goauthentik / goauthentik/authentik
Migrate users and passwords from Keycloak
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe your question**
I am currently using Keycloak as an IDP for my organization, without an LDAP behind. I manage roles and users directly in the administration backend of Keycloak. Because Authentik can also act as an LDAP server I consider switching, as many software lacks features when using SAML or OIDC, such as automatically revoke Roles from users, which is often only done when the user renews their session, but cannot be initiated from the IDP when changing Role memberships. It is not much of a problem to create SAML and OIDC clients in Authentik manually, an automatic migration is not necessary in my case as I have just about five SPs.
My biggest concern is migrating users with their passwords (which of course are hashed in the database). It would be a bad user experience if I have to send them an Email like "please login and create a new password" or having them to create new passwords on first login. You always lose users on the way.
Is there a way to migrate users, including their passwords, and roles, from Keycloak to Authentik? Or is such a feature considered in the near future?
**Version and Deployment (please complete the following information):**
- Latest Keycloak Legacy Docker Container
- PostgreSQL 14
**Additional context**
I could imagine it to be possible by giving Authentik access to Keycloaks database. Users without a password in Authentik would be authenticated against the Keycloak database and their password then be set in Authentiks database on successful login.
Contributor guide
Assessment
This issue has not been assessed yet.