoT box to an external monitor: the IP address is displayed on the screen.
- connecting the IoT box to a supported receipt or label printer with a USB cable: the IP address is automatically printed.
connecting the IoT box to a supported receipt or label printer with a USB cable: the IP address is automatically printed.
- accessing the administrator interface of the router to which the IoT box is connected or using
third-party software to scan the network.
accessing the administrator interface of the router to which the IoT box is connected or using
third-party software to scan the network.
Once the IoT box is connected to the Odoo database , its homepage can be accessed
from Odoo by opening the IoT app and clicking the URL displayed on the IoT boxâs card.

Network connection
Ethernet
Wi-Fi
IoT box homepage


Windows virtual IoT

# Windows virtual IoT

To start using the Windows virtual IoT:
- Make sure all prerequisites are met.
Make sure all prerequisites are met.
- Install the Windows virtual IoT on a Windows computer.
Install the Windows virtual IoT on a Windows computer.
- Configure the Windows Firewall .
Configure the Windows Firewall .
- Connect your devices to the Windows virtual IoT.
Connect your devices to the Windows virtual IoT.
- Connect the Windows virtual IoT to your Odoo database .
Connect the Windows virtual IoT to your Odoo database .

## Prerequisites

The following prerequisites must be met before setting up and using the Windows virtual IoT:
- A valid IoT box subscription .
A valid IoT box subscription .
- An updated and recent version of Windows (i.e., Windows 10 or Windows 11) installed on a Windows
computer (laptop, desktop, or server).
An updated and recent version of Windows (i.e., Windows 10 or Windows 11) installed on a Windows
computer (laptop, desktop, or server).
- MRP devices, including cameras and measurement tools,
are not compatible with Windows virtual IoT.
MRP devices, including cameras and measurement tools,
are not compatible with Windows virtual IoT.
- It is also possible to create a Windows Virtual Machine on a MacOS/Linux computer. However,
this option is not supported by Odoo, and no troubleshooting assistance will be provided.
It is also possible to create a Windows Virtual Machine on a MacOS/Linux computer. However,
this option is not supported by Odoo, and no troubleshooting assistance will be provided.
Never make the Windows virtual IoT accessible from the public Internet.
IoT systems are designed to provide your database with access to devices on your local network.
Exposing them to the public Internet would create a security risk .

## Installation

To install the Windows virtual IoT on a Windows computer:
- Access Odooâs download page and download the Community edition
of Odoo for Windows matching your databaseâs version .
Access Odooâs download page and download the Community edition
of Odoo for Windows matching your databaseâs version .
- Open the downloaded .exe file, allow the app to make changes to your device, select
a language, and click OK .
Open the downloaded .exe file, allow the app to make changes to your device, select
a language, and click OK .
`.exe`
- Click Next , then I Agree to accept the terms and conditions and continue.
Click Next , then I Agree to accept the terms and conditions and continue.
- Select Odoo IoT from the Select the type of install dropdown list. The
following components should be selected: Odoo Server, Odoo IoT, Nginx WebServer, and Ghostscript
interpreter.
Select Odoo IoT from the Select the type of install dropdown list. The
following components should be selected: Odoo Server, Odoo IoT, Nginx WebServer, and Ghostscript
interpreter.
- Verify you have the required space on your computer and click Next .
Verify you have the required space on your computer and click Next .
- In the Destination folder , enter C:\odoo and click Install . Warning Do not install Odooâs Windows virtual IoT in any Windows user directory, as this can cause
issues with HTTPS certificate generation .
In the Destination folder , enter C:\odoo and click Install .
Do not install Odooâs Windows virtual IoT in any Windows user directory, as this can cause
issues with HTTPS certificate generation .
- Once the installation is complete, click Next .
Once the installation is complete, click Next .
- Set up GPL Ghostscript: Click Next , agree to the terms and conditions, click Install , then Finish .
Set up GPL Ghostscript: Click Next , agree to the terms and conditions, click Install , then Finish .
- Click Next , Next , and Finish to complete the setup. The IoT systemâs homepage automatically opens in a web browser with
the URL http://localhost:8069 . Tip If the web browser does not show anything, restart the
Windows virtual IoT service.
Click Next , Next , and Finish to complete the setup. The IoT systemâs homepage automatically opens in a web browser with
the URL http://localhost:8069 .
`http://localhost:8069`
If the web browser does not show anything, restart the
Windows virtual IoT service.
- Check that you can access the IoT systemâs homepage in a web
browser: on the Windows virtual IoT computer, and on another device on the same network as the IoT system by navigating to the URL http://xxx:8069 (where xxx is the IoT systemâs IP address). on another device on the same network as the IoT system by navigating to the URL https://xxx (where xxx is the IoT systemâs IP address) to test for HTTPS connection. Tip If you cannot access the IoT systemâs homepage from
another device, create a Windows Firewall rule to allow
communication through port 8069 .
Check that you can access the IoT systemâs homepage in a web
browser:
- on the Windows virtual IoT computer, and
on the Windows virtual IoT computer, and
- on another device on the same network as the IoT system by navigating to the URL http://xxx:8069 (where xxx is the IoT systemâs IP address).
on another device on the same network as the IoT system by navigating to the URL http://xxx:8069 (where xxx is the IoT systemâs IP address).
`http://xxx:8069`
`xxx`
- on another device on the same network as the IoT system by navigating to the URL https://xxx (where xxx is the IoT systemâs IP address) to test for HTTPS connection. Tip If you cannot access the IoT systemâs homepage from
another device, create a Windows Firewall rule to allow
communication through port 8069 .
on another device on the same network as the IoT system by navigating to the URL https://xxx (where xxx is the IoT systemâs IP address) to test for HTTPS connection.
`https://xxx`
`xxx`
If you cannot access the IoT systemâs homepage from
another device, create a Windows Firewall rule to allow
communication through port 8069 .
`8069`

## Windows Firewall configuration

Firewalls help keep devices secure but can sometimes block legitimate connections. If the Windows
virtual IoT isnât accessible on the LAN , for example from another
device, it could be due to a firewall blocking the connection. To prevent this issue, configure
exceptions for network discovery in the OS or firewall settings.
If third-party firewall software is installed on the Windows computer, refer to the softwareâs
documentation to configure firewall exceptions.
To create a rule on Windows Defender and allow communication through port 8069 , follow these
steps:
`8069`
- Search the Windows start menu for firewall and select the Windows Defender Firewall
with Advanced Security app.
Search the Windows start menu for firewall and select the Windows Defender Firewall
with Advanced Security app.
`firewall`
- In the left part of the window, select Inbound Rules .
In the left part of the window, select Inbound Rules .
- In the right part of the window, under Actions , click New Rule .
In the right part of the window, under Actions , click New Rule .
- In the New Inbound Rule Wizard that opens, select the Port type of rule
and click Next .
In the New Inbound Rule Wizard that opens, select the Port type of rule
and click Next .
- On the Protocols and Ports page, make sure TCP and Specified
local ports are selected, enter the following in the field: 8069, 80, 443 , and click Next . Note Other ports may be necessary depending on your IoT devices. For example, for the Worldline payment terminal,
add the 9050 port.
On the Protocols and Ports page, make sure TCP and Specified
local ports are selected, enter the following in the field: 8069, 80, 443 , and click Next .
`8069,80,443`
Other ports may be necessary depending on your IoT devices. For example, for the Worldline payment terminal,
add the 9050 port.
`9050`
- On the Action page, select Allow the connection and click Next .
On the Action page, select Allow the connection and click Next .
- On the Profile page, disable any connection type(s) that donât apply to your
Windows computer and click Next .
On the Profile page, disable any connection type(s) that donât apply to your
Windows computer and click Next .
- On the Name page, provide a Name (e.g., Odoo ) and, optionally, a brief Description , then click Finish .
On the Name page, provide a Name (e.g., Odoo ) and, optionally, a brief Description , then click Finish .
`Odoo`
Windows Firewall rules documentation

