Migrating Plaintext Password Hints

Last modified 03 Sep 2026 14:32 UTC

Password hints are now stored as protected values instead of plain strings.

Existing repositories can still contain legacy password hints stored in clear text. They remain readable for backward compatibility, but should be migrated to the protected representation.

When This Migration Is Needed

Run this migration if your repository contains users with legacy plaintext password hints.

A legacy hint can be represented like this:

<credentials>
    <password>
        <hint>my first pet</hint>
    </password>
</credentials>

After the schema change, the same value is represented as a ProtectedStringType.

New or modified password hints are encrypted automatically. This migration is intended only for existing plaintext hints.

Migration Task

Use the provided task:

task-migrate-plaintext-password-hints.xml

The task:

  • processes UserType objects,

  • finds password hints that still contain a clear value,

  • rewrites only credentials/password/hint,

  • lets the normal midPoint model processing encrypt the new hint value,

  • skips users without a plaintext hint,

  • skips hints that are already encrypted.

Other protected values on the user are not re-encrypted by this task.

Running the Migration

Import the migration task into midPoint.

The task is imported in the suspended state to prevent it from running automatically.

Review the task and then resume it from the task management interface.

Wait until the task finishes successfully.

The task has single-run recurrence and is intended as a one-time migration.

Verification

After the task finishes, inspect users that previously contained plaintext password hints.

The password hint should still contain the same logical value, but it should now be stored in encrypted form.

Running the migration task again is safe. Users whose hints no longer contain a clear value are skipped.

Backward Compatibility

Legacy plaintext password hints remain readable. This allows existing users to be inspected and modified before the migration is completed.

However, migrating the remaining plaintext hints is recommended so that all password hints use the protected representation.

Was this page helpful?
YES NO
Thanks for your feedback