Users, access rights and signing in

This page helps you when a user cannot sign in to Odoo, gets an access error, or sees something other than what they should. It also shows how to create a user for a new employee, archive the user of someone who leaves, use two-factor authentication and give a customer access to the customer portal.

A user gets an access error or cannot see a menu

What could cause this

• The user lacks rights in the app the data belongs to, for example after a new add-on was installed or when they take on a new task.
• Rights were narrowed in one place and that blocks an action somewhere else. Example: when users lost the right to create contacts, they could no longer log activities on contacts.
• The document belongs to a different company from the one the user is working in.
• A menu is missing: in that case Odoo shows no error but hides the menu, because the user has no right to read the data behind it.

[Screenshot: the Access Error dialog listing the groups allowed to perform the action]

What you can check

1. Read the Access Error dialog. The text is in English and says which kind of data and which action was blocked (read, modify, create or delete). If it lists groups under This operation is allowed for the following groups, the user must be in one of them.
2. Open Settings ‣ Users & Companies ‣ Users, select the user and open the Access Rights tab. Compare their level in that app with the groups in the error dialog, raise the level if they should have the access, and save.
3. If the error names another company, switch to that company in the company selector at the top right and try again.
4. If a menu is missing, check the user's level in the app the menu belongs to. Example: the Accounting ‣ Claims menu is only shown to users with at least the Invoicing level on the Accounting line of the Access Rights tab.

When to contact Exigo

Contact Exigo if you cannot find which right is missing, if the user has the right level but still gets an error, or if the error first appeared after an upgrade or a new add-on. Include:

• a screenshot of the whole error dialog, including the text at the bottom;
• the user's name and what they were doing;
• when the error appeared;
• the number or name of the document they were opening.

A user sees too much or can do too much

What could cause this

• The user has the Administrator role, which gives access to Settings and lets them change other users' rights.
• The user has a higher level than they need in some app, for example Administrator in Sales.
• New users automatically get the rights set in Default Access Rights. If those are broad, every new user gets broad access.
• The Access Rights tab controls access by app and level. Restrictions by shop, department or individual fields and buttons are not options there.

[Screenshot: the Access Rights tab of a user with the Role and a level for each app]

What you can check

1. Open the user in Settings ‣ Users & Companies ‣ Users and go to the Access Rights tab.
2. Under Role, choose User unless they are meant to manage the system.
3. For each app, choose the lowest level that is enough, and no level for apps they should not use. Example: a salesperson who should not see other salespeople's orders gets the User: Own Documents Only level in Sales. Save.
4. To give new users less access from the start, open Settings ‣ General Settings, find the Permissions section and click Default Access Rights.

When to contact Exigo

Contact Exigo when access must be restricted beyond what the Access Rights tab offers, for example so that shop staff only see their own shop's sales, only certain users see the finances, or a button is hidden from most users. Include:

• a list of the roles, for example cashier, shop manager and bookkeeper;
• for each role: what it should see and what it should be able to do;
• which users belong to each role.

A user cannot sign in or has forgotten the password

What could cause this

• The user has forgotten the password, or it has been changed.
• The link in the email has expired or has already been used. Links to set or reset a password are valid for a limited time and stop working as soon as the user signs in.
• The user is using an old bookmark or the wrong web address.
• The problem is in one user's browser, for example a white screen after signing in.
• The Odoo app on an Android phone does not work.
• The user has been archived.

What you can check

1. On the sign-in page, the user clicks Reset Password, enters their email address and receives an email with a link to choose a new password.
2. If that link is not shown on the sign-in page, open Settings ‣ General Settings and turn on Password Reset in the Permissions section.
3. An administrator can also send the link: open the user in Settings ‣ Users & Companies ‣ Users, open the Security tab and click Send Password Reset. If the user has never signed in, the Send an Invitation Email button at the top of the user is shown instead.
4. If the user gets the error Invalid signup token when opening the link, the link has expired or already been used. Send them a new one.
5. Check whether the user is archived with the Inactive Users filter in the user list. An archived user can neither sign in nor receive a link.
6. Make sure the user opens the right web address. If they use a bookmark from an older system, have them get the right address from your company's administrator.
7. If only one user has the problem, try a private window or another browser, or clear the browser cookies for Odoo.
8. If the Odoo app on an Android phone does not work, clear the app's cache. You can also open Odoo in the phone's browser and choose Install App in the user menu at the top right, when the browser offers it.

When to contact Exigo

Contact Exigo if nobody in the company can sign in as an administrator, if the email with the link does not arrive although the address is right, or if an error appears when a new password is requested. Include:

• the user's email address or username;
• when they tried to sign in;
• the exact error text and a screenshot;
• which device, browser or app they use.