## Windows virtual IoT homepage

To access the Windows virtual IoTâs homepage, navigate to the URL http://localhost:8069 on the
Windows virtual IoT computer or open a web browser from another computer on the same network as
the IoT system and navigate to the URL http://xxx:8069 (where xxx is the IoT systemâs IP
address).
`http://localhost:8069`
`http://xxx:8069`
`xxx`
Once the Windows virtual IoT is connected to the Odoo database , its homepage can
be accessed from Odoo by opening the IoT app and clicking the URL displayed on the IoT systemâs
card.
Make sure the Windows Firewall is configured to allow access.

## Device connection

Most devices automatically connect to the Windows computer used for the Windows
Virtual IoT through Windows Plug and Play (PnP) .
However, if Windows does not recognize the device automatically upon connection, the administrator
may need to manually install the appropriate drivers.
After connecting the devices to the computer, refresh the IoT systemâs homepage to verify that the device is listed. If the device does not appear, reload the handlers from the IoT systemâs homepage .

## Windows virtual IoT restart

To manually restart the Windows IoT server, search the Windows start menu for services and
select the Services app. Scroll down to the odoo-server-xxx service (where xxx is the odoo version), right-click it, and select Start or Restart .
`services`
`xxx`

## Windows virtual IoT uninstall

To uninstall the Windows virtual IoT, uninstall the Odoo program on your Windows computer. Confirm the uninstallation and complete the steps in the Odoo Uninstall dialog.

Prerequisites
Installation
Windows Firewall configuration
Windows virtual IoT homepage
Device connection
Windows virtual IoT restart
Windows virtual IoT uninstall


Users

# Users

Odoo defines a user as someone who has access to a database. An administrator can add as many
users as the company needs and, in order to restrict the type of information each user can access,
rules can be applied to each user. Users and access rights can be added and changed at any point.
- Change languages
- Access rights
- Superuser mode
- Create and modify groups
Create and modify groups

## Add individual users

To add new users, navigate to Settings app â£ Users section â£ Manage Users , and
click on New .
Fill in the form with all the required information. Under the Access Rights tab, choose the group within each application the user can have access to.
The list of applications shown is based on the applications installed on the database.
After filling out all the necessary fields on the page, (Save
manually) . An invitation email is automatically sent to the user, using the email in the Email Address field. The user must click on the link included in the email to accept the
invitation, and to create a database login.
If the company is on a monthly subscription plan, the database automatically updates to reflect
the added users. If the company is on a yearly or multi-year plan, an expiration banner appears
in the database. An upsell quotation can be created by clicking the banner to update the
subscription. Alternatively, send a support ticket to resolve the
issue.

### User type

User Type can be chosen on the Manage Users page by clicking on the search
bar, and then setting a filter for either Internal
User or Portal User .
Odoo databases have three types of users: Internal User , Portal , and Public . Users are considered internal database users. Portal users are external
users , who only have access to the database portal to view records. Public users are those visiting
websites, via the websiteâs frontend. See the documentation on Portal access .
The Portal user option does not allow the administrator to choose access rights.
These users have specific access rights pre-set (such as, record rules and restricted menus), and
usually do not belong to the usual Odoo groups.

## User devices

For security purposes, when a user logs into the database, the various login information, such as
the IP address, is stored in the userâs profile. It is best practice to check this periodically, to
ensure all access is from the user, and no one else has accessed the database.
To check the logged-in devices, click the user icon in the upper-right corner, and click My Profile . This opens the userâs profile in the Settings app. Click the Devices tab to view a Kanban list of all devices the user has logged into the database
with. Any device currently logged into the system displays a green circle next to the device name on
the Kanban card.
Click on a card to view the details for the device. Each card displays the User name,
the Name of the device, the Last IP Address used as well as the Linked IP Address . It also shows the First Activity and Last
Activity , which shows when the device first logged into the database, and the last time it was
active on the database.
If a device is legitimate and should be retained, click Save .
If the device is legitimate but should not be retained, and does not pose a security risk, click Delete .

### Revoke devices

If a listed device is not a legitimate user device, and could be a potential security risk,
remove the device and revoke access by clicking the Revoke button.
A Security Control pop-up window loads, asking to Please confirm your identity by entering your password . Enter the userâs password, then click Confirm Password .
`Pleaseconfirmyouridentitybyenteringyourpassword`
The device disappears from the Devices tab and can no longer be used to log into the
database.

## Deactivate users

To deactivate (i.e. archive) a user, navigate to Settings app â£ Users section â£
Manage Users . Then, tick the checkbox to the left of the users to be deactivated.
After selecting the appropriate user to be archived, click the (Actions) icon, and select Archive from the resulting drop-down menu. Then, click OK from the Confirmation pop-up window that appears.
Never deactivate the main/administrator user (admin). Making changes to admin users can have
a detrimental impact on the database. This includes impotent admin , which means that no user in
the database can make changes to the access rights. For this reason, Odoo recommends contacting
an Odoo Business Analyst, or our Support Team, before making changes.

### Error: too many users

If there are more users in an Odoo database than provisioned in the Odoo Enterprise subscription,
the following message is displayed.
When the message appears, the database administrator has 30 days to act before the database expires.
The countdown is updated every day.
To resolve the issue, either:
- Add more users to the subscription by clicking the Upgrade your subscription link
displayed in the message to validate the upsell quotation, and pay for the extra users.
Add more users to the subscription by clicking the Upgrade your subscription link
displayed in the message to validate the upsell quotation, and pay for the extra users.
- Deactivate users , and reject the upsell quotation.
Deactivate users , and reject the upsell quotation.
If the company is on a monthly subscription plan, the database automatically updates to reflect
the added users. If the company is on a yearly or multi-year plan, an expiration banner appears
in the database. An upsell quotation can be created by clicking the banner to update the
subscription. Alternatively, users can send a support ticket to
resolve the issue.
Once the database has the correct number of users, the expiration message disappears automatically
after a few days, when the next verification occurs.

## Password management

Password management is an important part of granting users autonomous access to the database at all
times. Odoo offers a few different methods to reset a userâs password.
Odoo has a setting to specify the length needed for a password. This setting can be accessed by
navigating to Settings app â£ Permissions section, and entering the desired
password length in the Minimum Password Length field. By default the value is 8 .
`8`

### Reset password

Sometimes, users might wish to reset their personal password for added security, so they are the
only ones with access to the password. Odoo offers two different reset options: one initiated by the
user to reset the password, and another where the administrator triggers a reset.

