<div dir="ltr"><a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.html">http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.html</a><br></div><div class="gmail_extra"><br><div class="gmail_quote">On 1 December 2015 at 15:39, Orestis Tsakiridis <span dir="ltr"><<a href="mailto:orestis.tsakiridis@telestax.com" target="_blank">orestis.tsakiridis@telestax.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Thanks Stian.<br><br></div>Can you send me some documentation or source code pointers about "modifying the password authenticator" ? Are we talking about a Java class, overriding login form ? sth else?<br><br><br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 1, 2015 at 3:12 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">So looks like we will indeed have password hash spi in 1.8. It'll be released in early January.<div><br></div><div>If you can't wait for that I think it would be better to not import users with a password at all and instead send reset password links to their email address. That would assume all users have emails registered. Or you could also modify the password authenticator and make it run md5 the value of the input password for users that haven't updated their password yet.</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On 1 December 2015 at 13:36, Orestis Tsakiridis <span dir="ltr"><<a href="mailto:orestis.tsakiridis@telestax.com" target="_blank">orestis.tsakiridis@telestax.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Ok, so i guess i'll have to go with a workaround, password reset, etc as i've described.<br><br>Thanks Stian<br></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 1, 2015 at 2:29 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">We are planning to add a Password Hashing SPI, which will allow plugging in additional hashing mechanisms. It's not ready quite yet though.</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On 1 December 2015 at 13:25, Orestis Tsakiridis <span dir="ltr"><<a href="mailto:orestis.tsakiridis@telestax.com" target="_blank">orestis.tsakiridis@telestax.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr"><div><div><div><div>Hello,<br><br></div>I'm trying to create some migration scripts that will port users from Application1 into keycloak. Users in Application1 already have usernames, passwords etc. I use the admin rest api to create the users.<br><br></div>The problem i'm facing is that user passwords in Application1 database are already hashed using md5. So, i don't really know the actual passwords (security wise that makes sense). <br><br></div><div>The only solution i've come down to is store the password as they are in keycloak (md5ed) and tell the users to use the hashed value instead of the plaintext one wieh signing in. Then, force them to reset passwords. Not the best UX :-(<br></div><div><br></div>Is there a way to tell keycloak that "these passwords are already hashed in md5" so, "store them as they are" and "when a user tries to sign in, first hash his password with md5 and the compare to the value stored in db" or sth like that?<br><br></div>Any alternatives come to mind ?<br><div><div><div><div><div><br><br></div><div>Regards <br><span><font color="#888888"><br>Orestis<br></font></span></div></div></div></div></div></div>
<br></div></div>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>