Use inclusive terminology in docs (blacklist/whitelist -> denylist/allowlist) - #51453
Open
adityaanikam wants to merge 1 commit into
Open
Use inclusive terminology in docs (blacklist/whitelist -> denylist/allowlist)#51453adityaanikam wants to merge 1 commit into
adityaanikam wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates user-facing documentation to use inclusive denylist/allowlist terminology while retaining compatibility-sensitive identifiers.
Changes:
- Revises password policy terminology.
- Updates client registration and Kerberos allowlist wording.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
password-policies.adoc |
Updates password denylist documentation. |
client-registration.adoc |
Replaces whitelist terminology. |
kerberos.adoc |
Uses allowlist terminology for trusted hosts. |
Suppressed comments (1)
docs/documentation/server_admin/topics/authentication/password-policies.adoc:142
- The nested CLI instruction on line 144 still says “blacklist folder.” That phrase is user-facing prose rather than an immutable identifier, so leaving it unchanged makes this terminology update incomplete.
* Denylist files resolve against `+${kc.home.dir}/data/password-blacklists/+` by default. Customize this path using:
Comment on lines
+136
to
+137
| ===== Password denylist | ||
| Password must not be in a denylist file. |
|
|
||
| * Client Scope Policy - Allow to whitelist `Client Scopes`, which can be used with newly registered or updated clients. | ||
| There are no whitelisted scopes by default; only the client scopes, which are defined as `Realm Default Client Scopes` are whitelisted by default. | ||
| * Client Scope Policy - Allow to allowlist `Client Scopes`, which can be used with newly registered or updated clients. |
…lowlist) Fixes keycloak#51435 Signed-off-by: adityaanikam <adityanikam9502@gmail.com>
adityaanikam
force-pushed
the
inclusive-terminology-51435
branch
from
August 5, 2026 14:48
74abc40 to
1b10e04
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (2)
docs/guides/securing-apps/client-registration.adoc:228
- This still describes the defaults inaccurately:
allow-default-scopesdefaults to true and permits both realm default and realm optional client scopes (seeClientScopesClientRegistrationPolicy.java:128-132). Distinguish the empty explicit allowlist from the scopes that are implicitly allowed.
There are no allowlisted scopes by default; only the client scopes, which are defined as `Realm Default Client Scopes` are allowlisted by default.
docs/documentation/server_admin/topics/authentication/password-policies.adoc:144
- The sample value
blacklistsFolderis not a compatibility-sensitive identifier, so it unnecessarily retains the excluded terminology despite this PR's stated documentation update. Rename only this arbitrary path value while preserving the real property and CLI flag names.
** The `blacklistsPath` property of the `passwordBlacklist` policy SPI configuration. To configure the denylist folder using the CLI, use `+--spi-password-policy--password-blacklist--blacklists-path=/path/to/blacklistsFolder+`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts inclusive terminology (denylist/allowlist) in place of blacklist/whitelist in user facing documentation prose, per
Closes #51435
Files changed
docs/documentation/server_admin/topics/authentication/kerberos.adocdocs/documentation/server_admin/topics/authentication/password-policies.adocdocs/guides/securing-apps/client-registration.adocNote:
password-policies.adocalready used "denylist" in its "Pre computing the Bloom filter" section (thebuild-password-denylistCLI command). This PR brings the older "Password blacklist" section above it in line with that existing terminology, rather than introducing something new.Deliberately out of scope
blacklistsPath, thepasswordBlacklistSPI id, thekeycloak.password.blacklists.pathsystem property, and all--spi-password-policy--password-blacklist--*CLI flags. Renaming these would be a breaking change for existing deployments and needs its own deprecation path.password-blacklistsfolder path (${kc.home.dir}/data/password-blacklists/), for the same reason.docs/tests.md's--auth-server-whitelistflag - this is a Google Chrome command-line flag name, not Keycloak's own terminology, so changing it would make the doc inaccurate.docs/documentation/release_notes/topics/26_6_0.adoc- a historical release note, left as a record of what shipped at the time.Fixes #51435