#### Enable password reset from login page

It is possible to enable/disable password resets directly from the login page. This action is
completed by the individual user, and this setting is enabled by default.
To change this setting, go to Settings app â£ Permissions section, activate Password Reset , and then click Save .
On the login page, click Reset Password to initiate the password reset process, and have
a reset-token sent to the email on file.

#### Send reset instructions

Go to Settings app â£ Users & Companies â£ Users , select the user from the list,
and click on Send Password Reset Instructions on the user form. An email is
automatically sent to them with password reset instructions.
The Send Password Reset Instructions button only appears if the Odoo invitation
email has already been confirmed by the user. Otherwise, a Re-send Invitation Email button appears.
This email contains all the instructions needed to reset the password, along with a link redirecting
the user to an Odoo login page.

### Change user password

Go to Settings app â£ Users & Companies â£ Users , and select a user to access its
form. Click on the (Actions) icon, and select Change Password from the resulting drop-down menu. Enter a new password in the New Password column of
the Change Password pop-up window that appears, and confirm the change by clicking Change Password .
This operation only modifies the password of the users locally, and does not affect their
Odoo account.
If the Odoo password needs to be changed, use the send the password reset . Odoo.com passwords grant access to the My Databases page, and
other portal features.
After clicking Change Password , the page is redirected to an Odoo login page where the
database can be re-accessed using the new password.

## Multi Companies

The Multi Companies field on a user form allows an administrator to provide access to
multiple companies for users. To configure a multi-company environment for a user, navigate to the
desired user by going to: Settings app â£ Users section â£ Manage users . Then,
select the user to open their user form, and configure with multi-company access.
Under Multi Companies in the Access Rights tab, set the fields labeled Allowed Companies and Default Company .
The Allowed Companies field can contain multiple companies. These are the companies the
user can access and edit, according to the set access rights. The Default Company is the
company the user defaults to, upon logging in each time. This field can contain only one company.
If multi-company access is not configured correctly, it could lead to inconsistent multi-company
behaviors. Because of this, only experienced Odoo users should make access rights changes to
users for databases with a multi-company configuration. For technical explanations, refer to the
developer documentation on Multi-company Guidelines .

Add individual users
User type
User devices
Revoke devices
Deactivate users
Error: too many users
Password management
Reset password
Change user password
Multi Companies


Two-factor authentication

# Two-factor authentication

Two-factor authentication (2FA) is a way to improve security, and prevent unauthorized persons
from accessing user accounts.
Practically, 2FA means storing a secret inside an authenticator , usually on a mobile phone, and
exchanging a code from the authenticator when trying to log in.
This means an unauthorized user would need to guess the account password and have access to the
authenticator, which is a more difficult proposition.
Some governments, such as the Australian government, require 2FA . For these fiscal localizations , it is not possible to deactivate 2FA .

## Requirements

These lists are just examples. They are not endorsements of any specific software.
Phone-based authenticators are the easiest and most commonly used. Examples include:
- FreeOTP
- Google Authenticator
- LastPass Authenticator
LastPass Authenticator
- Microsoft Authenticator
Microsoft Authenticator
Password managers are another option. Common examples include:
- 1Password
- Bitwarden
The remainder of this document uses Google Authenticator as an example, as it is one of the most
commonly used. This is not an endorsement of the product.

## Two-factor authentication setup

After selecting an authenticator, log in to Odoo, then click the profile avatar in the upper-right
corner, and select My Profile from the resulting drop-down menu.
Click the Account Security tab, then slide the Two-Factor Authentication toggle to active .
This generates a Security Control pop-up window that requires password confirmation to
continue. Enter the appropriate password, then click Confirm Password . Next, a Two-Factor Authentication Activation pop-up window appears, with a QR code.
Using the desired authenticator application, scan the QR code when prompted.
If scanning the screen is not possible (e.g. the setup is being completed on the same device as
the authenticator application), clicking the provided Cannot scan it? link, or
copying the secret to manually set up the authenticator, is an alternative.
Afterwards, the authenticator should display a verification code .
Enter the code into the Verification Code field, then click Activate .

## Logging in

To confirm 2FA setup is complete, log out of Odoo.
On the login page, input the username and password, then click Log in . On the Two-factor Authentication page, input the code provided by the chosen authenticator in
the Authentication Code field, then click Log in .
If a user loses access to their authenticator, an administrator must deactivate 2FA on the
account before the user can log in.

## Enforce two-factor authentication

To enforce the use of 2FA for all users, first navigate to Main Odoo Dashboard â£
Apps . Remove the Apps filter from the Searchâ¦ bar, then search for 2FA by mail .
`2FAbymail`
Click Install on the Kanban card for the 2FA by mail module.
After installation is complete, go to Settings app: Permissions . Tick the checkbox
labeled, Enforce two-factor authentication . Then, use the radio buttons to choose
whether to apply this setting to Employees only , or All users .
Selecting All users applies the setting to portal users, in addition to employees.
Click Save to commit any unsaved changes.

Requirements
Two-factor authentication setup
Logging in
Enforce two-factor authentication


Access rights

# Access rights

Access rights are permissions that determine the content and applications users can access and
edit. In Odoo, these permissions can be set for individual users or for groups of users. Limiting
permissions to only those who need them ensures that users do not modify or delete anything they
should not have access to.
Only an administrator can change access rights.
Making changes to access rights can have a detrimental impact on the database. This includes impotent admin , which means that no user in the database can make changes to the access rights.
For this reason, Odoo recommends contacting an Odoo Business Analyst, or our Support Team, before
making changes.
A user must have the specific Administration access rights set on their user profile, in
order to make changes on another userâs settings for access rights.
To access this setting, navigate to Settings app â£ Manage users â£ select a
user â£ Access Rights tab â£ Administration section â£ Administration field .
Once at the setting, an already existing administrator must change the setting in the Administration field to Access Rights .
Once complete, click Save to save the changes, and implement the user as an
administrator.

## Users

The access rights for individual users are set when the user is added
to the database, but they can be adjusted at any point in the userâs profile.
To make changes to a userâs rights, click on the desired user to edit their profile.
On the userâs profile page, in the Access Rights tab, scroll down to view the current
permissions.
For each app, use the drop-down menu to select what level of permission this user should have. The
options vary for each section, yet the most common are: Blank/None , User: Own
Documents , User: All Documents , or Administrator .
The Administration field in the Access Rights tab has the following options: Settings or Access Rights .

