11:04 a.m.
Hello Leonid,
Can I have a more complete description of your use case? Without knowing how you imported
from the legacy storage, I'm not sure how to answer this.
However, I can give some context into the new credential format and why the previous
methods were deprecated, and maybe it'll help:
Before credentials were only password and OTP, but now it's intended that keycloak
handle any number of credential types, both in keycloak (for example WebAuthn that was
added in keycloak 8), and with extensions that 3rd parties wish to add. The definition of
credentials in the database has been modified to accommodate this change, there's
information in the documentation on this here:
https://www.keycloak.org/docs/latest/server_development/index.html#extend....
Basically, credential-type specific information is now held as json within two fields:
* secret_data: for information that must not leave the database,
* credential_data: for non-sensitive data that is available in the administration GUI, and
can be transmitted via the REST API.
There are classes in Keycloak that allow the serialization and de- serialization of this
json. For passwords it is now the PasswordCredentialModel (see
https://github.com/keycloak/keycloak/blob/master/server-spi/src/main/java...)
. If you're passing by a CredentialRepresentation object for importing legacy
passwords, you can:
1. Use the static method PasswordCredentialModel.createFromValues (String algorithm,
byte[] salt, int hashIterations, String encodedPassword), which will create a
CredentialModel with the correct format.
2. Use the static method ModelToRepresentation.toRepresentation(CredentialModel cred) to
get a CredentialRepresentation.
I hope this helps, and if not, I'll try to answer your next questions.
Alistair Doswald
-----Original Message-----
From: keycloak-user-bounces(a)lists.jboss.org <keycloak-user-bounces(a)lists.jboss.org>
On Behalf Of Leonid Rozenblyum
Sent: lundi, 18 novembre 2019 09:46
To: keycloak-user(a)lists.jboss.org
Subject: [keycloak-user] Keycloak 8: CredentialRepresentation algorithm
Hello!
Before Keycloak 8.0.0 it was possible to use
org.keycloak.representations.idm.CredentialRepresentation methods setAlgorithm
setHashedSaltedValue
in order to support import from a legacy storage with some custom algorithm not supported
by Keycloak.
During https://github.com/keycloak/keycloak/pull/6459 those methods were removed, fields
were deprecated.
What's the correct way to provide Credentials for a user with some custom algorithm
right now?
Thanks for explanation.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user