Hi All,
We have a project where a pre-generated user creates a new user on a front-end application. User data is passed to a back-end server that allows Keycloak REST API calls. For the newly created user to be able to update their password upon first login, they must first be created with a temporary password. We must encrypt the password passed between front-end and back-end but how can we send that encrypted password to Keycloak so that the created user can use their plain-text password at login?
EDIT: A few posts online have suggested that it’s okay to pass a plaintext password between frontend and server over an HTTPS connection. But it looks like there’s an aes-generated key under Realm Keys, is this suggesting that we can encrypt the password typed in in the user creation form, encrypt it on frontend, send that to the backend server that sends it to Keycloak through the API?
Our application will not be using an email service.
Thanks in advance!