Potential Admin Console Lockout for Bootstrap Admin on Keycloak 26

Configuring the server
1

I just noticed that when using Keycloak version 26, I am only able to create the bootstrap admin on initial startup (i.e. when the master realm does not exist).

For security, we routinely wipe the entire admin accounts in the master realm (by performing a cascading delete on PostgreSQL). But the problem is that the admin credentials are not recreated on startup (bootstrap or otherwise), leading to an admin console lockout.

We actually had to downgrade to version 25.0.6, and are using this in the configuration:

KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}

Potential Solution:

  1. The admin bootstrap also works when there are no admin accounts (not just when the master realm is initially created).
  2. An additional configuration option KC_BOOTSTRAP_ADMIN_EXPIRY, which sets when the admin credentials automatically get deleted (instead of having to do it manually). It could have a default of 1 hour.

I would appreciate feedback on this, thank you.