使用 keycloak IDP 更改用户帐户密码

Question

I am developping a vue application protected by keycloak using keycloak-js. I have a requirement that each user have an account page in my app to change their password. .

However it seems that keycloak has no endpoint to check old password. How can i achieve this? I am wondering if this is the appropriate way to do with keycloak or not...

I already tried the update password action that send an email with magic link to the user so they can change their password. However it is not compliant with owasp recommendation that advise to force user to type their old password each time.

Answer 1

An alternative approach is for you to create a Keycloak client with Direct Access Grants enabled ( ie, Resource Owner Password Credentials Grant in OAuth2 terminology).

Then you can use the token endpoint and exchange the username and password for an access token. If the password is correct you get a token, otherwise it fails. Consequently, you can use this to infer if the user has inserted the old password.

In this GitHub repo you can see an example of how the call to the aforementioned endpoint would look like.