## Create and modify groups

Groups are app-specific sets of permissions that are used to manage common access rights for a
large amount of users. Administrators can modify the existing groups in Odoo, or create new ones to
define rules for models within an application.
To access groups, first activate Odooâs developer mode , then go to Settings app â£ Users & Companies â£ Groups .
To create a new group from the Groups page, click Create . Then, from the
blank group form, select an Application , and complete the group form (detailed below).
To modify existing groups, click on an existing group from the list displayed on the Groups page, and edit the contents of the form.
Enter a Name for the group and tick the checkbox next to Share Group , if
this group was created to set access rights for sharing data with some users.
Always test the settings being changed to ensure they are being applied to the correct users.
The group form contains multiple tabs for managing all elements of the group. In each tab, click Add a line to add a new row for users or rules, and click the (cancel) icon to remove a row.
- Users tab: lists the current users in the group. Users listed in black have
administrative rights. Users without administrative access appear in blue. Click Add a
line to add users to this group.
Users tab: lists the current users in the group. Users listed in black have
administrative rights. Users without administrative access appear in blue. Click Add a
line to add users to this group.
- Inherited tab: Inherited means that users added to this group are automatically added
to the groups listed on this tab. Click Add a line to add inherited groups. Example For example, if the group Sales/Administrator lists the group Website/Restricted Editor in
its Inherited tab, then any users added to the Sales/Administrator group
automatically receive access to the Website/Restricted Editor group, as well.
Inherited tab: Inherited means that users added to this group are automatically added
to the groups listed on this tab. Click Add a line to add inherited groups.
For example, if the group Sales/Administrator lists the group Website/Restricted Editor in
its Inherited tab, then any users added to the Sales/Administrator group
automatically receive access to the Website/Restricted Editor group, as well.
- Menus tab: defines which models the group can have access to. Click Add a line to add a specific menu.
Menus tab: defines which models the group can have access to. Click Add a line to add a specific menu.
- Views tab: lists which views in Odoo the group has access to. Click Add a
line to add a view to the group.
Views tab: lists which views in Odoo the group has access to. Click Add a
line to add a view to the group.
- Access Rights tab: lists the first level of rights (models) that this group has. The Name column represents the name for the current groupâs access to the model
selected in the Model column. To link a new access right to a group, click Add a line . Select the appropriate model
from the Model drop-down, then enter a name for the access right in the Name column. For each model, enable the following options as appropriate: Read : Users can see the objectâs existing values. Write : Users can edit the objectâs existing values. Create : Users can create new values for the object. Delete : Users can delete values for the object. Tip While there are no conventions for naming access rights, it is advisable to choose a name that
identifies its purpose. For example, the access that purchase managers have to the Contact model could be
named res.partner.purchase.manager . This consists of the technical name of the model,
followed by a name identifying the group of users in question. To find the modelâs technical name from the current view, first enter a placeholder text
in the Name field, then click the Model name, then the (Internal link) icon.
Access Rights tab: lists the first level of rights (models) that this group has. The Name column represents the name for the current groupâs access to the model
selected in the Model column.
To link a new access right to a group, click Add a line . Select the appropriate model
from the Model drop-down, then enter a name for the access right in the Name column. For each model, enable the following options as appropriate:
- Read : Users can see the objectâs existing values.
Read : Users can see the objectâs existing values.
- Write : Users can edit the objectâs existing values.
Write : Users can edit the objectâs existing values.
- Create : Users can create new values for the object.
Create : Users can create new values for the object.
- Delete : Users can delete values for the object.
Delete : Users can delete values for the object.
While there are no conventions for naming access rights, it is advisable to choose a name that
identifies its purpose.
For example, the access that purchase managers have to the Contact model could be
named res.partner.purchase.manager . This consists of the technical name of the model,
followed by a name identifying the group of users in question.
`res.partner.purchase.manager`
To find the modelâs technical name from the current view, first enter a placeholder text
in the Name field, then click the Model name, then the (Internal link) icon.
- Record Rules : lists the second layer of editing and visibility rights. Record Rules overwrite, or refine, the groupâs access rights. Click Add a
line to add a record rule to this group. For each rule, choose values for the following options: Apply for Read . Apply for Write . Apply for Create . Apply for Delete . Important Record rules are written using a domain , or conditions that filter data. A domain expression
is a list of such conditions. For example: [('mrp_production_ids', 'in', user.partner_id.commercial_partner_id.production_ids.ids)] This record rule is to enable MRP consumption warnings for subcontractors. Odoo has a library of preconfigured record rules for ease of use. Users without knowledge of
domains (and domain expressions) should consult an Odoo Business Analyst, or the Odoo Support
Team, before making changes.
Record Rules : lists the second layer of editing and visibility rights. Record Rules overwrite, or refine, the groupâs access rights. Click Add a
line to add a record rule to this group. For each rule, choose values for the following options:
- Apply for Read .
- Apply for Write .
- Apply for Create .
- Apply for Delete .
Record rules are written using a domain , or conditions that filter data. A domain expression
is a list of such conditions. For example:
[('mrp_production_ids', 'in', user.partner_id.commercial_partner_id.production_ids.ids)]
`[('mrp_production_ids','in',user.partner_id.commercial_partner_id.production_ids.ids)]`
This record rule is to enable MRP consumption warnings for subcontractors.
Odoo has a library of preconfigured record rules for ease of use. Users without knowledge of
domains (and domain expressions) should consult an Odoo Business Analyst, or the Odoo Support
Team, before making changes.

## Superuser mode

Superuser mode allows the user to bypass record rules and access rights. To activate Superuser
mode , first, activate developer mode . Then, navigate to the debug menu,
represented by a (debug) icon, located in the top banner.
Finally, towards the bottom of the menu, click Become Superuser .
Only users with Settings access for the Administration section of the Access Rights (in
their user profile) are allowed to log in to Superuser mode .
Superuser mode allows for circumvention of record rules and access rights, and therefore,
should be exercised with extreme caution.
Upon exiting Superuser mode , users may be locked out of the database, due to changes that were
made. This can cause impotent admin , or an administrator without the ability to change access
rights/settings.
In this case contact Odoo Support here: new help ticket . The
support team is able to restore access using a support login.
To leave Superuser mode , log out of the account, by navigating to the upper-right corner, and
clicking on the OdooBot username. Then, select the Log out option.
An alternative way to activate Superuser mode is to login as a superuser. To do that, navigate
to the login screen, and enter the appropriate Email and Password .
Instead of clicking Login , click Log in as superuser .

Users
Create and modify groups
Superuser mode


Microsoft Azure sign-in authentication

# Microsoft Azure sign-in authentication

The Microsoft Azure OAuth sign-in authentication is a useful function that allows Odoo users to sign
in to their database with their Microsoft Azure account.
This is particularly helpful if the organization uses Azure Workspace, and wants employees within
the organization to connect to Odoo using their Microsoft Accounts.
Databases hosted on Odoo.com should not use OAuth login for the owner or administrator of the
database as it would unlink the database from their Odoo.com account. If OAuth is set up for that
user, the database will no longer be able to be duplicated, renamed, or otherwise managed from
the Odoo.com portal.
- Outlook Calendar synchronization
Outlook Calendar synchronization
- Connect Microsoft Outlook 365 to Odoo using Azure OAuth
Connect Microsoft Outlook 365 to Odoo using Azure OAuth

## Configuration

Integrating the Microsoft sign-in function requires configuration on Microsoft and Odoo.

