Problem
When an administrator resets a user’s password, for example for a student, and enables the option “User must change password at next login”, Keycloak displays the following message during the next login attempt:
The password has expired and must be changed.
However, when the user attempts to set a new password, the operation fails with:
Update password failed
The user is then prompted to change the password again and cannot complete the login.
Investigation
Keycloak requires the App Center setting keycloak/password/change/endpoint to forward password changes to the UCS server.
Check the current setting on the UCS system:
univention-app configure --list keycloak | grep '^keycloak/password/change/endpoint'
The output may look similar to this:
Falling back to initial value for keycloak/password/change/endpoint
keycloak/password/change/endpoint: 'dc01.example.com'
The message Falling back to initial value indicates that App Center is displaying the default value defined in the application settings. However, this default value may not have been applied to the Keycloak container configuration.
Open a shell in the Keycloak container:
univention-app shell keycloak
Check whether the setting is present in the container’s Univention Configuration Registry:
grep '^keycloak/password/change/endpoint:' /etc/univention/base.conf
or
env | grep -i endpoint
If the command returns no output, the endpoint is not configured inside the container. As a result, password changes enforced by Keycloak may fail.
Exit the container shell:
exit
Solution
Explicitly set keycloak/password/change/endpoint to the fully qualified domain name (FQDN) of the UCS server.
Determine the server’s FQDN:
hostname -f
Example output:
dc01.example.com
Apply this value to the Keycloak App Center configuration:
univention-app configure keycloak \
--set keycloak/password/change/endpoint=dc01.example.com
Replace dc01.example.com with the FQDN of the UCS server in the affected environment.
After the App Center configuration has completed, verify that the setting is now available inside the Keycloak container:
univention-app shell keycloak
Check the setting:
grep '^keycloak/password/change/endpoint:' /etc/univention/base.conf
The command should return the configured value:
keycloak/password/change/endpoint: dc01.example.com
Exit the container shell:
exit
The affected user should now be able to log in and complete the required password change successfully.
Important: Do not remove this setting with
--unset. App Center may continue to display the default value when runningunivention-app configure --list keycloak, even though the required setting is no longer present inside the Keycloak container.
Bug 59781