Document password denylists and apply to realm - #345
Open
Wictorgirardi wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows the dashboard changes for p2-inc/dashboard-v2#213.
Why
Two pages were telling customers the wrong thing.
security/password-blacklist.mdsaid "For subscribers of a dedicated cluster, contact support to enable to upload your list", which stopped being true when denylist uploads became self-service. It was quoted in the Slack thread behind #213 as a source of confusion for a customer who was trying to do it themselves.self-service/resources.mddocumented denylists as sharing the extension resource limit and being unavailable on Starter. That is no longer how it works — denylists are uncapped on every tier.What changed
security/password-blacklist.md— replaced the contact-support line with the self-service flow: create a Password Denylist resource, upload a.txt, refresh cluster resources, then apply it to realms. The Keycloak Admin Console steps are kept as an alternative under their own heading, now stating that the file name to enter is the resource name plus.txt.self-service/resources.md— split the tier table so denylists have their own column (unlimited everywhere), removed the "shares the extension resource limit" claim, and corrected the Starter guidance: only Extension is disabled there, not Password Denylist. Added a section on applying a denylist to a realm, documented that a resource namedcommon-passwordsdeploys ascommon-passwords.txt, and noted that a denylist in use cannot be deleted or disabled until it is removed from the realm.getting-started/customizing-ui.md— the Custom Themes section still said to contact support and that dashboard uploads were "coming soon", which contradicts the resources page. Now points at the self-service flow. This one is adjacent rather than strictly part of the denylist work; happy to split it out if you'd rather keep the PR tight.Also corrected the resource-name rule from "lowercase letters, numbers, hyphens, or underscores" to "lowercase letters, numbers, and hyphens" — the backend regex rejects underscores.