### Odoo System Parameter

First activate the developer mode , and then go to Settings
â£ Technical â£ System Parameters .
Click Create and on the new/blank form that appears, add the following system parameter auth_oauth.authorization_header to the Key field, and set the Value to 1 . Then click Save to finish.
`auth_oauth.authorization_header`
`1`

### Microsoft Azure dashboard

#### Create a new application

Now that the system parameters in Odoo have been set up, itâs time to create a corresponding
application inside of Microsoft Azure. To get started creating the new application, go to Microsoftâs Azure Portal . Log in with the Microsoft
Outlook Office 365 account if there is one, otherwise, log in with a personal Microsoft
account .
A user with administrative access to the Azure Settings must connect and perform the following
configuration steps below.
Next, navigate to the section labeled Manage Microsoft Entra ID (formally Azure Active
Directory ). The location of this link is usually in the center of the page.
Now, click on the Add (+) icon, located in the top menu, and then select App
registration from the drop-down menu. On the Register an application screen, rename the Name field to Odoo Login OAuth or a similarly recognizable title. Under the Supported account types section select the option for Accounts in this
organizational directory only (Default Directory only - Single tenant) .
`OdooLoginOAuth`
The Supported account types can vary by Microsoft account type and end use of the
OAuth. For example: Is the login meant for internal users within one organization or is it meant
for customer portal access? The above configuration is used for internal users in an
organization.
Choose Personal Microsoft accounts only if the target audience is meant for portal
users. Choose Accounts in this organizational directory only (Default Directory only -
Single tenant) if the target audience is company users.
Under the Redirect URL section, select Web as the platform, and then input https://<odoo base url>/auth_oauth/signin in the URL field. The Odoo base URL is the canonical domain at which your Odoo instance can be reached (e.g. mydatabase.odoo.com if you are hosted on Odoo.com) in the URL field. Then, click Register , and the application is created.
`https://<odoobaseurl>/auth_oauth/signin`

#### Authentication

Edit the new appâs authentication by clicking on the Authentication menu item in the
left menu after being redirected to the applicationâs settings from the previous step.
Next, the type of tokens needed for the OAuth authentication will be chosen. These are not
currency tokens but rather authentication tokens that are passed between Microsoft and Odoo.
Therefore, there is no cost for these tokens; they are used merely for authentication purposes
between two APIs . Select the tokens that should be
issued by the authorization endpoint by scrolling down the screen and check the boxes labeled: Access tokens (used for implicit flows) and ID tokens (used for implicit and
hybrid flows) .
Click Save to ensure these settings are saved.

#### Gather credentials

With the application created and authenticated in the Microsoft Azure console, credentials will be
gathered next. To do so, click on the Overview menu item in the left-hand column. Select
and copy the Application (client) ID in the window that appears. Paste this credential
to a clipboard / notepad, as this credential will be used in the Odoo configuration later.
After finishing this step, click on Endpoints on the top menu and click the copy icon next to OAuth 2.0 authorization endpoint (v2) field. Paste this value in the clipboard /
notepad.

### Odoo setup

Finally, the last step in the Microsoft Azure OAuth configuration is to configure some settings in
Odoo. Navigate to Settings â£ Integrations â£ OAuth Authentication and check the
box to activate the OAuth login feature. Click Save to ensure the progress is saved.
Then, sign in to the database once the login screen loads.
Once again, navigate to Settings â£ Integrations â£ OAuth Authentication and
click on OAuth Providers . Now, select New in the upper-left corner and name
the provider Azure .
`Azure`
Paste the Application (client) ID from the previous section into the Client
ID field. After completing this, paste the new OAuth 2.0 authorization endpoint (v2) value into the Authorization URL field.
For the UserInfo URL field, paste the following URL : https://graph.microsoft.com/oidc/userinfo
`https://graph.microsoft.com/oidc/userinfo`
In the Scope field, paste the following value: openid profile email . Next, the Windows
logo can be used as the CSS class on the login screen by entering the following value: fa fa-fw fa-windows , in the CSS class field.
`openidprofileemail`
`fafa-fwfa-windows`
Check the box next to the Allowed field to enable the OAuth provider. Finally, add Microsoft Azure to the Login button label field. This text will appear next to the
Windows logo on the login page.
`MicrosoftAzure`
Save the changes to complete the OAuth authentication setup in Odoo.

### User experience flows

For a user to log in to Odoo using Microsoft Azure, the user must be on the Odoo
password reset page . This is the only way that Odoo is able to link the Microsoft Azure account and
allow the user to log in.
Existing users must reset their password to access the Odoo password reset page . New Odoo users must click the new user invitation link
that was sent via email, then click on Microsoft Azure . Users should not set a new
password.
To sign in to Odoo for the first time using the Microsoft Azure OAuth provider, navigate to the Odoo password reset page (using the new user invitation link). A password reset
page should appear. Then, click on the option labeled Microsoft Azure . The page will
redirect to the Microsoft login page.
Enter the Microsoft Email Address and click Next . Follow the process to sign
in to the account. Should 2FA be turned on, then an extra step
may be required.
Finally, after logging in to the account, the page will redirect to a permissions page where the
user will be prompted to Accept the conditions that the Odoo application will access
their Microsoft information.

Configuration
Odoo System Parameter
Microsoft Azure dashboard
Odoo setup
User experience flows


Facebook sign-in authentication

# Facebook sign-in authentication

The Facebook OAuth sign-in function allows Odoo users to sign in to their database with their
Facebook account.
Databases housed on Odoo.com should not use OAuth login for the owner or administrator of the
database, as it would unlink the database from their Odoo.com account. If OAuth is setup for
that user, the database can no longer be duplicated, renamed, or otherwise managed from the
Odoo.com portal.

## Meta for Developers setup

Go to Meta for Developers and log in. Click My
Apps . On the Apps page, click Create App .
On the Use cases page, select Authenticate and request data from users with
Facebook Login , then click Next .
In the Add an app name field, enter Odoo Login OAuth , or a similar title.
`OdooLoginOAuth`
The App contact email automatically defaults to the email address associated with the
Meta account. If this email address is not regularly monitored, it may be wise to use another
email address.
Click Next . Review the Publishing requirements , the Meta
Platform Terms , and Developer Policies . Then, click Create app .
Clicking Create app may require password re-entry.

### Customize app

After the new app is created, the Dashboard page appears, with a list of steps to be
completed before the app can be published. From here, click Customize adding a Facebook
Login button .
On the Customize page, click Settings .
In the Valid OAuth Redirect URIs field, enter https://<odoo base url>/auth_oauth/signin , replacing <odoo base url> with the URL of the applicable database.
`https://<odoobaseurl>/auth_oauth/signin`
`<odoobaseurl>`
If a database has the URL https://example.odoo.com , the URL https://example.odoo.com/auth_oauth/signin would be entered in the Valid OAuth
Redirect URIs field.
`https://example.odoo.com`
`https://example.odoo.com/auth_oauth/signin`
Click Save changes when finished.

### Configure settings

At the far left of the page, click App settings â£ Basic . This page contains
additional settings that are required before the app can be submitted for approval.
In the Privacy Policy URL field, enter https://www.odoo.com/privacy .
`https://www.odoo.com/privacy`
https://www.odoo.com/privacy is the default privacy policy for databases hosted on Odoo.com.
Click the App Icon field to open a file upload window. From here, select and upload an
app icon.
In the User data deletion field, enter https://www.odoo.com/documentation/17.0/administration/odoo_accounts.html .
`https://www.odoo.com/documentation/17.0/administration/odoo_accounts.html`
This document provides instructions on how a user can delete their Odoo account.
Lastly, click the Category field, and select Business and pages from the
drop-down menu.

### Capture app ID

After the app is created, and approved, select and copy the App ID . Paste this
information on a clipboard or notepad file, as it is needed in a later step to complete the setup.

