Hi, Dnia piątek, 9 grudnia 2016 08:22:50 CET Bruno Oliveira pisze: I think the question was not about hashing Keycloak user passwords, but about encrypting the password used to bind keycloak to the LDAP server configured as an Identity Provider for Keycloak. Is that correct, Michael? In such case, the password cannot be hashed (as Keycloak has to have access to it to provide it to the LDAP server upon connecting). My *guess* is that the bind password could be encrypted, but database compromise would nonetheless let a potential attacker get to the password (if in no other way, by setting up their own Keycloak instance and using the db for it). There's no way around it, I think -- Keycloak has to have access to the clear- text LDAP password, one way or another, to bind to the LDAP server. -- Pozdravi, rashiq