I'm using org.keycloak:keycloak-admin-client:12.0.4. I've been doing some research about how to use the API.
Here are a couple examples:
// ----
// Getting a JWT
// ----
Keycloak keycloak = KeycloakBuilder.builder()
.serverUrl("http://localhost:8180/auth")
.grantType(OAuth2Constants.PASSWORD)
.realm("dev")
.clientId("example-client")
.clientSecret("1169ef64-ea8f-47eb-9e55-74fdda9ee398")
.username("user1")
// raw password
.password("user1Pass")
.resteasyClient(
new ResteasyClientBuilderImpl()
.connectionPoolSize(10).build()
).build();
AccessTokenResponse atr =
keycloak.tokenManager().getAccessToken();
// ----
// Creating a new user
// ----
UserRepresentation user = new UserRepresentation();
user.setEnabled(true);
user.setUsername("tester1");
user.setFirstName("First");
user.setLastName("Last");
user.setEmail("example@email.com");
user.setAttributes(Collections.singletonMap("origin", Arrays.asList("demo")));
RealmResource realmResource = keycloak.realm("dev");
UsersResource usersRessource = realmResource.users();
Response response = usersRessource.create(user);
String userId = CreatedResponseUtil.getCreatedId(response);
CredentialRepresentation passwordCred = new CredentialRepresentation();
passwordCred.setTemporary(false);
passwordCred.setType(CredentialRepresentation.PASSWORD);
// raw password
passwordCred.setValue("test");
UserResource userResource = usersRessource.get(userId);
So in both of these situations, I'm using a String which is the raw password. My question is, should I be hashing passwords before sending them to Keycloak?
It's not that I distrust Keycloak, I'm just curious if Keycloak itself is doing some hashing in its own implementation. I've done some searching on Google, but haven't found any what I'm looking for.