# Migrate users from Keycloak to Auth0 "custom\_password\_hash" problems

**URL:** <https://community.auth0.com/t/migrate-users-from-keycloak-to-auth0-custom-password-hash-problems/99467>\
**Category:** Get Help\
**Tags:** user-import-export, user-management\
**Created:** [February 1, 2023, 2:47pm UTC](https://community.auth0.com/t/migrate-users-from-keycloak-to-auth0-custom-password-hash-problems/99467 "2023-02-01T14:47:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sequencemedia](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sequencemedia/32/42783_2.png) [@sequencemedia](https://community.auth0.com/u/sequencemedia)\
**Post date:** [February 1, 2023, 2:47pm UTC](https://community.auth0.com/t/migrate-users-from-keycloak-to-auth0-custom-password-hash-problems/99467/1 "2023-02-01T14:47:42Z")

</div>

I’ve been following through [a discussion posted back in July '21](https://community.auth0.com/t/migrate-keycloak-user-to-auth0-problems/65462) about migrating users from Keycloak to Auth0

User @thameera posted the solution and following it I’ve been able to export the users from Keycloak, and import them using the Management API

But! I cannot log in with any of the credentials

It seems to me that I have created a valid JSON structure, but I have not set the values correctly

Here’s an example of a user I get from Keycloak

```auto
{
    "id" : "ac492a5c-df80-4012-b3c3-b2cd1dbc037c",
    "createdTimestamp" : 1675074404666,
    "username" : "the-user-1",
    "enabled" : true,
    "totp" : false,
    "emailVerified" : false,
    "firstName" : "User",
    "lastName" : "One",
    "email" : "the-user-1@sequencemedia.net",
    "credentials" : [ {
      "id" : "d6d16776-c2a3-458f-97b8-719cd07a2f97",
      "type" : "password",
      "userLabel" : "My password",
      "createdDate" : 1675260278399,
      "secretData" : "{\"value\":\"zC9qCa/0XjQOt/fy/XFZ69rvnw6w6hueI294PnqmPeKOeMH3Qr8S5RWhg1v+b60DhkcSlw1FKZWpgNjsQflxYA==\",\"salt\":\"9xdUcOPkoYYS/kr2URMArw==\",\"additionalParameters\":{}}",
      "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
    } ],
    "disableableCredentialTypes" : [],
    "requiredActions" : [],
    "realmRoles" : ["default-roles-master"],
    "notBefore" : 0,
    "groups" : []
  }

```

And here is the user transformed for Auth0

```auto
{
    "email": "the-user-1@sequencemedia.net",
    "email_verified": false,
    "name": "User One",
    "custom_password_hash": {
      "algorithm": "pbkdf2",
      "hash": {
        "value": "$pbkdf2-sha256$i=27500,l=32$9xdUcOPkoYYS/kr2URMArw$zC9qCa/0XjQOt/fy/XFZ69rvnw6w6hueI294PnqmPeKOeMH3Qr8S5RWhg1v+b60DhkcSlw1FKZWpgNjsQflxYA"
      }
    }
  }

```

I used the pattern provided by @thameera to produce the value

```auto
$pbkdf2-${digest}$i=${iterations},l=${keylen}$${b64Salt}$${hash}

```

I _noticed_ that the salt value is named “b64Salt” but the hash only “hash”. I’ve assumed that they are _both_ expected to be in `base64` format – is this where I have borked?

This is a test-only local instance user so I’m happy to supply the actual credentials:

- Username `the-user-1@sequencemedia.net`
- Password `$b!6A6t7M7URi.`

---

<div class="post-metadata">

**Author:** ![faraujo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/faraujo/32/30043_2.png) [@faraujo](https://community.auth0.com/u/faraujo)\
**Post date:** [February 1, 2023, 4:00pm UTC](https://community.auth0.com/t/migrate-users-from-keycloak-to-auth0-custom-password-hash-problems/99467/2 "2023-02-01T16:00:37Z")

</div>

I don’t quite remember, as it has been a few years, but I do remember struggling with the answer.

However, I think the problem lies on the `l` parameter. According to the [PHC string format](https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md), the `l ` is the size of the decoded base 64 hash.

So basically I changed to `l=64` and placed the base 64 value of the salt and worked.

Hope this helped.  
Again I don’t remember very much the details, I think it was generally what happened.

---

<div class="post-metadata">

**Author:** ![sequencemedia](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sequencemedia/32/42783_2.png) [@sequencemedia](https://community.auth0.com/u/sequencemedia)\
**Post date:** [February 1, 2023, 4:30pm UTC](https://community.auth0.com/t/migrate-users-from-keycloak-to-auth0-custom-password-hash-problems/99467/3 "2023-02-01T16:30:10Z")

</div>

That’s it! THANK YOU @faraujo

A corrected transformed user (for future readers) is

```auto
{
    "email": "the-user-1@sequencemedia.net",
    "email_verified": false,
    "name": "User One",
    "custom_password_hash": {
      "algorithm": "pbkdf2",
      "hash": {
        "value": "$pbkdf2-sha256$i=27500,l=64$9xdUcOPkoYYS/kr2URMArw$zC9qCa/0XjQOt/fy/XFZ69rvnw6w6hueI294PnqmPeKOeMH3Qr8S5RWhg1v+b60DhkcSlw1FKZWpgNjsQflxYA"
      }
    }
  }

```

- `l` is the size of the decoded base 64 hash (so, `64`)
- The salt is a base64 string _without_ the trailing `==` (so `9xdUcOPkoYYS/kr2URMArw==` becomes `9xdUcOPkoYYS/kr2URMArw`)
- The hash is a base64 string _without_ the trailing `==` (so `zC9qCa/0XjQOt/fy/XFZ69rvnw6w6hueI294PnqmPeKOeMH3Qr8S5RWhg1v+b60DhkcSlw1FKZWpgNjsQflxYA==` becomes `zC9qCa/0XjQOt/fy/XFZ69rvnw6w6hueI294PnqmPeKOeMH3Qr8S5RWhg1v+b60DhkcSlw1FKZWpgNjsQflxYA`)

And that’s that!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 15, 2023, 4:30pm UTC](https://community.auth0.com/t/migrate-users-from-keycloak-to-auth0-custom-password-hash-problems/99467/4 "2023-02-15T16:30:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.