Enabling Reset Password

To configure this secure reset password workflow the following conditions have to be met within your Keycloak realm:

An SMTP server must be configured via Keycloak to send recovery links. Navigate to Realm Settings in Keycloak and ensure the following:
- Email tab: configure email for your realm. Refer to the Keycloak documentation for details.
- Event>Event listener tab: Set up email as an Event listener. This enables Keycloak to send event notifications to users for password changes.
When provisioning or creating accounts, every user must be created with a valid email address attached. If a user lacks an email address, Keycloak cannot send the recovery token.

Administrators must manually generate a temporary password within the Keycloak console and convey it to the user. If the user fails to complete the password update process fully upon their first visit, they can restart the wizard multiple times using the same temporary credential.

When SMTP is active the workflow becomes secure and token-based:

The Keycloak administrator triggers a manual reset action.
Keycloak generates a time-sensitive, single-use link and emails it to the user's bound email address.
The user clicks the link to set a new password. The usual password policies of your Keycloak instance apply.