Repository navigation
|
I spent some time studying the problem. The search did not yield any successful solutions for me. In a general sense, I don't even know how to describe the problem. Initially, my task was to import users with the pbkdf2_sha256 password hash, and everything was working fine. I haven't changed the import script, the realm settings, or the database parameters, yet this scheme has stopped working. After the import, I get a LOGIN_ERROR and an invalid_credential_error, despite the fact that the password is guaranteed to be correct. (This is also confirmed by rehashing the password with the parameters). There are no errors during the import, and no errors during login except for the LOGIN_ERROR. The correct credentials are in the database. TRACE shows that precisely these colored data are being used. Tested on 26.3 and 26.4. With both a full and an empty database. If anyone has information, ideas, solutions, or suggestions, I would be happy to hear them. Since the list of my attempts is quite large, I will describe the general options below:
|
Replies: 2 comments
|
Was there a Keycloak upgrade in the meantime? In Keycloak 25 the password hashing algorithm was changed to Argon2 (see https://www.keycloak.org/docs/latest/upgrading/index.html#argon2-password-hashing), and perhaps that's why it stopped working for you. Although, the system should still accept other formats, including pbkdf-sha256 (https://www.keycloak.org/docs/latest/server_admin/index.html#password-policy-types), so perhaps there was a different change (e.g., if FIPS mode was enabled on the system, perhaps SHA256 is no longer accepted, or the number of iterations is too low / too big). |
|
Thank you for the suggested solution. When importing, I was specifying pbkdf2_sha256, but the Keycloak API requires it to be specified in the format pbkdf2-sha256. The problem is solved. |
Was there a Keycloak upgrade in the meantime? In Keycloak 25 the password hashing algorithm was changed to Argon2 (see https://www.keycloak.org/docs/latest/upgrading/index.html#argon2-password-hashing), and perhaps that's why it stopped working for you.
Although, the system should still accept other formats, including pbkdf-sha256 (https://www.keycloak.org/docs/latest/server_admin/index.html#password-policy-types), so perhaps there was a different change (e.g., if FIPS mode was enabled on the system, perhaps SHA256 is no longer accepted, or the number of iterations is too low / too big).