Re: [keycloak-user] Password policy for the last used passwords

Hello, My keycloak configuration has password policy enabled for all users and it also has the Not Recently Used part specified to some number. I have a simple use case: 1. I create user 2. I set a password for this user 3. I delete this user I repeat this step again, with the same username and password and I get an error on 2nd step which is "Invalid password: must not be equal to any of last x passwords.” The problem is, I can only have this error on admin API, if I do it on the admin UI then I don’t get it. Now obviously if it was the same “user” it would make sense, but since I delete this username and create a new user, which has different user ID; then I would expect it to behave differently. I am using Keycloak 3.1.0 and Java adapter which has 3.1.0 as well. The below are the code 1. Creating user: keycloak.realm(usersRealm).users().create(someUserRepresentation); 2. Resetting password of the user: CredentialRepresentation passwordCredRepresentation = new CredentialRepresentation(); representation.setTemporary(false); representation.setType(PASSWORD); representation.setValue(password); UserResource userResource = keycloak.realm(usersRealm). users().get(keycloakId); userResource.resetPassword(passwordCredRepresentation); 3. Deleting the user: keycloak.realm(usersRealm).users().delete(keycloakId)) I definitely know that delete user works because once I run this, I don’t see any user and when I run create user code, I can see a user account with different ID. My question is, is this intentional or a bug? If it is intentional, then how can I clear user’s password history? I tried looking that up in admin api but could not find any call. Thanks, Sarp _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user