Package org.keycloak.policy

Class BlacklistPasswordPolicyProviderFactory

  • All Implemented Interfaces:
    PasswordPolicyProviderFactory, ProviderFactory<PasswordPolicyProvider>
    public class BlacklistPasswordPolicyProviderFactory
extends Object
implements PasswordPolicyProviderFactory
    Creates BlacklistPasswordPolicyProvider instances.

    Password blacklists are simple text files where every line is a blacklisted password delimited by a newline character \n.

    Blacklists can be configured via the Authentication: Password Policy section in the admin-console. A blacklist-file is referred to by its name in the policy configuration.

    Blacklist location

    Users can provide custom blacklists by adding a blacklist password file to the configured blacklist folder.

    The location of the password-blacklists folder is derived as follows

    1. the value of the System property keycloak.password.blacklists.path if configured - fails if folder is missing
    2. the value of the SPI config property: blacklistsPath when explicitly configured - fails if folder is missing
    3. otherwise $KC_HOME/data/password-blacklists/ if nothing else is configured
    To configure the blacklist folder via CLI use --spi-password-policy-password-blacklist-blacklists-path=/path/to/blacklistsFolder

    Note that the preferred way for configuration is to copy the password file to the $KC_HOME/data/password-blacklists/ folder

    A password blacklist with the filename 10_million_passwords.txt that is located beneath $KC_HOME/data/keycloak/blacklists/ can be referred to as 10_million_passwords.txt in the Authentication: Password Policy configuration.

    False positives

    The current implementation uses a probabilistic data-structure called BloomFilter which allows for fast and memory efficient containment checks, e.g. whether a given password is contained in a blacklist, with the possibility for false positives. By default a false positive probability DEFAULT_FALSE_POSITIVE_PROBABILITY is used. To change the false positive probability via CLI configuration use --spi-password-policy-password-blacklist-false-positive-probability=0.00001

    Author:
    Thomas Darimont