diff --git a/server_admin/topics/authentication/password-policies.adoc b/server_admin/topics/authentication/password-policies.adoc index eafe6a5df2..2659ee543b 100644 --- a/server_admin/topics/authentication/password-policies.adoc +++ b/server_admin/topics/authentication/password-policies.adoc @@ -68,7 +68,7 @@ Not Recently Used:: Password Blacklist:: This policy checks if a given password (converted to lowercase) is contained in a blacklist file, which is potentially a very large file. Password blacklists are UTF-8 plain-text files with Unix line endings where every line represents a blacklisted password. - All passwords in the blacklist must be lowercased to facilitate case-insensitive comparison. + All passwords in the blacklist must be lowercase to facilitate case-insensitive comparison. The file name of the blacklist file must be provided as the password policy value, e.g. `10_million_password_list_top_1000000.txt`. Blacklist files are resolved against `${jboss.server.data.dir}/password-blacklists/` by default. This path can be customized via the `keycloak.password.blacklists.path` system property,