### Publish

On the left side of the page, click Publish . Depending on the status of the connected
Facebook account, additional verification and testing steps may be required, and are listed on this
page.
After reviewing the information, click Publish .
Additional information regarding Meta App Development, including further details on building,
testing, and use cases, can be found in the Meta for developers documentation .

## Odoo setup

First, activate Developer mode .
Navigate to the Settings app , and scroll down to the Integrations section. There, tick the checkbox labeled, OAuth Authentication . Click Save .
Then, sign in to the database once the login screen loads.
After successfully logging in, navigate to Settings app â£ Users & Companies â£
OAuth Providers . Click Facebook Graph .
In the Client ID field, enter the App ID from the previous
section, then tick the Allowed checkbox.

Meta for Developers setup
Customize app
Configure settings
Capture app ID
Publish
Odoo setup


Google Sign-In Authentication

# Google Sign-In Authentication

The Google Sign-In Authentication is a useful function that allows Odoo users to sign in to their
database with their Google account.
This is particularly helpful if the organization uses Google Workspace, and wants employees within
the organization to connect to Odoo using their Google Accounts.
Databases hosted on Odoo.com should not use Oauth login for the owner or administrator of the
database as it would unlink the database from their Odoo.com account. If Oauth is set up for that
user, the database will no longer be able to be duplicated, renamed or otherwise managed from
the Odoo.com portal.
- Google Calendar synchronization
Google Calendar synchronization
- Connect Gmail to Odoo using Google OAuth
Connect Gmail to Odoo using Google OAuth

## Configuration

The integration of the Google sign-in function requires configuration both on Google and Odoo.

### Google API Dashboard

- Go to the Google API Dashboard .
Go to the Google API Dashboard .
- Make sure the right project is opened. If there isnât a project yet, click on Create
Project , fill out the project name and other details of the company, and click on Create . Tip Choose the name of the company from the drop-down menu.
Make sure the right project is opened. If there isnât a project yet, click on Create
Project , fill out the project name and other details of the company, and click on Create .
Choose the name of the company from the drop-down menu.

#### OAuth consent screen

- On the left side menu, click on OAuth consent screen .
On the left side menu, click on OAuth consent screen .
- Choose one of the options ( Internal / External ), and click on Create . Warning Personal Gmail Accounts are only allowed to be External User Type, which means Google
may require an approval, or for Scopes to be added on. However, using a Google WorkSpace account allows for Internal User Type to be used. Note, as well, that while the API connection is in the External testing mode, then no
approval is necessary from Google. User limits in this testing mode is set to 100 users.
Choose one of the options ( Internal / External ), and click on Create .
Personal Gmail Accounts are only allowed to be External User Type, which means Google
may require an approval, or for Scopes to be added on. However, using a Google WorkSpace account allows for Internal User Type to be used.
Note, as well, that while the API connection is in the External testing mode, then no
approval is necessary from Google. User limits in this testing mode is set to 100 users.
- Fill out the required details and domain info, then click on Save and Continue .
Fill out the required details and domain info, then click on Save and Continue .
- On the Scopes page, leave all fields as is, and click on Save and
Continue .
On the Scopes page, leave all fields as is, and click on Save and
Continue .
- Next, if continuing in testing mode ( External ), add the email addresses being configured under
the Test users step by clicking on Add Users , and then the Save and Continue button. A summary of the app registration appears.
Next, if continuing in testing mode ( External ), add the email addresses being configured under
the Test users step by clicking on Add Users , and then the Save and Continue button. A summary of the app registration appears.
- Finally, scroll to the bottom, and click on Back to Dashboard .
Finally, scroll to the bottom, and click on Back to Dashboard .

#### Credentials

- On the left side menu, click on Credentials .
On the left side menu, click on Credentials .
- Click on Create Credentials , and select OAuth client ID .
Click on Create Credentials , and select OAuth client ID .
- Select Web Application as the Application Type . Now, configure the
allowed pages on which Odoo will be redirected. In order to achieve this, in the Authorized redirect URIs field, enter the databaseâs
domain immediately followed by /auth_oauth/signin . For example: https://mydomain.odoo.com/auth_oauth/signin , then click on Create .
Select Web Application as the Application Type . Now, configure the
allowed pages on which Odoo will be redirected.
In order to achieve this, in the Authorized redirect URIs field, enter the databaseâs
domain immediately followed by /auth_oauth/signin . For example: https://mydomain.odoo.com/auth_oauth/signin , then click on Create .
`/auth_oauth/signin`
`https://mydomain.odoo.com/auth_oauth/signin`
- Now that the OAuth client has been created, a screen will appear with the Client ID and Client Secret . Copy the Client ID for later, as it will be necessary
for the configuration in Odoo, which will be covered in the following steps.
Now that the OAuth client has been created, a screen will appear with the Client ID and Client Secret . Copy the Client ID for later, as it will be necessary
for the configuration in Odoo, which will be covered in the following steps.

### Google Authentication on Odoo

#### Retrieve the Client ID

Once the previous steps are complete, two keys are generated on the Google API Dashboard: Client ID and Client Secret . Copy the Client ID .

#### Odoo activation

- Go to Odoo General Settings â£ Integrations and activate OAuth
Authentication . Note Odoo may prompt the user to log-in again after this step.
Go to Odoo General Settings â£ Integrations and activate OAuth
Authentication .
Odoo may prompt the user to log-in again after this step.
- Go back to General Settings â£ Integrations â£ OAuth Authentication , activate
the selection and Save . Next, return to General Settings â£
Integrations â£ Google Authentication and activate the selection. Then fill out the Client ID with the key from the Google API Dashboard, and Save . Note Google OAuth2 configuration can also be accessed by clicking on OAuth Providers under the OAuth Authentication heading in Integrations .
Go back to General Settings â£ Integrations â£ OAuth Authentication , activate
the selection and Save . Next, return to General Settings â£
Integrations â£ Google Authentication and activate the selection. Then fill out the Client ID with the key from the Google API Dashboard, and Save .
Google OAuth2 configuration can also be accessed by clicking on OAuth Providers under the OAuth Authentication heading in Integrations .

## Log in to Odoo with Google

To link the Google account to the Odoo profile, click on Log in with Google when first
logging into Odoo.
Existing users must reset their password to access the Reset Password page, while new users can directly click on Log in with
Google , instead of choosing a new password.
- Google Cloud Platform Console Help - Setting up OAuth 2.0
Google Cloud Platform Console Help - Setting up OAuth 2.0

Configuration
Google API Dashboard
Google Authentication on Odoo
Log in to Odoo with Google


Change languages

# Change languages

You select the language of your database upon its creation. However, you can add and install additional languages to allow users
to manage the database in another language or to translate your website.

## Add languages

To download additional languages:
- either click the profile icon in the upper-right corner, select My profile , and
click the ( globe ) icon next to the Language field;
either click the profile icon in the upper-right corner, select My profile , and
click the ( globe ) icon next to the Language field;
- or go to the Settings app, and click Add Languages in the Languages section.
or go to the Settings app, and click Add Languages in the Languages section.
You can then select the languages you want from the dropdown menu and click Add .

## Change languages

To select their preferred language, users can click the profile icon in the upper-right corner, go
to My profile , and select a Language in the dropdown list.

