# Migrate Keycloak user to Auth0 problems

**URL:** <https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462>\
**Category:** Get Help\
**Tags:** migrate-users, auth0\
**Created:** [July 2, 2021, 7:52am UTC](https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462 "2021-07-02T07:52:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![faraujo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/faraujo/32/30043_2.png) [@faraujo](https://community.auth0.com/u/faraujo)\
**Post date:** [July 2, 2021, 7:52am UTC](https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462/1 "2021-07-02T07:52:30Z")

</div>

Hello,

We are currently in the process of moving from Keycloak to Auth0 and we are having issues trying to migrate users using the User Import / Export Extension, as we want users to retain their old passwords. We want the migration process to be as seamless as possible.

Our Keycloak hashed passwords are encrypted using pbkdf2-sha256 with 27500 hash iterations.  
According to the [User JSON schema](https://auth0.com/docs/users/bulk-user-import-database-schema-and-examples#user-json-schema) there is no field were we can configure the number of hash iterations under the “custom\_password\_hash”.

For reference, the Keycloak user has this set as credentials (real values obfuscated):

```auto
"secretData" : "{\"value\":\"hashedPassword==\",\"salt\":\"someSalt==\"}",
"credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}"

```

If I try to adapt that in to a JSON file to use to import, I get an error saying “Additional properties not allowed: salt”. I feel that since there is no field to insert the number of hash iterations, I might not be able to use that extension, but I might be missing something or someone might have some other alternative.  
The JSON file I used to import the users looked something like this:

```auto
[
	{
		"email": "example@test.com",
		"email_verified": true,
		"name": "Imported User",
		"custom_password_hash": {
			"algorithm": "pbkdf2",
			"hash": {
				"value": "hashedPassword==",
				"encoding": "utf8",
				"digest": "sha256"
			},
			"salt": {
				"value": "someSalt==",
				"position": "suffix"
			}
		}
	}
]

```

Thank you,  
Francisco Araújo.

---

<div class="post-metadata">

**Author:** ![thameera](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thameera/32/13430_2.png) [@thameera](https://community.auth0.com/u/thameera)\
**Post date:** [July 7, 2021, 8:14am UTC](https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462/2 "2021-07-07T08:14:40Z")

</div>

Hi @faraujo , the number of iterations is embedded in PBKDF2 hashes, and does not need to be specified separately. Auth0 requires that you import the hashes in PHC format: [Bulk User Import Database Schema and Examples](https://auth0.com/docs/users/bulk-user-import-database-schema-and-examples#pbkdf2)

A PHC PBKDF2 hash has the following format:

```auto
$pbkdf2-${digest}$i=${iterations},l=${keylen}$${b64Salt}$${hash}

```

The JSON file would look like this:

```auto
[
  {
    "email": "example@test.com",
    "email_verified": true,
    "name": "Imported User",
    "custom_password_hash": {
      "algorithm": "pbkdf2",
      "hash": {
        "value": "$pbkdf2-sha256$i=27500,l=32$a2V5Ym9hcmRjYXQ$BlVeTAF9FMHUF3sn39M6vywv1aZcAqW/FrVW+XTtFWM"
      }
    }
  }
]

```

If you can share the hash and salt of a known example password (eg: `password123`), we can help you generate the PHC string.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [July 7, 2021, 11:49am UTC](https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462/3 "2021-07-07T11:49:28Z")

</div>

Thanks for helping on this one Thameera!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 22, 2021, 11:49am UTC](https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462/4 "2021-07-22T11:49:42Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.