# Validate current password before update new password Keycloak using Spring Boot **URL:** \ **Category:** Getting advice\ **Tags:** authentication\ **Created:** [March 10, 2023, 9:59am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757 "2023-03-10T09:59:25Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [March 10, 2023, 9:59am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/1 "2023-03-10T09:59:25Z")
Hi guys, Assuming I’m logged into an application and have a Keycloak token, now I want to check if the entered password is correct before executing the password. Please help me write this method in Java, I have tried searching on both Google and ChatGPT but have not found a solution. ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/0/0195d1a53283513addb94f129fdf65bb225a3de7.png) ---
**Author:** ![adropofliquid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/adropofliquid/32/6859_2.png) [@adropofliquid](https://forum.keycloak.org/u/adropofliquid)\ **Post date:** [March 10, 2023, 1:31pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/2 "2023-03-10T13:31:12Z")
I am assuming you are trying to do this using the Admin REST Api. An option is to initiate a login session with the username and password, and if it’s successful, you can return true, and false if otherwise. ---
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [March 13, 2023, 2:22am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/3 "2023-03-13T02:22:50Z")
But I have already logged in and have jwt token. So this solution is not feasible. ---
**Author:** ![adropofliquid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/adropofliquid/32/6859_2.png) [@adropofliquid](https://forum.keycloak.org/u/adropofliquid)\ **Post date:** [March 13, 2023, 6:44pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/4 "2023-03-13T18:44:26Z")
I don’t think I understood your initial question. what do you mean by “before executing the password”? are you trying to implement a password change? ---
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [March 14, 2023, 2:09am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/5 "2023-03-14T02:09:00Z")
Yes, I will have two steps: 1. Check if the current password is correct, assuming the user has already logged in. 2. If pass step 1, we will update new password But I am stuck at step 1. ---
**Author:** ![adropofliquid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/adropofliquid/32/6859_2.png) [@adropofliquid](https://forum.keycloak.org/u/adropofliquid)\ **Post date:** [March 14, 2023, 5:15pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/6 "2023-03-14T17:15:45Z")
Okay. So my initial answer is feasible. I am aware user is logged in and already has a token, and that does not stop you from initiating another login session. So here are my (hacky) recommended steps 1. Login the user 2. User clicks change pass 3. ask for old pass 4. initiate a login session with username and password in some java method that returns true if the password login session gets initiated successfully. 5. update password if true. 6. logout the user from all sessions because of password change An alternative to this would be to just use account reset function which creates a new password without verifying old password but makes use of email verification. ---
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [March 15, 2023, 2:08am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/7 "2023-03-15T02:08:51Z")
Thanks, I will use your way. 😃 ---
**Author:** ![mfahadahmed](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@mfahadahmed](https://forum.keycloak.org/u/mfahadahmed)\ **Post date:** [May 3, 2023, 1:43pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/8 "2023-05-03T13:43:34Z")
Hi @adropofliquid Does this method still works if the user has multi-factor-authentication enabled? If no, then what workaround should we implement in that case? ---
**Author:** ![adropofliquid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/adropofliquid/32/6859_2.png) [@adropofliquid](https://forum.keycloak.org/u/adropofliquid)\ **Post date:** [May 10, 2023, 1:38am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/9 "2023-05-10T01:38:59Z")
I have not tried this with MFA enabled. I am not sure about it ---
**Author:** ![yesha2406](https://avatars.discourse-cdn.com/v4/letter/y/90ced4/32.png) [@yesha2406](https://forum.keycloak.org/u/yesha2406)\ **Post date:** [June 8, 2023, 10:38am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/10 "2023-06-08T10:38:29Z")
@cuongnh @adropofliquid Could you please add some code so I can understand. As I need to build functionality where I have to verify whether the old password is correct or not while changing the password. It would be a great help. Thanks in advance. ---
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [June 12, 2023, 4:39am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/11 "2023-06-12T04:39:08Z")
