Environment variables 'KEYCLOAK_ADMIN' and 'KEYCLOAK_ADMIN_PASSWORD' are deprecated #19

New Issue

2025-02-21T00:32:29Z

cgalo5758 commented

2025-02-21 00:32:29 +00:00

https://github.com/keycloak/keycloak/issues/31229

👍 2

3wordchant commented

2025-03-21 09:21:06 +00:00

Ty for the report @cgalo5758. I remember seeing something about the deprecation in release notes. Do you happen to know if there are 1:1 replacements we can switch to? Or we'd need to change the initial set-up instructions?

cgalo5758 commented

2025-03-30 03:53:02 +00:00

Yes, @3wordchant! We can replace them with KC_BOOTSTRAP_ADMIN_USERNAME and KC_BOOTSTRAP_ADMIN_PASSWORDas described in the (configuration documentation)[https://www.keycloak.org/server/configuration#_creating_the_initial_admin_user]:

Keycloak parses these values at first startup to create an initial user with administrative rights. Once the first user with administrative rights exists, you can use the Admin Console or the command line tool kcadm.[sh|bat] to create additional users.

If the initial administrator already exists and the environment variables are still present at startup, an error message stating the failed creation of the initial administrator is shown in the logs. Keycloak ignores the values and starts up correctly.

The main difference it seems to me is that these credentials are only used at first start and the interface makes it explicit that it is a temporary account.

Yes, @3wordchant! We can replace them with `KC_BOOTSTRAP_ADMIN_USERNAME` and `KC_BOOTSTRAP_ADMIN_PASSWORD`as described in the (configuration documentation)[https://www.keycloak.org/server/configuration#_creating_the_initial_admin_user]: >Keycloak parses these values at first startup to create an initial user with administrative rights. Once the first user with administrative rights exists, you can use the Admin Console or the command line tool `kcadm.[sh|bat]` to create additional users. > >If the initial administrator already exists and the environment variables are still present at startup, an error message stating the failed creation of the initial administrator is shown in the logs. Keycloak ignores the values and starts up correctly. The main difference it seems to me is that these credentials are only used **at first start** and the interface makes it explicit that it is a temporary account.

👀 1

notplants referenced this issue

2026-04-29 15:35:28 +00:00

add_kcadm #28

oxaliq referenced this issue

2026-04-29 22:59:26 +00:00

add_kcadm #28

Sign in to join this conversation.