The next screens offer you a set of options to access your account, depending on how you created it. Choosing the email or phone number options will send you a password reset link either on your phone or email.
At this point I was convinced that, despite its quirks, the message was probably legit. To further support this judgment, I combed through the original message and checked all the links. A scam message that uses deadlines or other scare tactics to make you click a link will almost certainly link to a dangerous page. All the links in this message went straight to facebook.com.
What could the problem be? A video you posted last year of your friends dancing to a hit song? Could that really be it? Well, maybe: The link does lead to a notice about music copyright infringement. The address of the page is facebook.com, and the notification page contains a link to an appeal form. So far, seems plausible.
When users click the email link, Keycloak asks them to update their password, and if they have set up an OTP generator, Keycloak asks them to reconfigure the OTP generator. Depending on security requirements of your organization, you may not want users to reset their OTP generator through email.
If the user selects the Try another way link with WebAuthn passwordless authentication, the user can choose between Password and Security Key (WebAuthn passwordless). When selecting the password, the user will need to continue and log in with the assigned OTP. If the user has no WebAuthn credentials, the user must enter the password and then the OTP. If the user has no OTP credential, they will be asked to record one.
aa06259810