Algorithm/encryption used in secret_data for otp

1

Hi peoples,

I am trying to migrate existing OTP code from my database into keycloak. Currently the key stored in my database does not have any encryption or encoding applied, however in Keycloak, I noticed that the OTP key is in a different format looking at the secret_data column of the CREDENTIAL table, for example: {“value”: “1wLkKThhSxoirVo08MCT”}

Can anyone tell what algorithm is used to populate in this field? I tried to convert my string to base64 but without success.

Thanks for your help

1 Like
2

https://lists.jboss.org/pipermail/keycloak-dev/2017-July/009686.html

1wLkKThhSxoirVo08MCT is random string stored in DB. Convert it to bytes first and encode it with BASE32.

import base64
base64.b32encode(str.encode(“1wLkKThhSxoirVo08MCT”))
b’GF3UY22LKRUGQU3YN5UXEVTPGA4E2Q2U’

GF3UY22LKRUGQU3YN5UXEVTPGA4E2Q2U is the secret string that you can use to configure your OTP apps