Hi, This place is surely better than a comment in JIRA. I really need this issue to be resolved. I tried a fistr patch quickly, which was rejected[1], but is it possible to verify the credential type befoer the password policy check in UserCredentialStoreManager.java or is it the wrong direction? [1]: https://github.com/keycloak/keycloak/pull/4364/files Regards, -- Cédric Couralet