Hi, I just read about "Password migration using a web hook", and I would like a little more detail. Once the webhook has run and a hashed password is stored in Kratos is this treated as a completed migration (the webhook never runs for that user again)? Alternatively, if the user tries to login using, what Kratos considers an incorrect password, can kratos re-run the web hook to check if this "incorrect" password is in fact correct on the remote authentication system. I.e. the hash in kratos becomes more of a cache rather than a new point of truth, To expand - I am considering customer requests for a system where their reference for auth remains Active Directory, but they want to allow users to login even if AD is unavailable. However they want Updated passwords to still be migrated to Kratos when passwords change. (Dammed customers and their weird requirements).

is this treated as a completed migration (the webhook never runs for that user again)?

yes correct The migration hook either succeeds, stores the supplied password and issues a session, or it fails, which will cause the hook to run again on the next login, but issues no session. What you seem to be looking for are break glass accounts for organizations, which allows members of an organization to use the recovery flow to access their account, even if the IDP is not available.

I am still looking at the password migration flow. The PasswordMigrationResponse is just (effectively) a bool. I was hoping that I could populate the Traits and Metadata of the kratos account with information from AD. Is this not possible because of GDPR or security reasons, or was there just no requirement when the code was written (and thus a pull request might be accepted)?