Here, you can do same as login fuction. ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/5/5bb82dec86f6e24859fa6eb5ba5496980a437833.png) ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/c23578ef11f72ca66c9ea35908b5ff45b3f84fb7.png) ---
**Author:** ![adropofliquid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/adropofliquid/32/6859_2.png) [@adropofliquid](https://forum.keycloak.org/u/adropofliquid)\ **Post date:** [June 25, 2023, 1:15pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/12 "2023-06-25T13:15:16Z")
Great work. do you have this on github? ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [June 25, 2023, 7:41pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/13 "2023-06-25T19:41:44Z")
This all is bad in many ways as you build your personal man-in-the-middle 💣 Better solution: Leave all to Keycloak, implement your own custom `UpdatePassword` Required Action by extending the existing/built-in one and overwriting the `getMaxAuthAge()` method only (or also the `order()` method) an return 0. Leave the ID of the action as is. This way, Keycloak will always ask first for the existing password and you don’t have to deal with man-in-the-middle. Also, don’t do “login” with the man-in-the-middle-apporach. Read and understand the spec and concept behind OAuth2 and OIDC. Don’t argue with “but…”. That’s always wrong. ---
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [June 26, 2023, 1:36am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/14 "2023-06-26T01:36:47Z")
We are using SSL, how can we meet MITM? Not to mention, most of the methods that call to Keycloak are doing the same. ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [June 26, 2023, 5:05am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/15 "2023-06-26T05:05:28Z")
Again: > [@dasniko](#): > > Read and understand the spec and concept behind OAuth2 and OIDC. Man-in-the-middle is not about using SSL/TLS or not. By using you above mentioned approach, your application get access to the users cleartext credentials and thus your application is the MITM! Your application MUST NOT get in touch with users credentials in any ways. Users only interact with the secure server (here: Keycloak) when dealing with credentials. _That’s how OAuth and OIDC work_, it’s about redirections in browser, not trying to integrate something in a wrong and highly insecure way into your application. > [@cuongnh](#): > > Not to mention, most of the methods that call to Keycloak are doing the same. The Keycloak admin client you are using here is for - guess what - administrational stuff! Not dealing with users credentials and login of users. Just because something works or is possible, doesn’t mean that you are doing it correct. 🤷‍♂️ ---
**Author:** ![cuongnh](https://avatars.discourse-cdn.com/v4/letter/c/5f9b8f/32.png) [@cuongnh](https://forum.keycloak.org/u/cuongnh)\ **Post date:** [June 26, 2023, 7:41am UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/16 "2023-06-26T07:41:52Z")
Oh, I understood. U mean our system shouldn’t work directly with the user’s credentials request, just working directly with Keycloak, right? ---
**Author:** ![adropofliquid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/adropofliquid/32/6859_2.png) [@adropofliquid](https://forum.keycloak.org/u/adropofliquid)\ **Post date:** [October 21, 2023, 9:21pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/17 "2023-10-21T21:21:15Z")
Thank you for your response Niko. This is unclear. How do we implement the custom action? can you explain in more details. ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [October 21, 2023, 9:30pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/18 "2023-10-21T21:30:43Z")
> ---
**Author:** ![vished](https://avatars.discourse-cdn.com/v4/letter/v/4bbf92/32.png) [@vished](https://forum.keycloak.org/u/vished)\ **Post date:** [February 21, 2024, 9:47pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/19 "2024-02-21T21:47:25Z")
Can you explain this process? Why should I use to override this class? How does it change the process which has been described here? ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [February 21, 2024, 9:54pm UTC](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/20 "2024-02-21T21:54:16Z")
As of today, you don’t have to override anything anymore, it’s now a feature in Keycloak that you can define a `Password Policy` that sets the max. authentication time a user may be authenticated, before asking for reauthentication again. If set to `0`, the user will always be asked before updating the password. The “why” I already explained in my above comment: [Validate current password before update new password Keycloak using Spring Boot - #13 by dasniko](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757/13) [Next page](https://forum.keycloak.org/t/validate-current-password-before-update-new-password-keycloak-using-spring-boot/20757.md?page=2)