A new employee cannot get access

What could cause this

• No user has been created for them. A record in the Employees app is not a user and does not allow signing in.
• The invitation email did not arrive, or the link in it has expired.
• The user has no rights in the app they are meant to work in. Example: they do not appear in the Salesperson field on a sales order unless they have rights in Sales.

What you can check

1. Open Settings ‣ Users & Companies ‣ Users and click New.
2. Enter the employee's name, and their email address in the Login field. The email address is their username and the invitation email goes there.
3. On the Access Rights tab, choose the Role and a level in each app they will use.
4. Save. Odoo sends the invitation email to the address automatically.
5. If the invitation email does not arrive or the link has expired, open the user and click Send an Invitation Email at the top of the user. The button is shown until the user signs in for the first time.

When to contact Exigo

Contact Exigo if an error appears when you save a new user, or if the invitation email does not arrive although you have sent it again and the address is right. Include the exact error text, a screenshot and the new user's email address.

An employee has left but can still sign in

What could cause this

• Their user is still active. A user that is not archived can sign in even though the employee has left.
• The employee was archived in the Employees app without ticking Related User. Their user is then not archived.

What you can check

1. Open the user in Settings ‣ Users & Companies ‣ Users.
2. Click Actions (the gear icon), choose Archive and confirm.
3. The user can then no longer sign in, and links they have received to set a password stop working. Documents and history linked to them stay unchanged.
4. If the employee comes back, choose the Inactive Users filter, open the user and choose Unarchive under Actions.

When to contact Exigo

Contact Exigo if an error appears when you archive a user, or if you have questions about the number of users on an invoice from Exigo. Include the user's name and a screenshot of the error.

A customer cannot get access to the customer portal or sees the wrong documents there

What could cause this

• The contact's email address is already used by another user, even if that user is archived. A red icon then appears next to the address (Email Address already taken by another user) and the Grant Access button is not shown.
• Two contacts are registered with the same email address. The access is then linked to one of them and the invoices to the other.
• The invitation email did not reach the customer.
• A contact with access sees all posted invoices and orders of the company they are filed under. If they are filed under the wrong company they see that company's documents, and invoices to a contact outside their company are not shown.

[Screenshot: the Portal Access Management window with the Grant Access and Re-Invite buttons]

What you can check

1. Open the contact in Contacts, click Actions (the gear icon) and choose Grant portal access. If you open a company, all its contacts are listed in the window.
2. In the Portal Access Management window, check the email address and click Grant Access next to the contact. They receive an email with a link to choose a password.
3. If the address is already taken, search for it in the user list, also with the Inactive Users filter. If it belongs to an older or duplicate contact, merge the contacts; otherwise use a different email address.
4. If the invitation did not arrive, click Re-Invite next to the contact in the same window.
5. If a customer cannot see an invoice, check that the invoice is posted and addressed to their company or a contact under it, and that the contact with access is filed under the right company in the Company field.
6. To close a contact's access, click Revoke Access in the same window.

When to contact Exigo

Contact Exigo if the access does not activate, if it disappears again, or if a customer sees documents that belong to someone else. Include the contact's name and email address, the number of the document in question and a screenshot.

Two-factor authentication and automatic logout

What could cause this

• A user has changed phones or deleted the authenticator app and cannot get the code.
• The code the user enters is not the latest one the app shows.
• When two-factor authentication is enforced, users without an authenticator app receive a code by email when they sign in. If the email does not arrive, they cannot sign in.
• Automatic logout after inactivity is not on by default. It requires the auth_timeout add-on.

[Screenshot: the Security tab of a user with Send Password Reset and Two-factor Authentication]

What you can check

1. A user turns on two-factor authentication themselves: they open the user menu at the top right, choose My Preferences, open the Security tab and click Enable 2FA. They confirm their password, scan the QR code with an authenticator app on their phone and enter the code the app shows.
2. To enforce two-factor authentication, open Settings ‣ General Settings, tick Enforce two-factor authentication in the Permissions section, choose Employees only or All users and save. All users also covers customers on the customer portal.
3. If a user has lost their phone, open the user in Settings ‣ Users & Companies ‣ Users, open the Security tab and click Disable next to Two-factor Authentication. Odoo asks you to confirm your password. The user then signs in and sets up two-factor authentication again.

When to contact Exigo

Contact Exigo if you want automatic logout after inactivity, if no administrator can sign in to disable two-factor authentication, or if users do not receive codes by email. Include the user's name, when they tried to sign in and a screenshot.