Session Limit Blocks Login #54686

Larkos94 · 2026-11-05T15:06:18Z

Larkos94
Nov 5, 2026

Hello,

i have a application where it is important, that a user can only be loged in over one instance (browser). My problem is that i've configured my browser flow as discribed in the documentation with the "User session count limiter". Saldy when i try to login it instantly tells me my credentials are wrong now. I dont know why so i am asking for help.

Thank you in advance

branislav0 · 2026-11-05T16:29:21Z

branislav0
Nov 5, 2026

This is almost always about where the limiter sits in the flow. The session limiter itself never says "invalid username or password". When it blocks a login, it shows its own error page with the session-limit message (or your custom error message).

My guess is that you added User session count limiter as a REQUIRED step on the top level of your copied browser flow, next to Cookie, Identity Provider Redirector and the forms subflow, which are all ALTERNATIVE. Keycloak doesn't allow mixing the two on the same level. If there's at least one REQUIRED step, all the ALTERNATIVE ones are dropped. The server log shows:

REQUIRED and ALTERNATIVE elements at same level! Those alternative executions will be ignored: [auth-cookie, identity-provider-redirector, ...]

(DefaultAuthenticationFlow.fillListsOfExecutions)

So the flow runs only the limiter. With no user identified yet, it has nothing to count and passes, and the flow ends without any user being logged in. AuthenticationProcessor then throws UNKNOWN_USER, and that's shown as "Invalid username or password". You never get the chance to type your password, which is why it's instant.

Fix: move the limiter into the forms subflow, after Username Password Form, so the user is known when it runs:

Cookie                              ALTERNATIVE
Identity Provider Redirector        ALTERNATIVE
forms (subflow)                     ALTERNATIVE
  ├─ Username Password Form         REQUIRED
  ├─ User session count limiter     REQUIRED
  └─ ... (OTP conditional subflow etc.)

Then open the limiter's settings (gear icon) for "only one browser":

Maximum concurrent sessions for each user: 1
Behavior when user session limit is exceeded: Deny new session (the second browser gets an error) or Terminate oldest session (the new login kicks out the old one)

Also make sure the limiter actually has a config. Without one it fails with "No configuration found of 'User Session Count Limiter' authenticator" in the log.

If your flow already looks like the one above and you still get the error, please post a screenshot of the flow and the server log lines from the login attempt.

0 replies

Navigation Menu

Repository navigation

Session Limit Blocks Login #54686

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Session Limit Blocks Login #54686

Uh oh!

Larkos94 Nov 5, 2026

Replies: 1 comment

Uh oh!

branislav0 Nov 5, 2026

Larkos94
Nov 5, 2026

branislav0
Nov 5, 2026