When the device registers to the geo server, it also provides an "alias". The idea is that the developer has to use the same "alias" when registering to the UPS, then it's up to the backend app to retrieve the aliases for the geoserver and use these as criteria when sending a push notif to UPS.

It tried to described that here : https://github.com/sebastienblanc/unified-geo-server#integration-with-push

One idea for the alias, is to use the Keycloak (or whatever auth system) username as alias to have it somehow "unified"