Replies: 2 comments 1 reply
-
|
Hi! I'm currently dealing with the same issue as you are. Resources:
It seems that the data you need to send to the create_user endpoint should be in the following format, where {
"email": email,
"username": email,
"enabled": True,
"emailVerified": True,
"credentials": [
{
"type": "password",
"credentialData": json.dumps({"hashIterations": 12, "algorithm": "bcrypt"}),
"secretData": json.dumps({"value": value, "salt": b64_salt}),
}
],
}If anyone has some tips on how to continue, this would be very welcome. If I ever manage to do it, I will provide an update. |
Beta Was this translation helpful? Give feedback.
-
|
Update: Used the curl command below (ran from inside a docker container, after which I restarted the container).
After having done that, I could insert existing users in the db by using the following as input for the user_create endpoint: {
"email": email,
"username": email,
"enabled": True,
"emailVerified": True,
"credentials": [
{
"type": "password",
"hashIterations": "12",
"hashedSaltedValue": pw_hashed,
"algorithm": "bcrypt",
}
]
} |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your answer. Maybe I was not precise enough. We have already a working proof of concept here https://github.com/hpi-schul-cloud/erwin-idm/tree/feature/EW-133-bcrypt-spike, which already uses Keycloak BCrypt Plugin and Keycloak Admin CLI to access Keycloak. Our main concern is how we migrate the password hashes, because we want to avoid having dependencies to third party plugins/libraries in the long run, that might need maintenance from us. During the work on the proof we found out that Keycloak 17 + 18 (tested from us) will automatically update hashes to the default password hashing algorithm set in the password policy during a new user login. This behavior is not documented (or I didn't found it) and would greatly aid our migration process. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello,
we are currently in the process of migrating our custom user store including credentials to Keycloak. Our user store uses BCrypt for password hashing and we want use Keycloak's default hashing algorithm. We observed that Keycloak will update old password hashes using the hashing algorithm set in the password policy. This allows a soft transition between BCrypt and Keycloak which is really handy for us. I couldn't find any documentation about this behavior and would like to ask, if this behavior is intended and can be used for a soft migration.
Kind regards,
Patrick
Beta Was this translation helpful? Give feedback.
All reactions