14.12.2 14.12.1 14.12.0 14.11.0 14.10.0 14.9.0 14.8.0 14.7 14.6 14.5 14.4 14.3
14.12.2 14.12.1 14.12.0 14.11.0 14.10.0 14.9.0 14.8.0 14.7 14.6 14.5 14.4 14.3
Breadcrumbs

Password policy (Keycloak)

Enforce a strong Keycloak password policy on the realm used for VRS login (minimum length, complexity, and password history).

Screenshots below are from Keycloak Admin (realm VRS, Keycloak 23).

Related: Account lockout after failed logins is covered separately in Login account lockout (Keycloak Brute Force Detection). Do not confuse password policy with Brute Force Detection.

Policy

Value

Purpose

Minimum length

12

Reject short passwords

Uppercase characters

1

Require at least one uppercase letter

Lowercase characters

1

Require at least one lowercase letter

Digits

1

Require at least one digit

Special characters

1

Require at least one special character

Not recently used

3

Block reuse of the last 3 passwords

1. Open Password Policy

  1. Log in to the Keycloak Admin console.

  2. Select the realm used for VRS login (for example VRS).

  3. Left menu → Authentication → Policies → Password policy.

2. Add the Policies

  1. Click Add policy and add each policy from the table above.

  2. Set the values as shown, then click Save.

Add policy menu (remaining policies after the recommended ones are already added):

Keycloak Add policy dropdown on Password policy page
Authentication → Policies → Password policy → Add policy

Configured password policy (example):

Password policy with length 12 upper lower digits special history 3
Password policy: Minimum length 12; Uppercase / Lowercase / Digits / Special characters 1; Not recently used 3

3. Verify

  1. Open Users → select a test user → Credentials.

  2. Click Reset password.

  3. Set Temporary to Off for the check (optional).

  4. Try a weak password (for example 12345) → Keycloak must reject it.

  5. Try a strong password that meets all rules and is not in recent history → Keycloak must accept it.

Credentials tab:

User Credentials tab with Reset password
Users → Credentials → Reset password

Weak password rejected:

Error resetting password must contain special characters
Example: weak / incomplete password rejected by policy

Password history rejection (reuse of a recent password):

Error must not be equal to any of last 3 passwords
Example: Not recently used blocks reuse of the last 3 passwords

Strong password accepted:

The password has been reset successfully
Strong new password accepted

Notes

  • Existing users keep their current passwords until the next password change or admin reset. The policy is enforced when a password is set or changed.

  • Apply the same six policies on every realm that authenticates VRS users for your deployment.