### Change another userâs language

To change the database language for a user:
- Go to the Settings app and click Manage Users in the Users section.
Go to the Settings app and click Manage Users in the Users section.
- Click on the user whose language you want to change.
Click on the user whose language you want to change.
- Go to the Preferences tab and select a previously installed language from the Language dropdown menu.
Go to the Preferences tab and select a previously installed language from the Language dropdown menu.
Emails and documents will be sent to the user in the selected language.

Add languages
Change languages
Change another userâs language


LDAP authentication

# LDAP authentication

To configure LDAP authentication in Odoo:
- Open the Settings app, scroll down to the Integrations section, and enable LDAP Authentication .
Open the Settings app, scroll down to the Integrations section, and enable LDAP Authentication .
- Click Save , then go back to the Integrations section and click LDAP Server .
Click Save , then go back to the Integrations section and click LDAP Server .
- In the Set up your LDAP Server list, click New , then select the required
company in the dropdown list.
In the Set up your LDAP Server list, click New , then select the required
company in the dropdown list.
- In the Server information section, enter the serverâs IP address and port in the LDAP server address and LDAP Server port fields, respectively.
In the Server information section, enter the serverâs IP address and port in the LDAP server address and LDAP Server port fields, respectively.
- Enable Use TLS to request secure TLS/SSL encryption when connecting to the LDAP
server, providing the server has StartTLS enabled.
Enable Use TLS to request secure TLS/SSL encryption when connecting to the LDAP
server, providing the server has StartTLS enabled.
- In the Login information section, enter the ID and password of the account used to
query the server in the LDAP binddn and LDAP password fields,
respectively. If the fields are left empty, the server will perform the query anonymously.
In the Login information section, enter the ID and password of the account used to
query the server in the LDAP binddn and LDAP password fields,
respectively. If the fields are left empty, the server will perform the query anonymously.
- In the Process parameter section, enter: the LDAP serverâs name in the LDAP base field using LDAP format
(e.g., dc=example,dc=com ); uid=%s in the LDAP filter field.
In the Process parameter section, enter:
- the LDAP serverâs name in the LDAP base field using LDAP format
(e.g., dc=example,dc=com );
the LDAP serverâs name in the LDAP base field using LDAP format
(e.g., dc=example,dc=com );
`dc=example,dc=com`
- uid=%s in the LDAP filter field.
uid=%s in the LDAP filter field.
`uid=%s`
- In the User information section: Enable Create user to create a user profile in Odoo the first time someone logs in
using LDAP; Select the User template to be used to create the new user profiles. If no template
is selected, the administratorâs profile is used.
In the User information section:
- Enable Create user to create a user profile in Odoo the first time someone logs in
using LDAP;
Enable Create user to create a user profile in Odoo the first time someone logs in
using LDAP;
- Select the User template to be used to create the new user profiles. If no template
is selected, the administratorâs profile is used.
Select the User template to be used to create the new user profiles. If no template
is selected, the administratorâs profile is used.
When using Microsoft Active Directory (AD) for LDAP authentication, if users experience login
issues despite using valid credentials, create a new system parameter to disable referral chasing
in the LDAP client:
- Activate the developer mode.
Activate the developer mode.
- Go to Settings â£ Technical â£ System Parameters and click New .
Go to Settings â£ Technical â£ System Parameters and click New .
- Fill in the fields: Key : auth_ldap.disable_chase_ref Value : True
- Key : auth_ldap.disable_chase_ref
Key : auth_ldap.disable_chase_ref
`auth_ldap.disable_chase_ref`
- Value : True
`True`


Portal access

# Portal access

Portal access is given to users who need the ability to view certain documents or information within
an Odoo database.
Some common use cases for providing portal access include allowing customers to read/view any or all
of the following in Odoo:
- leads/opportunities
- quotations/sales orders
quotations/sales orders
- purchase orders
- invoices & bills
- projects
- timesheets
- tickets
- signatures
- subscriptions
Portal users only have read/view access, and will not be able to edit any documents in the
database.

## Provide portal access to customers

From the main Odoo dashboard, select the Contacts application. If the contact is not yet
created in the database, click on the Create button, enter the details of the contact,
and then click Save . Otherwise, choose an existing contact, and then click on the Action drop-down menu located at the top-center of the interface.
Then select Grant portal access . A pop-up window appears, listing three fields:
- Contact : the recorded name of the contact in the Odoo database
Contact : the recorded name of the contact in the Odoo database
- Email : the contactâs email address that they will use to log into the portal
Email : the contactâs email address that they will use to log into the portal
- In Portal : whether or not the user has portal access
In Portal : whether or not the user has portal access
To grant portal access, first enter the contactâs Email they will use to log into the
portal. Then, check the box under the In Portal column. Optionally, add text to the
invitation message the contact will receive. Then click Apply to finish.
An email will be sent to the specified email address, indicating that the contact is now a portal
user for that Odoo database.
To grant portal access to multiple users at once, navigate to a company contact, then click Action â£ Grant portal access to view a list of all of the companyâs related
contacts. Check the box under the In Portal column for all the contacts that need
portal access, then click Apply .
At any time, portal access can be revoked by navigating to the contact, clicking Action â£ Grant portal access , and then unselecting the checkbox under the In Portal column and clicking Apply .

## Change portal username

There may be times when a portal user wants to change their user login. This can be done by any user
in the database with administrator access rights. The following process outlines the necessary steps
to change the portal user login.
See the documentation on setting access rights .
First, navigate to Settings app â£ Users . Then, under Filters , select Portal Users , or select Add Custom Filter and set the following
configuration Groups > contains > portal . After making this selection,
search for (and open) the portal user that needs to be edited.
`portal`
Next, click Edit (if necessary), click into the Email Address field, and
proceed to make any necessary changes to this field. The Email Address field is used to
log into the Odoo portal.
Changing the Email Address (or login) only changes the username on the customerâs
portal login.
In order to change the contact email, this change needs to take place on the contact template in
the Contacts app. Alternatively, the customer can change their email directly from the portal,
but the login cannot be changed. See change customer info .

## Customer portal changes

There may be times when the customer would like to make changes to their contact information,
password/security, or payment information attached to the portal account. This can be performed by
the customer from their portal. The following process is how a customer can change their contact
information.

### Change customer info

First enter the username and password (login) into the database login page to access the portal user
account. A portal dashboard will appear upon successfully logging in. Portal documents from the
various installed Odoo applications will appear with the number count of each.
Portal access documentation .
Next, navigate to the upper-right corner of the portal, and click the Edit button, next
to the Details section. Then, change the pertinent information, and click Confirm .

### Change password

First enter the username and password (login) into the database login page to access the portal user
account. A portal dashboard will appear upon successfully logging in.
If the customer would like to change their password for portal access, click on the Edit
Security Settings link, below the Account Security section. Then, make the necessary
changes, by typing in the current Password , New Password , and verify the new
password. Lastly, click on Change Password to complete the password change.
If a customer would like to change the login, as documented above, contact the Odoo database
point-of-contact. See above documentation on changing the portal username .
Passwords for portal users and Odoo.com users remain separate, even if the same email address is
used.

