Chapter 17. Account Console

Red Hat Single Sign-On users can manage their accounts through the Account Console. Users can manage their profiles, add two-factor authentication, include identity provider acounts, and manage device activity.

Additional resources

  • The Account Console is completely themeable and internationalizable as is the case with all Red Hat Single Sign-On user interfaces. For example, you can add attributes to the Personal Info page. For more details, see the Server Developer Guide.

17.1. Accessing the Account Console

Any user can access the Account Console.

Procedure

  1. Make note of the realm name and IP address for the Red Hat Single Sign-On server where your account exists.
  2. In a web browser, enter a URL in this format: <server-root>/auth/realms/{realm-name}/account.
  3. Enter your login name and password.

Account Console

Account Console

17.2. Configuring ways to sign in

You can sign in to this console using basic authentication (a login name and password) or two-factor authentication. For two-factor authentication, use one of the following procedures.

17.2.1. Two-factor authentication with OTP

Prerequisites

  • OTP is a valid authentication mechanism for your realm.

Procedure

  1. Click Account Security in the menu.
  2. Click Signing In.
  3. Click Set Up Authenticator Application.

    Signing In

    Signing In

  4. Follow the directions that appear on the screen to use either FreeOTP or Google Authenticator on your mobile device as your OTP generator.
  5. Scan the QR code in the screen shot into the OTP generator on your mobile device.
  6. Log out and log in again.
  7. Respond to the prompt by entering an OTP that is provided on your mobile device.

17.2.2. Two-factor authentication with WebAuthn

Prerequisites

  • WebAuthn is a valid two-factor authentication mechanism for your realm. Please follow the WebAuthn section for more details.

Procedure

  1. Click Account Security in the menu.
  2. Click Signing In.
  3. Click Set up Security Key.

    Signing In

    Signing In With Security Key

  4. Prepare your WebAuthn Security Key. How you prepare this key depends on the type of WebAuthn security key you use. For example, for a USB based Yubikey, you may need to put your key into the USB port on your laptop.
  5. Click Register to register your security key.
  6. Log out and log in again.
  7. Assuming authentication flow was correctly set, a message appears asking you to authenticate with your Security Key as second factor.

17.2.3. Passwordless authentication with WebAuthn

Prerequisites

Procedure

  1. Click Account Security in the menu.
  2. Click Signing In.
  3. Click Set up Security Key in the Passwordless section.

    Signing In

    Signing In With Security Key

  4. Prepare your WebAuthn Security Key. How you prepare this key depends on the type of WebAuthn security key you use. For example, for a USB based Yubikey, you may need to put your key into the USB port on your laptop.
  5. Click Register to register your security key.
  6. Log out and log in again.
  7. Assuming authentication flow was correctly set, a message appears asking you to authenticate with your Security Key as second factor. You no longer need to provide your password to log in.

17.3. Viewing device activity

You can view the devices that are logged in to your account.

Procedure

  1. Click Account Security in the menu.
  2. Click Device Activity.
  3. Log out a device if it looks suspicious.

Devices

Devices

17.4. Adding an identity provider acccount

You can link your account with an identity broker. This option is often used to link social provider accounts.

Procedure

  1. Log into the Admin Console.
  2. Click Identity Providers in the menu.
  3. Click Add provider.
  4. Select a provider and complete the fields.
  5. Return to the Account Console.
  6. Click Account Security in the menu.
  7. Click Linked Accounts.

The identity provider you added appears in this page.

Linked Accounts

Linked Accounts

17.5. Accessing other applications

The Applications menu item shows users which applications you can access. In this case, only the Account Console is available.

Applications

Applications