Scenario Overview:
In Keycloak, our organization has a realm named FooRealm, containing both business and admin users. We recently decided to enforce a 30-day password update policy for business users. However, admin users, who only perform API and system calls, should be excluded from this policy.
Keycloak lacks a built-in feature to exclude specific user types from password policies. To work around this, I explored the Keycloak database and found the ‘Credential’ table, which stores credential-related information with the following fields:
- USER_ID
- CREATED_DATE
Based on my understanding, the system likely checks the password’s expiration by comparing the current time with the CREATED_DATE field. If the difference exceeds the policy’s expiration time, it prompts for a password update.
Proposed Solution:
To exclude admin users from the password expiry policy, could we update their CREATED_DATE to a far future date? This way, the system would see their passwords as perpetually valid and bypass the expiration check.