[SOLVED]: How to Reset Keycloak Admin Password

Keycloak, an open-source identity and access management solution, provides a comprehensive set of features for securing applications and services. However, situations may arise where you need to reset the admin password due to forgotten credentials or security concerns. In this article, we will discuss on how to reset keycloak admin password, ensuring secure access to your identity management system. Keep in mind, this procedure may wary based on the type of installation you have. In this article, two type of deployment is taken into account, pls read through the other, if one is not working for you

Reset Admin Password for Keycloak with External DB

Now a days, keycloak are brought up with external Database which stores the keycloak configuration and the users details. This is done in order to make ensure Geo Redundancy for the data stored in the keycloak. Below procedure can be used for such mode of keycloak deployment.

Step 1: Identifying the Database

Identify the database used for the keycloak. In my case I'm running a MariaDB instance which have a database created with name keycloakdb . These details can be obtained from the keycloak installation files or configuration

Step 2: Login to the Database

Below command can be used to login to the database, username and password can be obtained from the keycloak installation file or configuration

mysql -u keycloak -p<password> -D keycloakdb

Note: For the scope of this article I'm considering by DB user as keycloak. If you have enabled ssl for your DB, make sure you are passing the ca cert also with the mysql client command

Step3: Find keycloak User Id for Admin User

Below code snippets shows the sql commands to be executed to obtain the user id of the admin user

MariaDB [keycloakdb]> select ID, USERNAME 
-> from USER_ENTITY 
-> where 
-> USERNAME='admin' and 
-> REALM_ID=(select ID from REALM where name='master');
| fec77989-5dc9-477f-b2da-9e2255f49f32 | admin |
1 row in set (0.002 sec)

Step4: Check if admin user credentials is present (Optional)

Pass the ID obtained from the previous step to the below command to check if the admin user is having password assigned to it.

MariaDB [keycloakdb]> select * from CREDENTIAL 
-> where USER_ID = 'f73bb649-8f91-4c49-ae41-fdda5f00df44' ;
  • We will see a record password for the field TYPE, in the above output
  • We will see fields SECRET_DATA and CREDENTIAL_DATA which contains hashed password (old) and hashing algorithm details

Step5: Reset the credentials

Generate a hashed password pbkdf2-sha256 algorithm with salt key  is preferred in the scope of this article, and the number of iterations is 27500. Below script can be used to generate the hashed credentials,

import hashlib
import binascii

# Update the below accordingly
password = "Admin@1234"
provided_salt = "mysaltisthis"

# Convert the salt from base64 to bytes
salt = binascii.a2b_base64(provided_salt)

# Number of iterations for PBKDF2
hash_iterations = 27500

# Hash the password using PBKDF2-SHA256
hashed_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, hash_iterations)

# Convert the hash to a base64-encoded string
hashed_password_base64 = binascii.b2a_base64(hashed_password).decode('utf-8').strip()

print("Hashed password:", hashed_password_base64)

Update the salt, hashed password, and user id in the below sql command and execute using mysql client

WHERE USER_ID = 'fec77989-5dc9-477f-b2da-9e2255f49f32' ;


Step6: Restart keycloak instances

Post the credentials is updated in DB, restart all the keycloak instances, the method of restarting varies based on the type of deployment, pls follow the respective deployment documentation.


Reset Admin Password for Keycloak Running as Service

Below procedure can be followed to reset admin password for keycloak

Step 1: Accessing the Keycloak Server

To begin the process, you need access to the Keycloak server. This could be through direct access to the server machine or via a remote connection, depending on your setup.

Step 2: Stopping Keycloak

Before making any changes, it's recommended to stop the Keycloak server to avoid potential conflicts. This can usually be done using the following command:

systemctl stop keycloak

Step 3: Accessing the Keycloak Configuration

Navigate to the Keycloak installation directory. The exact location might vary depending on your setup and installation method. Look for a folder named something like "keycloak" or "keycloak-X.Y.Z" (where X.Y.Z represents the version number).

cd /path/to/keycloak

Step 4: Editing the Standalone XML Configuration

In the Keycloak installation directory, find the standalone/configuration/standalone.xml file. This file contains the configuration settings for keycloak.

Open standalone.xml using a text editor of your choice, such as nano, vim or vi.

Step 5: Modifying the Admin User’s Credentials

Within the standalone.xml file, locate the <admin-users> section. You will find a line that resembles the following.

    <user ..>

Find the <user> element representing the admin user. It typically has an attribute username="admin".

Edit the password  attribute of the admin user's <user> element. Replace the existing encrypted password with a new encrypted password. The easiest way to generate an encrypted password is by using a utility like openssl  or any online encryption tool

Step 6: Saving Changes

After updating the password, save the changes to the standalone.xml file and close the text editor.

Step 7: Starting Keycloak

Now that you've successfully updated the admin user's password, it's time to start Keycloak again.

systemctl start keycloak

Step 8: Accessing the Admin Console

With the admin password reset, you can now access the Keycloak admin console using the new credentials

Step 9: Updating the Password

Upon logging in, Keycloak might prompt you to update the password. Follow the instructions to set a new password that meets your security requirements.


Resetting the admin password of Keycloak is a crucial step in maintaining the security and accessibility of your identity and access management system. By following the steps outlined in this guide, you can ensure that you regain access to the admin console while also adhering to best practices for securing sensitive information. Always exercise caution when modifying configuration files, and make sure to follow security protocols to prevent unauthorized access.

Search on LinuxDataHub

Leave a Comment