[TOCM]

[TOC]

Keycloak Tools

What it does...

English

Emergency Intervention Tools !!! :D

• Change a password

  • Argon2-compatible

• Enable or disable an account

• Force a password reset

• List all realms

• List all users

  It can retrieve DBASE credentials from docker-compose.yml

Motivation

In my company, we are required to change our passwords every 6 months — including the administrator account — and we are not allowed to store them in any shared KeePass vault or any other connected password manager.

We wanted to simulate a complete loss of access to the Keycloak super-admin account, which was originally installed using environment variables (KC_*), meaning there is no configuration file inside the container.

We managed to recover access using the method described in the official tutorial, but not without difficulties.
The process was quite nerve-wracking — the slightest mistake with kc.sh and its options can corrupt the Docker image or container, potentially blocking the entire authentication system.
We made several mistakes before successfully resetting the super-admin password, including launching kc.sh without the SQL database options!

In short, changing a password should be quick, and requiring a full read of the documentation each time is simply not acceptable.
We don’t use kc.sh often enough to remember all its constraints, which are perfectly valid but tedious.
Keycloak is just one tool among many, and we do not intend to become kc.sh experts.

That’s why I developed keyc-tools.py, during my free time — to reset a password in an emergency without having to remember the syntax or prerequisites... even if it means stopping the service for one minute (literally timed!).

I’m sharing it so you can use it too :D

Example 1

If you have the docker-compose.yml file available, place it in the same directory as keyc-tools.py so it can automatically retrieve the SQL credentials. Then run:

python3 keyc-tools.py realm=master user=kadmin password
                              or
python3 keyc-tools.py realm=master user=kadmin password="XxxxXxx"

Example 1.1 - All realms

python3 keyc-tools.py user=kadmin password

Example 2

Without docker-compose.yml, use the full syntax:

<!> If the account is disabled, add the "activate" option

python3 keyc-tools.py dbuser=DBUser dbname=DBName dbpassword=DBPass dbhost=localhost dbport=3306 dbtype=mariadb realm=master user=kadmin password

Example 3 - List users

./keyc-tools.py get_user

Example 3.1 - For a specific realm

./keyc-tools.py get_user realm=master

Example 4

./keyc-tools.py help  :)

Installation tutorial / quick reference

• Excerpt from the installation tutorial / quick reference