Add new user with credentials Temporary property does not working

user_4247822 0
Viewed 4234

Keycloak REST API in UserRepresentation model there is a "credentials" property, which has ( type = "password", value="some", temporary=true/false } On adding new user I wonna force the user to change his password on the first login. I know that it can be done globally in Required Actions in Realm/Authorization options, but if "force changing password" is not setted as default. I thought to control it by the setup that property in user.credentials model, but looks like it's totally dummy property and not makes any effect, always works as false. Am I right ?

P.S. I also take a look at the model in https://github.com/keycloak/keycloak/blob/b4b3527df7656bfaaee351ec414e56c683c134c2/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java I fond in resetPassword it's setted up, but not in updateUser ( which I assume is used for add user also ).

{
    "username": "New_User_3",
    "enabled": true,
    "firstName": "NewUserDemoFirst",
    "lastName": "NewUserDemoLast",
    "email": "New_User_3@mail.test",
    "attributes": {     
    },
    "access": {
        "manageGroupMembership": false,
        "view": false,
        "mapRoles": false,
        "impersonate": false,
        "manage": false
    },
    "credentials": [
        {
            "type": "password",
            "temporary": true,
            "value": "xM0K+G"
        }
    ]
}
keycloak identity
2 Answers

You could add required actions to the JSON object as shown. This would force the user to update the password upon login for the first time.

 {
   "username": "userxyz",
   "credentials": [
     {
       "type": "password",
       "value": "passwordabc",
       "temporary": true
     }
   ],
   "requiredActions": [
     "UPDATE_PASSWORD"
   ],
   ...
 }
user_147552270

but looks like it's totally dummy property and not makes any effect, always works as false. Am I right ?

Yes.

This seem to be a bug of Keycloak. I can reproduce it too.

To fix the bug, I think the following lines should be added to org.keycloak.services.resources.admin.UserResource.updateUserFromRep():

List<CredentialRepresentation> credentials = rep.getCredentials();
if (credentials != null) {
    for (CredentialRepresentation credential : credentials) {
        if (CredentialRepresentation.PASSWORD.equals(credential.getType())
                 && credential.isTemporary() != null && credential.isTemporary()) {
            user.addRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD);
        }
    }
}

A workaround is to call reset-password after creating a user.

PUT /{realm}/users/{id}/reset-password

See also:https://www.keycloak.org/docs-api/7.0/rest-api/index.html

user_77256210
Related