Manage my account
Logging in
Section titled “Logging in”I need:
- A master password for my vault (vaultwarden).
- A unique identity for all cloud services (kanidm / IDM).
My administrator must follow a procedure so I can set up these credentials.
- Master password: an email containing a link to enter the password.
- Identity: a QR code or a link to set a key and a “2FA” password.
The master password is essential, it’s the only one you must absolutely remember.
My login follows this diagram:
My login methods
Section titled “My login methods”My account accepts four ways to log in to cloud services. They coexist: if one becomes unavailable, the others remain valid.
| Method | What I do | When |
|---|---|---|
| Main YubiKey | Enter the key’s PIN code, then touch it | Daily use |
| Backup YubiKey | Same, key stored in a safe place | If the main key is lost |
| Vault access key | Unlock the vault, confirm | When no YubiKey is at hand |
| Password + 2FA code | Enter the password, then the code | Safety net |
Using my YubiKey
Section titled “Using my YubiKey”My YubiKey is a physical key that replaces the password in most situations:
- Encrypted computer: at boot, I touch the YubiKey when the LED blinks → the disk unlocks automatically, no passphrase needed.
- Logging in to my session: I touch the YubiKey on the login screen instead of typing my password.
- Kanidm (SSO): registration is done once, with my administrator. After that, I enter the key’s PIN code and touch it to log in to all cloud services.
Starting my encrypted computer
Section titled “Starting my encrypted computer”If my disk is encrypted, the computer asks to be unlocked at startup, before the login screen. That’s normal: until I unlock it, its contents are unreadable, even in case of theft.
- With my YubiKey: I plug it in before turning on (or as soon as the prompt appears), then I touch it when its LED blinks. The disk unlocks on its own, nothing to type.
- Without the key: I type the passphrase my administrator gave me, then Enter. The characters don’t show while typing; that’s intentional.
- Nothing works? I can make mistakes and retry without risk. If I stay stuck, I contact my administrator: they can unlock my machine remotely, without moving.
Adding a second factor
Section titled “Adding a second factor”A second factor is often added to a password to secure it. These days, a huge number of passwords are compromised, which is why this type of authentication is becoming necessary.
The second factor can be a code sent by email / SMS, a 6-digit code generator, etc.