### Add two-factor authentication

First enter the username and password (login) into the database login page to access the portal user
account. A portal dashboard will appear upon successfully logging in.
If the customer would like to turn on two-factor authentication (2FA) for portal access, click on
the Edit Security Settings link, below the Account Security section.
Click on Enable two-factor authentication to turn on 2FA . Confirm the current portal password in the Password field. Then, click
on Confirm Password . Next, activate 2FA in a 2FA app (Google Authenticator, Authy, etc.), by scanning the QR code or entering a Verification Code .
Finally, click Enable two-factor authentication to complete the setup.

### Change payment info

First enter the username and password (login) into the database login page to access the portal user
account. A portal dashboard will appear upon successfully logging in.
If the customer would like to manage payment options, navigate to the Manage payment
methods in the menu on the right. Then, add the new payment information, and select Add
new card .

Provide portal access to customers
Change portal username
Customer portal changes
Change customer info
Change password
Add two-factor authentication
Change payment info


Employees

# Employees

Odoo Employees centralizes personnel files , employment contracts , and departmental hierarchies in
one system. Properly configuring its settings ensures the dashboard shows each employeeâs real-time
attendance and work locationâdata that drives payroll accuracy, capacity planning, and compliance
reporting.

#### New employees

Set up new employee records.

#### Departments

Create and manage the departments employees are a part of.

#### Contracts

Manage and create employee contracts.

#### Certifications

Certify employees as subject matter experts with certifications.

#### Badges

Grant badges to employees for performance and achievements.

#### Equipment

Manage and track employee equipment.

#### Offboarding

Take care of employee records when collaboration ends.

#### Employee retention report

Gain insight to the retention rate for a company.

## Settings

To view and configure the available settings, navigate to Employees app â£
Configuration â£ Settings .

### Employees

- Presence Display : select how the employeeâs availability status is calculated. Based on attendances : marked available when checked into the Attendances app. Based on user status in system : marked available when the employee logs in to
Odoo .
Presence Display : select how the employeeâs availability status is calculated.
- Based on attendances : marked available when checked into the Attendances app.
Based on attendances : marked available when checked into the Attendances app.
- Based on user status in system : marked available when the employee logs in to
Odoo .
Based on user status in system : marked available when the employee logs in to
Odoo .
- Advanced Presence Control : when enabled, presence status can be calculated from
operational signals rather than check-ins or logins: Based on number of emails sent : an employee is marked present if they send at least
# emails per hour; otherwise, they are marked absent. Enter the minimum number of emails that
must be sent in the Sent Emails field. Based on IP Address : an employee is marked present only when connected from one of
the specified corporate IP addresses. Enter the IP addresses in the IP Addresses field, separating each address with a comma.
Advanced Presence Control : when enabled, presence status can be calculated from
operational signals rather than check-ins or logins:
- Based on number of emails sent : an employee is marked present if they send at least
# emails per hour; otherwise, they are marked absent. Enter the minimum number of emails that
must be sent in the Sent Emails field.
Based on number of emails sent : an employee is marked present if they send at least
# emails per hour; otherwise, they are marked absent. Enter the minimum number of emails that
must be sent in the Sent Emails field.
- Based on IP Address : an employee is marked present only when connected from one of
the specified corporate IP addresses. Enter the IP addresses in the IP Addresses field, separating each address with a comma.
Based on IP Address : an employee is marked present only when connected from one of
the specified corporate IP addresses. Enter the IP addresses in the IP Addresses field, separating each address with a comma.
- Skills Management : enable this option to display the resumÃ© tab on employee profiles. This allows for the display of work experience , skills , and certifications .
Skills Management : enable this option to display the resumÃ© tab on employee profiles. This allows for the display of work experience , skills , and certifications .
- Remote Work : enable this option to allow for a detailed schedule to appear on the
employee form, in the Work Information tab. When enabled, the
specific location can be set for each working day for the employee. The corresponding icon is
displayed in the upper-right corner of the employee card, indicating their location by icon, and
status by color. Example A green (home) icon indicates the employee is working from home
that day. A (building) icon means the employee is scheduled to
work at the office. The color of the icon indicates the employeeâs status, with green indicating present, yellow
indicating absent, and gray indicating it is outside of the employeeâs working hours.
Remote Work : enable this option to allow for a detailed schedule to appear on the
employee form, in the Work Information tab. When enabled, the
specific location can be set for each working day for the employee. The corresponding icon is
displayed in the upper-right corner of the employee card, indicating their location by icon, and
status by color.
A green (home) icon indicates the employee is working from home
that day. A (building) icon means the employee is scheduled to
work at the office.
The color of the icon indicates the employeeâs status, with green indicating present, yellow
indicating absent, and gray indicating it is outside of the employeeâs working hours.

### Work organization

Using the drop-down menu, select the default Company Working Hours . The default options
are Standard 40 hours/week , Appointment Resource Default Calendar , and Standard 32 hours/week (4 work days, Friday free) .
The available working hours listed are the same as the configured working schedules in the Payroll app. Working hours can be created and modified from
both the Payroll and Employees apps.

### Employee update rights

Enable the Employee Editing option to allow employees to edit their own data on their
employee record.

Settings
Employees
Work organization
Employee update rights


Badges

# Badges

In Odoo, employees can earn badges, either automatically through challenges created in the CRM
app , through eLearning courses, or manually, as
managers decide to award them.
Badges are a way to gamify the work day, can be created for any reason, and can be granted to any
user.
Badges can only be awarded to users of the database , and if
the eLearning app is installed.

## View available badges

To view the available badges that are configured by default, navigate to Employees
app â£ Configuration â£ Badges .
All badges appear in a default Kanban view, with the badgeâs Name and image displayed.
Additionally, the number of users awarded the badge for both the current month, and in total,
appears, along with the badge description, and the avatar for each user who received the badge.
Each badge has a Grant button to award the badge from the Badges dashboard.

## Create badges

Badges can be created in the database when the default badges are not sufficient. This can be done
from the Badges dashboard in the Employees app, or from the CRM app.
To add a badge in the Employees app, first navigate to Employees app â£
Configuration â£ Badges , then click the New button in the upper-left corner.
Fill out the badge form as outlined in the CRM documentation .

## View employee badges

To view badges awarded to an employee, open the Employees app, and click on an employee record.
Click on the Received Badges tab to view any awarded badges.
If this tab is not visible, it means there is no Related User in the Settings tab. Once a user is populated in the Related User field, the Badges tab appears.

## Grant badges

To grant a badge to an employee, open the employee record, and click into the Received
Badges tab. Click the Grant a Badge button to load a Reward Employee pop-up
window.
Using the drop-down menu, select the badge being awarded in the What are you thankful
for? field. The default options are Good Job , Problem Solver , and Brilliant .
Additional options appear (e.g., Get Started , Power user , community Hero ) which are associated with challenges. These are automatically granted
through completed challenges. While these can be awarded at any time, it is advised to grant
badges manually that are not associated with a challenge.
Next, enter a brief summary of why the badge is being granted in the field displaying Describe what they did and why it matters (will be public) field. Last, click the Reward Employee button, and the badge is awarded, and is visible in the Badges tab.
Users cannot grant themselves badges. An error message appears if attempted.

View available badges
Create badges
View employee badges
Grant badges