Two-factor authentication and passkeys

Sign-in runs through Keycloak at auth.zerolog.ch, ZeroLog's own sign-in service in Switzerland.

From setting up a factor to the next sign-inYou set up a factor on the Keycloak account page. It shows as Ready in Sign-in and security, where you switch it on, mark it required and pick a preferred login. Passwordless is optional once another factor is on. You confirm your sign-in and save. The rules are stored with your Keycloak account and apply from your next sign-in, which asks for your chosen method plus every required factor.1. Set up a factor on theKeycloak account page(email, authenticator, passkey)2. Factor shows Readyin Sign-in & security3. Per factor: switchEnabled and RequiredPick a preferred loginOptional: Passwordless(needs another factor)4. Confirm your sign-in,then Save rules5. Rules stored withyour Keycloak account6. Next sign-in: the methodyou choose plus everyrequired factorNot set up:cannot be switched on
A factor must be set up before it can be enabled, and saved rules apply from the next sign-in.
Diagram as text
  1. Set up a factor (email, authenticator app or passkey) on your Keycloak account page. A factor that is not set up cannot be switched on.
  2. Back in Settings, Sign-in and security, the factor shows as Ready.
  3. For each factor, switch Enabled and Required as you want, and pick a preferred login. Passwordless is optional once another factor is enabled.
  4. Confirm your sign-in again, then save the rules.
  5. The rules are stored with your Keycloak account.
  6. From your next sign-in, the method you choose plus every required factor is asked for.
Four factors you choose
Password
The classic. Optional once another factor is enabled.
Email
A one-time code or a magic link sent to your verified address. Codes and links are kept in server memory only; ZeroLog sends the mail through SMTP2GO.
Authenticator app
A six-digit TOTP code from any authenticator app.
Passkey
WebAuthn: your device's own unlock (fingerprint, face or PIN).

Set up a factor

Settings → Sign-in & security → Set up factors & email

  1. 01
    The link opens your Keycloak account page.
  2. 02
    Add an email address, an authenticator app or a passkey there.
  3. 03
    Back in ZeroLog, the factor shows as Ready. A factor that is not set up stays greyed out and cannot be switched on. Email counts as ready once the address is verified.

Choose the rules

Settings → Sign-in & security

Each factor has two switches. Enabled means it can be used to sign in. Required means it is asked for at every sign-in.

Pick a preferred login from the enabled factors; it is preselected at sign-in. Every sign-in asks for the method you choose plus all required factors.

To save, ZeroLog first asks you to confirm your sign-in (the button reads Sign in to confirm), then the button reads Save rules. The new rules apply from your next sign-in.

If you already had an authenticator app set up, your starting rules are password plus authenticator code, both required, until you change them.

Passwordless

After you enable another factor, you can turn on Passwordless. The password is then no longer used to sign in.

Passkeys

Nothing typeable is exchanged.

That is what makes a passkey resistant to phishing in a way a code is not.

Register more than one if you can: a laptop and a phone, say.

A passkey lives on the device that made it, and a single passkey plus a lost device is a bad afternoon.