Your Account (Keycloak) — Identity & Passkeys

Your identity on The Nest is managed by Keycloak, an open-source identity and access management platform. Keycloak handles authentication, passkeys, and group-based authorization for all services.

What Keycloak Does

Authentication: Verifies your identity using WebAuthn passkeys (passwordless).
Authorization: Determines which services you can access based on your Keycloak groups.
Single Sign-On (SSO): One login grants access to all connected services (Matrix, Forgejo, Nextcloud, etc.).

Managing Your Account

Viewing Enrolled Passkeys

Visit sso.mynest.love.
Click Account (after signing in).
Under Security Devices, you'll see all enrolled passkeys.

Adding a New Passkey

Go to Security Devices → Add on the Keycloak account page.
Follow the prompts to register a new device (smartphone, security key, etc.).
Give it a recognizable name (e.g., "iPhone 15" or "YubiKey").

Removing a Passkey

You can remove a passkey from Security Devices, but you must have at least one remaining. If you're down to your last passkey, Keycloak will prevent removal and prompt you to add another first.

Group-Based Access

Your access to services is controlled by Keycloak groups. See Requesting Service Access for details on how to request new groups.

Common groups include:

Group	Services Unlocked
`media-users`	Jellyfin, Sonarr, Radarr, Bazarr
`music-users`	DroppedNeedle, slskd
`books-users`	Calibre-Web, Shelfmark, Audiobookshelf
`storage-users`	Nextcloud
`ttrpg-users`	Foundry VTT

Account Recovery

If you lose access to all enrolled passkeys:

Contact an admin via Matrix (@nest:starling.mynest.love).
Verify your identity using your registered email address.
The admin will reset your account, allowing you to re-enroll passkeys.

Matrix — Uses Keycloak for SSO login
Vaultwarden — Can store passkey credentials securely
Forgejo — Uses Keycloak for authentication

TODO: Add screenshot of Keycloak account page showing security devices.

2.3 KiB Raw Blame History