Do I Need to Hash My Passwords for Keycloak Client?

Viewed 392

I'm using org.keycloak:keycloak-admin-client:12.0.4. I've been doing some research about how to use the API.

Here are a couple examples:

        // ----
        // Getting a JWT
        // ----
        Keycloak keycloak = KeycloakBuilder.builder()
                .serverUrl("http://localhost:8180/auth")
                .grantType(OAuth2Constants.PASSWORD)
                .realm("dev")
                .clientId("example-client")
                .clientSecret("1169ef64-ea8f-47eb-9e55-74fdda9ee398")
                .username("user1")
                // raw password
                .password("user1Pass")
                .resteasyClient(
                        new ResteasyClientBuilderImpl()
                                .connectionPoolSize(10).build()
                ).build();

        AccessTokenResponse atr =
                keycloak.tokenManager().getAccessToken();

        // ----
        // Creating a new user
        // ----
        UserRepresentation user = new UserRepresentation();
        user.setEnabled(true);
        user.setUsername("tester1");
        user.setFirstName("First");
        user.setLastName("Last");
        user.setEmail("example@email.com");
        user.setAttributes(Collections.singletonMap("origin", Arrays.asList("demo")));

        RealmResource realmResource = keycloak.realm("dev");
        UsersResource usersRessource = realmResource.users();

        Response response = usersRessource.create(user);
        String userId = CreatedResponseUtil.getCreatedId(response);

        CredentialRepresentation passwordCred = new CredentialRepresentation();
        passwordCred.setTemporary(false);
        passwordCred.setType(CredentialRepresentation.PASSWORD);
        // raw password
        passwordCred.setValue("test");

        UserResource userResource = usersRessource.get(userId);

So in both of these situations, I'm using a String which is the raw password. My question is, should I be hashing passwords before sending them to Keycloak?

It's not that I distrust Keycloak, I'm just curious if Keycloak itself is doing some hashing in its own implementation. I've done some searching on Google, but haven't found any what I'm looking for.

0 Answers
Related