59 lines
2.3 KiB
Markdown
59 lines
2.3 KiB
Markdown
# Your Account (Keycloak) — Identity & Passkeys
|
|
|
|
Your identity on The Nest is managed by [Keycloak](https://keycloak.org/), an open-source identity and access management platform. Keycloak handles authentication, passkeys, and group-based authorization for all services.
|
|
|
|
## What Keycloak Does
|
|
|
|
- **Authentication:** Verifies your identity using WebAuthn passkeys (passwordless).
|
|
- **Authorization:** Determines which services you can access based on your Keycloak groups.
|
|
- **Single Sign-On (SSO):** One login grants access to all connected services (Matrix, Forgejo, Nextcloud, etc.).
|
|
|
|
## Managing Your Account
|
|
|
|
### Viewing Enrolled Passkeys
|
|
|
|
1. Visit [sso.mynest.love](https://sso.mynest.love).
|
|
2. Click **Account** (after signing in).
|
|
3. Under **Security Devices**, you'll see all enrolled passkeys.
|
|
|
|
### Adding a New Passkey
|
|
|
|
1. Go to **Security Devices → Add** on the Keycloak account page.
|
|
2. Follow the prompts to register a new device (smartphone, security key, etc.).
|
|
3. Give it a recognizable name (e.g., "iPhone 15" or "YubiKey").
|
|
|
|
### Removing a Passkey
|
|
|
|
You can remove a passkey from **Security Devices**, but you must have at least one remaining. If you're down to your last passkey, Keycloak will prevent removal and prompt you to add another first.
|
|
|
|
## Group-Based Access
|
|
|
|
Your access to services is controlled by Keycloak groups. See [Requesting Service Access](../access-requests.md) for details on how to request new groups.
|
|
|
|
Common groups include:
|
|
|
|
| Group | Services Unlocked |
|
|
|-------|-------------------|
|
|
| `media-users` | Jellyfin, Sonarr, Radarr, Bazarr |
|
|
| `music-users` | DroppedNeedle, slskd |
|
|
| `books-users` | Calibre-Web, Shelfmark, Audiobookshelf |
|
|
| `storage-users` | Nextcloud |
|
|
| `ttrpg-users` | Foundry VTT |
|
|
|
|
## Account Recovery
|
|
|
|
If you lose access to all enrolled passkeys:
|
|
|
|
1. Contact an admin via Matrix (`@nest:starling.mynest.love`).
|
|
2. Verify your identity using your registered email address.
|
|
3. The admin will reset your account, allowing you to re-enroll passkeys.
|
|
|
|
## Related Services
|
|
|
|
- [Matrix](../communication-and-security/matrix.md) — Uses Keycloak for SSO login
|
|
- [Vaultwarden](../communication-and-security/vaultwarden.md) — Can store passkey credentials securely
|
|
- [Forgejo](../productivity-and-creation/forgejo.md) — Uses Keycloak for authentication
|
|
|
|
---
|
|
|
|
*TODO: Add screenshot of Keycloak account page showing security devices.*
|