Search code examples
migrationsingle-sign-onkeycloak

Keycloak migrating hashed passwords

I'm trying to migrate users from an old Drupal 6 CMS to Keycloak. I'd like to migrate the users with their old passwords and then assigning an "Update Password" required action to their profile.

However migrating the passwords seems problematic as I can only access them in their hashed form.

The passwords are hashed with an MD5 algorithm using no salt. I've tried migrating them according to this page: https://lists.jboss.org/pipermail/keycloak-user/2015-December/004212.html

Here's the JSON I'm sending to the Keycloak REST API:

{
  "hashedSaltedValue" : "password-hash",
  "algorithm" : "restcomm-md5",
  "type" : "password",
}

Here's a list of things I've tried

  • Included a NULL hash value
  • Included a 0 hashIteration value
  • Base64 encoded the hash
  • Converted the hash to binary and then Base64 encoding it

Has anyone ever had any luck getting this feature working?

Solution

  • The following curl command worked for me to migrate a old hashed password. Replace {hashedSaltedValue} with your hashed password and {salt} with you salt.

     token="..."
 curl 'http://keycloak-http/auth/admin/realms/testrealm/users/f:60f0ff50-2cc5-492d-8222-04ac0a9964e1:217b93e8-2830-4392-83e3-9feceea94575' \
    -X PUT \
    -H "Authorization: $token" \
    -H "Content-Type: application/json" \
    --data '{"credentials": [ { "algorithm": "pbkdf2-sha512", "hashedSaltedValue": "{hashedpassword}", "hashIterations": 30000, "type": "password", "salt":"{salt}"}]}'