k3s/documentation/user-facing/communication-and-security/keycloak-account.md
2026-07-23 18:24:39 -04:00

59 lines
2.3 KiB
Markdown

# Your Account (Keycloak) — Identity & Passkeys
Your identity on The Nest is managed by [Keycloak](https://keycloak.org/), an open-source identity and access management platform. Keycloak handles authentication, passkeys, and group-based authorization for all services.
## What Keycloak Does
- **Authentication:** Verifies your identity using WebAuthn passkeys (passwordless).
- **Authorization:** Determines which services you can access based on your Keycloak groups.
- **Single Sign-On (SSO):** One login grants access to all connected services (Matrix, Forgejo, Nextcloud, etc.).
## Managing Your Account
### Viewing Enrolled Passkeys
1. Visit [sso.mynest.love](https://sso.mynest.love).
2. Click **Account** (after signing in).
3. Under **Security Devices**, you'll see all enrolled passkeys.
### Adding a New Passkey
1. Go to **Security Devices → Add** on the Keycloak account page.
2. Follow the prompts to register a new device (smartphone, security key, etc.).
3. Give it a recognizable name (e.g., "iPhone 15" or "YubiKey").
### Removing a Passkey
You can remove a passkey from **Security Devices**, but you must have at least one remaining. If you're down to your last passkey, Keycloak will prevent removal and prompt you to add another first.
## Group-Based Access
Your access to services is controlled by Keycloak groups. See [Requesting Service Access](../access-requests.md) for details on how to request new groups.
Common groups include:
| Group | Services Unlocked |
|-------|-------------------|
| `media-users` | Jellyfin, Sonarr, Radarr, Bazarr |
| `music-users` | DroppedNeedle, slskd |
| `books-users` | Calibre-Web, Shelfmark, Audiobookshelf |
| `storage-users` | Nextcloud |
| `ttrpg-users` | Foundry VTT |
## Account Recovery
If you lose access to all enrolled passkeys:
1. Contact an admin via Matrix (`@nest:starling.mynest.love`).
2. Verify your identity using your registered email address.
3. The admin will reset your account, allowing you to re-enroll passkeys.
## Related Services
- [Matrix](../communication-and-security/matrix.md) — Uses Keycloak for SSO login
- [Vaultwarden](../communication-and-security/vaultwarden.md) — Can store passkey credentials securely
- [Forgejo](../productivity-and-creation/forgejo.md) — Uses Keycloak for authentication
---
*TODO: Add screenshot of Keycloak account page showing security devices.*