Repository navigation
what triggers an event : public void onEvent(Event event) : is the LOGOUT fired when token expire? browser closed? session timeout? #48405
|
public class RealmConfigChangeListener implements EventListenerProvider { |
Answered by
zuhairhalawa
Oct 24, 2026
Replies: 2 comments 1 reply
|
It is not fired for:
@Override
public void onEvent(Event event) {
if (event.getType() == EventType.LOGOUT || event.getType() == EventType.USER_SESSION_DELETED) {
// event.getUserId(), event.getSessionId(), event.getDetails().get(Details.REASON)
}
} |
0 replies
Answer selected by
spictera
|
Thanks
Exactly what I was looking for.
…---- Den Sat, 24 Oct 2026 09:42:52 +0200 skrev ***@***.*** ----
onEvent(Event) is called for every user event Keycloak fires, on each listener that is enabled for the realm (Realm settings > Events > Event listeners) or whose factory is global. The "Saved types" setting only controls what goes into the event store; listeners receive every event. Failed attempts arrive with an _ERROR suffix (for example LOGIN_ERROR). Realm and admin changes are delivered to onEvent(AdminEvent, boolean) instead.
LOGOUT is fired when a logout is actually processed: OIDC logout (RP-initiated, or with a refresh token), back-channel logout, SAML logout, signing a session out from the Account Console, or the session-limit authenticator evicting a session.
It is not fired for:
Access token expiry. Nothing happens on the server at that point.
The browser being closed. Keycloak isn't told, and the SSO session stays until it times out.
SSO session idle or max timeout. Since 26.5.0 an expired session produces a separate USER_SESSION_DELETED event with details.reason = user_session_expired. The 26.5.0 release notes say it is published roughly 3-10 minutes after expiry, and it isn't persisted by default, but listeners still receive it.
An admin deleting a session through the Admin API. That produces an admin event (resource type USER_SESSION), not LOGOUT.
@OverRide
public void onEvent(Event event) {
if (event.getType() == EventType.LOGOUT || event.getType() == EventType.USER_SESSION_DELETED) {
// event.getUserId(), event.getSessionId(), event.getDetails().get(Details.REASON)
}
}
—
Reply to this email directly, #48405?email_source=notifications&email_token=AQUO5BYCHLFEQYG4QVYGDU35VRMPZA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOJRGYYDOOJYUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-19160798 , or https://github.com/notifications/unsubscribe-auth/AQUO5B6762JWIBIR43CGYQT5VRMPZAVCNFSNUABGKJSXA33TNF2G64TZHMYTCMJSGU2TQOJ3IRUXGY3VONZWS33OHM4TSMZWGI4TNILWAI .
You are receiving this because you authored the thread.
|
1 reply
|
Glad that helped. If it answers your question, could you mark it as the answer? That makes it easy for others with the same question to find it. Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
onEvent(Event)is called for every user event Keycloak fires, on each listener that is enabled for the realm (Realm settings > Events > Event listeners) or whose factory is global. The "Saved types" setting only controls what goes into the event store; listeners receive every event. Failed attempts arrive with an_ERRORsuffix (for exampleLOGIN_ERROR). Realm and admin changes are delivered toonEvent(AdminEvent, boolean)instead.LOGOUTis fired when a logout is actually processed: OIDC logout (RP-initiated, or with a refresh token), back-channel logout, SAML logout, signing a session out from the Account Console, or the session-limit authenticator evicting a session.It is not fired for: