Skip to content

Commit bb9ba72

Browse files
hbrunnhbrunn
committed
[ADD] auth_totp_bypass_ip_range
1 parent 035093d commit bb9ba72

File tree

27 files changed

+1311
-0
lines changed

27 files changed

+1311
-0
lines changed

‎auth_totp_bypass_ip_range/README.rst‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
===================
2+
IP based MFA bypass
3+
===================
4+
5+
..
6+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
7+
!! This file is generated by oca-gen-addon-readme !!
8+
!! changes will be overwritten. !!
9+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
10+
!! source digest: sha256:293829077d34925720abfd9ded62f8faa4f395c144d03ecd0e5c7d8091d5bf55
11+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
12+
13+
.. |badge1| image:: https://img.shields.io/badge/maturity-Alpha-red.png
14+
:target: https://odoo-community.org/page/development-status
15+
:alt: Alpha
16+
.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
17+
:target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
18+
:alt: License: AGPL-3
19+
.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github
20+
:target: https://github.com/OCA/server-auth/tree/16.0/auth_totp_bypass_ip_range
21+
:alt: OCA/server-auth
22+
.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
23+
:target: https://translation.odoo-community.org/projects/server-auth-16-0/server-auth-16-0-auth_totp_bypass_ip_range
24+
:alt: Translate me on Weblate
25+
.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
26+
:target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=16.0
27+
:alt: Try me on Runboat
28+
29+
|badge1| |badge2| |badge3| |badge4| |badge5|
30+
31+
This module allows to define some IP networks as not needing multi
32+
factor authentication.
33+
34+
.. IMPORTANT::
35+
This is an alpha version, the data model and design can change at any time without warning.
36+
Only for development or testing purpose, do not use in production.
37+
`More details on development status <https://odoo-community.org/page/development-status>`_
38+
39+
**Table of contents**
40+
41+
.. contents::
42+
:local:
43+
44+
Configuration
45+
=============
46+
47+
To configure this module, you need to:
48+
49+
1. Enable debug mode
50+
2. Go to Settings / Technical / System parameters
51+
3. Create or edit parameter ``auth_totp_bypass_ip_range.networks``
52+
53+
The parameter can contain a whitespace separated list of networks in
54+
`CIDR
55+
notation <https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation>`__.
56+
A specific IP address would be ie 42.42.42.42/32
57+
58+
Usage
59+
=====
60+
61+
To use this module, you need to:
62+
63+
1. Enable 2FA for some user
64+
2. Connect from an IP that was configured to bypass 2FA
65+
3. Observe that no 2FA challenge is raised
66+
67+
Known issues / Roadmap
68+
======================
69+
70+
- support IPv6
71+
72+
Bug Tracker
73+
===========
74+
75+
Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-auth/issues>`_.
76+
In case of trouble, please check there if your issue has already been reported.
77+
If you spotted it first, help us to smash it by providing a detailed and welcomed
78+
`feedback <https://github.com/OCA/server-auth/issues/new?body=module:%20auth_totp_bypass_ip_range%0Aversion:%2016.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
79+
80+
Do not contact contributors directly about support or help with technical issues.
81+
82+
Credits
83+
=======
84+
85+
Authors
86+
-------
87+
88+
* Hunki Enterprises BV
89+
90+
Contributors
91+
------------
92+
93+
- Holger Brunn <mail@hunki-enterprises.com>
94+
(https://hunki-enterprises.com)
95+
96+
Maintainers
97+
-----------
98+
99+
This module is maintained by the OCA.
100+
101+
.. image:: https://odoo-community.org/logo.png
102+
:alt: Odoo Community Association
103+
:target: https://odoo-community.org
104+
105+
OCA, or the Odoo Community Association, is a nonprofit organization whose
106+
mission is to support the collaborative development of Odoo features and
107+
promote its widespread use.
108+
109+
.. |maintainer-hbrunn| image:: https://github.com/hbrunn.png?size=40px
110+
:target: https://github.com/hbrunn
111+
:alt: hbrunn
112+
113+
Current `maintainer <https://odoo-community.org/page/maintainer-role>`__:
114+
115+
|maintainer-hbrunn|
116+
117+
This module is part of the `OCA/server-auth <https://github.com/OCA/server-auth/tree/16.0/auth_totp_bypass_ip_range>`_ project on GitHub.
118+
119+
You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

‎auth_totp_bypass_ip_range/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
from . import models

‎auth_totp_bypass_ip_range/__manifest__.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Copyright 2025 Hunki Enterprises BV
2+
# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl-3.0)
3+
4+
{
5+
"name": "IP based MFA bypass",
6+
"summary": "Define IP ranges consideres safe without MFA",
7+
"version": "16.0.1.0.0",
8+
"development_status": "Alpha",
9+
"category": "Extra Tools",
10+
"website": "https://github.com/OCA/server-auth",
11+
"author": "Hunki Enterprises BV, Odoo Community Association (OCA)",
12+
"maintainers": ["hbrunn"],
13+
"license": "AGPL-3",
14+
"depends": ["auth_totp"],
15+
"data": [],
16+
"demo": [],
17+
}

‎auth_totp_bypass_ip_range/models/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
from . import res_users

‎auth_totp_bypass_ip_range/models/res_users.py‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright 2025 Hunki Enterprises BV
2+
# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl-3.0)
3+
4+
import logging
5+
from ipaddress import AddressValueError, IPv4Address, IPv4Network
6+
7+
from odoo import models
8+
from odoo.http import request
9+
10+
_logger = logging.getLogger("auth_totp_bypass_ip_range")
11+
12+
13+
class ResUsers(models.Model):
14+
_inherit = "res.users"
15+
16+
def _auth_totp_bypass_ip_range(self):
17+
"""
18+
Determine if the current request comes from an IP that bypasses MFA
19+
"""
20+
networks = (
21+
self.env["ir.config_parameter"]
22+
.sudo()
23+
.get_param("auth_totp_bypass_ip_range.networks", "")
24+
.split()
25+
)
26+
ip = IPv4Address(request.httprequest.environ["REMOTE_ADDR"])
27+
for network in networks:
28+
try:
29+
parsed_network = IPv4Network(network, strict=False)
30+
except AddressValueError:
31+
_logger.error("%s is not a valid network", network)
32+
continue
33+
if ip in parsed_network:
34+
return True
35+
return False
36+
37+
def _mfa_type(self):
38+
"""
39+
Don't do MFA if the request comes from an IP that is configured to bypass it
40+
"""
41+
if self._auth_totp_bypass_ip_range():
42+
return None
43+
return super()._mfa_type()
44+
45+
def _mfa_url(self):
46+
"""
47+
Don't do MFA if the request comes from an IP that is configured to bypass it
48+
"""
49+
if self._auth_totp_bypass_ip_range():
50+
return None
51+
return super()._mfa_url()

‎auth_totp_bypass_ip_range/readme/CONFIGURE.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
To configure this module, you need to:
2+
3+
1. Enable debug mode
4+
2. Go to Settings / Technical / System parameters
5+
3. Create or edit parameter ``auth_totp_bypass_ip_range.networks``
6+
7+
The parameter can contain a whitespace separated list of networks in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation). A specific IP address would be ie 42.42.42.42/32

‎auth_totp_bypass_ip_range/readme/CONTRIBUTORS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- Holger Brunn \<mail@hunki-enterprises.com> (https://hunki-enterprises.com)

‎auth_totp_bypass_ip_range/readme/DESCRIPTION.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This module allows to define some IP networks as not needing multi factor authentication.

‎auth_totp_bypass_ip_range/readme/ROADMAP.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- support IPv6

‎auth_totp_bypass_ip_range/readme/USAGE.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
To use this module, you need to:
2+
3+
1. Enable 2FA for some user
4+
2. Connect from an IP that was configured to bypass 2FA
5+
3. Observe that no 2FA challenge is raised

0 commit comments

Comments
 (0)