Skip to content
d-centralize handbook

Keycloak admin routines

Recurring Keycloak operations on the d-centralize realm. These run through the onboarding-sync service account, so a checkout of dc scripts handles authentication for you (the client secret is pulled from Bitwarden).

Reactivate an account

Section titled “Reactivate an account”

Use this when a user cannot log in and has no working temporary password: they never received one, the one they have doesn’t work, or their account never had one set. It sets a fresh temporary password and emails it to the user’s private inbox (Bitwarden private contact info / <localpart>) with onboarding/sync_users.py:

Terminal window
# preview — prints the user to reactivate, sends nothing
uv run onboarding/sync_users.py --only <localpart> --service keycloak --resend-temp-password


# send it
uv run onboarding/sync_users.py --only <localpart> --service keycloak --resend-temp-password --apply

The user signs in at the account console with the temporary password, then sets their own password and enrols 2FA. The mail goes to the private inbox, so it reaches the user before they can read their <localpart>@d-centralize.nl mailbox.