> Resident Key / Discoverable Credential - The browser supports WebAuthn credentials stored on the authenticator. These credentials can be read to identify the user account without the user manually providing them.
Which websites do this?
Which websites do this?
That's in contrast to WebAuthn as a second factor (which is where the authenticator is another factor in addition to a password).
https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/
you basically just have to create a new 'browser flow' and enable this one in the realm you wish to authenticate with. It wasn't really possible to add multiple keys to the user the last time i configured it -- but according to the docs, that seems to be resolved so it probably is worth another look.
If you move the WebAuthN devices above the TOTP, Keycloak will first ask for the WebAuthN key with a button to switch back to another method (TOTP). It's slightly annoying.
It is not open source, but there is a gratis/free as in beer edition that you can download and use commercially (for certain usage: https://fusionauth.io/license-faq#3 ).
You can grab it here: https://fusionauth.io/download
It's usually not a deal breaker, but you should be aware if you're going to evaluate it for work
Disclaimer: I work there.