e7363905fa
Changes according to the latest [OWASP cheat sheet for secure Password Storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2): - Changed default password hashing algorithm from pbkdf2-sha256 to pbkdf2-sha512 - Increased number of hash iterations for pbkdf2-sha1 from 20.000 to 1.300.000 - Increased number of hash iterations for pbkdf2-sha256 from 27.500 to 600.000 - Increased number of hash iterations for pbkdf2-sha512 from 30.000 to 210.000 - Adapt PasswordHashingTest to new defaults - The test testBenchmarkPasswordHashingConfigurations can be used to compare the different hashing configurations. - Document changes in changes document with note on performance and how to keep the old behaviour. - Log a warning at the first time when Pbkdf2PasswordHashProviderFactory is used directly Fixes #16629 Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> |
||
|---|---|---|
| .github | ||
| .idea | ||
| .mvn | ||
| adapters | ||
| authz | ||
| boms | ||
| common | ||
| core | ||
| crypto | ||
| dependencies | ||
| distribution | ||
| docs | ||
| examples | ||
| federation | ||
| integration | ||
| js | ||
| misc | ||
| model | ||
| operator | ||
| quarkus | ||
| rest | ||
| saml-core | ||
| saml-core-api | ||
| server-spi | ||
| server-spi-private | ||
| services | ||
| testsuite | ||
| themes | ||
| util | ||
| .gitattributes | ||
| .gitignore | ||
| .gitleaks.toml | ||
| ADOPTERS.md | ||
| CONTRIBUTING.md | ||
| get-version.sh | ||
| GOVERNANCE.md | ||
| LICENSE.txt | ||
| MAINTAINERS.md | ||
| maven-settings.xml | ||
| mvnw | ||
| mvnw.cmd | ||
| pom.xml | ||
| PR-CHECKLIST.md | ||
| README.md | ||
| set-version.sh | ||
Keycloak
Keycloak is an Open Source Identity and Access Management solution for modern Applications and Services.
This repository contains the source code for the Keycloak Server, Java adapters and the JavaScript adapter.
Help and Documentation
- Documentation
- User Mailing List - Mailing list for help and general questions about Keycloak
Reporting Security Vulnerabilities
If you have found a security vulnerability, please look at the instructions on how to properly report it.
Reporting an issue
If you believe you have discovered a defect in Keycloak, please open an issue. Please remember to provide a good summary, description as well as steps to reproduce the issue.
Getting started
To run Keycloak, download the distribution from our website. Unzip and run:
bin/kc.[sh|bat] start-dev
Alternatively, you can use the Docker image by running:
docker run quay.io/keycloak/keycloak start-dev
For more details refer to the Keycloak Documentation.
Building from Source
To build from source, refer to the building and working with the code base guide.
Testing
To run tests, refer to the running tests guide.
Writing Tests
To write tests, refer to the writing tests guide.
Contributing
Before contributing to Keycloak, please read our contributing guidelines.
Other Keycloak Projects
- Keycloak - Keycloak Server and Java adapters
- Keycloak QuickStarts - QuickStarts for getting started with Keycloak
- Keycloak Node.js Connect - Node.js adapter for Keycloak