Repository navigation
During an authentication flow, how to detect that a username has no password credential set? #44604
Replies: 1 comment
|
Why are you not able to also migrate the passwords from the old store to Keycloak? If the passwords are stored in a hashed format that is supported by Keycloak, you should be able to import the passwords into Keycloak, and then have Keycloak automatically upgrade the hash to the realm configured hashing algorithm (assuming things work as they did for the upgrade to Keycloak 25 - https://www.keycloak.org/docs/latest/upgrading/index.html#argon2-password-hashing). As a note, the approach you suggest, where the form would automatically display the password reset form if the user has not updated their password may be used by attackers to leak information about existing users / identifying users who have not updated their passwords or logged in recently. The usual approach in this case would be notifying the users (via email) of the change and displaying a warning on the login page mentioning that they may need to update their passwords if they cannot log in. I understand it's not as straight-forward for the users as your approach, however. |
Uh oh!
There was an error while loading. Please reload this page.
We need to migrate some users from on storage provider to Keycloak. In the process, we obviously can't migrate the passwords, which means that the users that we create have no password credential set.
We would like to be able to detect this situation during the authentication flow in order to display, first, a username form and, then, either a "forgot password" form or a password form dependending on the presence of a password credential.
There is a condition named "user attribute" but credentials are not an attribute and thus it can't be used for that matter.
Is there a way to implement such a flow?
All reactions