Skip to main content
Two-Factor Authentication & SSO

Two-Factor Authentication & SSO for Odoo errors: when each message appears and what to do

The messages in Two-Factor Authentication & SSO for Odoo fall into five groups: FIDO2 passkeys, OIDC connections, SAML connections, mappings and exemptions, and the authentication event log, which cannot be edited or deleted. Several say in their own text what is missing or what to do, and below you will find each literal message with when it appears and how to act.

FlexigoTech · Editor in charge: Víctor Gómez · Updated 4 November 2026

Key facts

Versions
Odoo 17, 18, 19 and 20
Checked
in the module's source code, version 20.0 · against the sources linked at the end
Reading time
6 min

How to read the module's messages

Several messages carry a {} or %s placeholder where the module inserts a specific value: the connection name, the domain, a URL or the reason for the failure. That value is the first thing to read, because it is what tells one case apart from another.

If you are still configuring the module, the setup guide walks through the settings; here we go message by message.

FIDO2 passkeys: registration and authentication

MessageWhen it appearsWhat to do
Passkeys (FIDO2) need Odoo 18 or later: on this Odoo use "TOTP Only" or "Either".When you ask for passkeys on an Odoo older than 18Choose TOTP Only or Either, as the message says
A user can have at most 5 active FIDO2 credentials (FR-044). Please revoke an existing credential before registering a new one.When registering a new credential with 5 already activeRevoke an existing credential, then register the new one
py_webauthn is not installed. FIDO2 registration is unavailable.When trying to register FIDO2 without py_webauthnRaise the missing py_webauthn with whoever runs your Odoo server
py_webauthn is not installed.Short form of the same warning, at more than one point in the FIDO2 flowSame as the row above
Failed to generate FIDO2 registration options: {}When preparing a credential registrationRead the reason after the colon
FIDO2 registration verification failed: {}When verifying the registrationRead the reason and repeat the registration
Failed to generate FIDO2 authentication options: {}When preparing FIDO2 authenticationRead the reason given with the message
FIDO2 credential not found for this user.The module cannot find the credential for that userCheck the credential belongs to that user
FIDO2 credential was registered for domain "{}" but current domain is "{}". Credential is invalid for this domain (FR-043).The current domain is not the one used at registrationSign in through the domain the message shows
FIDO2 authentication verification failed: {}When verifying the authenticationRead the reason the message adds

On Odoo 17 there are no passkeys: the message itself says they need Odoo 18 or later and points you to TOTP Only or Either.

OIDC connections: discovery document and ID token

MessageWhen it appearsWhat to do
The connection "%s" already has its OIDC settings: edit them instead of adding others.When adding further OIDC settings to a connection that already has themEdit the existing settings
Issuer URL is required to fetch the discovery document.When requesting the discovery document without an Issuer URLEnter the Issuer URL
Failed to fetch OIDC discovery document from {}: {}The document could not be fetched from that URLCheck the URL and the reason shown in the message
JWKS URI is not configured. Fetch the discovery document first.The JWKS URI is missingFetch the discovery document first
ID token validation failed: malformed token ({}).The ID token is malformedRead the detail in brackets
ID token validation failed: algorithm {!r} is not accepted.The token's algorithm is not acceptedCheck the named algorithm with whoever manages the IdP
ID token validation failed: JWKS not readable ({}).The JWKS keys cannot be readRead the detail in brackets
ID token validation failed: invalid signature.The token signature is not validReview it with whoever manages the IdP
ID token validation failed: missing claims.Claims are missing from the tokenReview it with whoever manages the IdP
ID token validation failed: issuer mismatch.The issuer does not matchCompare the issuer on the OIDC connection with the IdP's
ID token validation failed: audience mismatch.The audience does not matchReview the OIDC connection with whoever manages the IdP
ID token validation failed: token expired.The token has expiredStart the sign-in again
ID token nonce mismatch: expected {} but got {}The nonce received is not the one expectedCompare the two values in the message

Every message starting with ID token validation failed appears while validating the token returned by the identity provider. The final part tells you which check failed.

List of IdP connections in Odoo Settings with two records, Google Workspace OIDC and Microsoft Entra ID SAML
The IdP connections list, with protocol, company, active, JIT provisioning and fallback mode columns

SAML connections and IdP metadata

MessageWhen it appearsWhat to do
The connection "%s" already has its SAML settings: edit them instead of adding others.When adding further SAML settings to a connection that already has themEdit the existing settings
Single Logout (SLO) is enabled but no IdP SLO URL is provided. Please enter the IdP SLO URL or disable SLO.SLO switched on with no IdP SLO URLEnter the IdP SLO URL or switch SLO off
xml.etree.ElementTree is not available.The module cannot find xml.etree.ElementTreeRaise it with whoever runs your Odoo server
Failed to parse IdP metadata XML: {}The IdP metadata XML could not be readCheck the XML and the reason the message adds

Mappings, exemptions and the event log

MessageWhen it appearsWhat to do
Attribute mapping cannot belong to both a SAML config and an OIDC config. Please link it to exactly one.The attribute mapping is linked to SAML and OIDC at onceLeave it linked to just one config
Attribute mapping must be linked to either a SAML config or an OIDC config.The attribute mapping is linked to neitherLink it to a SAML or OIDC config
Group mapping cannot belong to both a SAML config and an OIDC config.The group mapping is linked to bothLeave it on just one
Group mapping must be linked to either a SAML config or an OIDC config.The group mapping is linked to neitherLink it to a SAML or OIDC config
Exemption expiry date must be today or in the future. Received: {}The exemption expiry date is in the pastUse today's date or a future one
Editing not allowed: authentication event log records are append-only (tamper-evident audit trail).When trying to edit an authentication event log recordNothing: the module does not allow editing them
Deletion not allowed: authentication event log records are append-only (tamper-evident audit trail).When trying to delete an event log recordNothing: the module does not allow deleting them
List of MFA policies in Odoo Settings with two rows, Admin MFA Enforcement and Regular User MFA
The MFA policies, with company, accepted factor types, grace period and the Active checkbox

The two event log messages do not point to a configuration fault: the text says those records only accept new entries (append-only). If you are trying to correct something, that is not the place.

How FlexigoTech can help

If a message is not clear from its own text, we can go through it with you. FlexigoTech implements Odoo 17, 18, 19 and 20 and builds bespoke connectors and integrations. The module is published on Odoo Apps for 17, 18, 19 and 20, at €9 excluding VAT per Odoo version, as a one-off payment. If you are unsure whether it fits, see what it covers and on which version, and purchase details are on the module page.

Keep reading

How Two-Factor Authentication & SSO for Odoo works inside: a glossary of menus, jobs and modelsMenus, scheduled actions and models of Two-Factor Authentication & SSO for Odoo explained as a glossary, with the exact names you will see in Odoo.Setting up Two-Factor Authentication & SSO for Odoo, question by questionWhich fields to fill in on the OIDC or SAML configuration, how to map claims and groups and what to check in week one with Two-Factor Authentication & SSO for Odoo.Two-Factor Authentication & SSO for Odoo: when it fits and what to have readyWhat Two-Factor Authentication & SSO for Odoo covers and leaves out according to its README, what you need before installing and which Odoo versions.
Checked in the module's source code (version 20.0) and the linked sources

Sources