goauthentik / goauthentik/authentik

Migrate users and passwords from Keycloak

Open
#4,471 7 comments 3 reactions 0 assignees View on GitHub
question
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe your question**
I am currently using Keycloak as an IDP for my organization, without an LDAP behind. I manage roles and users directly in the administration backend of Keycloak. Because Authentik can also act as an LDAP server I consider switching, as many software lacks features when using SAML or OIDC, such as automatically revoke Roles from users, which is often only done when the user renews their session, but cannot be initiated from the IDP when changing Role memberships. It is not much of a problem to create SAML and OIDC clients in Authentik manually, an automatic migration is not necessary in my case as I have just about five SPs.

My biggest concern is migrating users with their passwords (which of course are hashed in the database). It would be a bad user experience if I have to send them an Email like "please login and create a new password" or having them to create new passwords on first login. You always lose users on the way.

Is there a way to migrate users, including their passwords, and roles, from Keycloak to Authentik? Or is such a feature considered in the near future?

**Version and Deployment (please complete the following information):**
- Latest Keycloak Legacy Docker Container
- PostgreSQL 14

**Additional context**
I could imagine it to be possible by giving Authentik access to Keycloaks database. Users without a password in Authentik would be authenticated against the Keycloak database and their password then be set in Authentiks database on successful login.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.