stianst · May 21, 2026 · May 5, 2026 · May 19, 2026 · May 20, 2026
@@ -11,6 +11,6 @@
  */
 public interface RunOnServer extends Serializable {
 
-    void run(KeycloakSession session) throws IOException, VerificationException;
+    void run(KeycloakSession session) throws IOException, VerificationException, ClassNotFoundException;
 
 }
@@ -5,13 +5,20 @@
 
 import jakarta.ws.rs.NotFoundException;
 
+import org.keycloak.Config;
 import org.keycloak.credential.CredentialModel;
-import org.keycloak.models.KeycloakSession;
+import org.keycloak.events.EventListenerProvider;
+import org.keycloak.events.EventType;
+import org.keycloak.events.email.EmailEventListenerProviderFactory;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.RealmProvider;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.session.UserSessionPersisterProvider;
 import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -77,9 +84,9 @@ public Class getResultClass() {
         };
     }
 
-    public static RunOnServer removeUserSession(String realmName, String sessionId) {
+    public static RunOnServer removeUserSession(String sessionId) {
         return session -> {
-            RealmModel realm = getRealmByName(session, realmName);
+            RealmModel realm = session.getContext().getRealm();
 
             UserSessionModel sessionModel = session.sessions().getUserSession(realm, sessionId);
             if (sessionModel == null) {
@@ -90,21 +97,117 @@ public static RunOnServer removeUserSession(String realmName, String sessionId)
        };
     }
 
-    public static RunOnServer removeUserSessions(String realmName) {
+    public static RunOnServer removeUserSessions() {
         return session -> {
-            RealmModel realm = getRealmByName(session, realmName);
-
+            RealmModel realm = session.getContext().getRealm();
             session.sessions().removeUserSessions(realm);
         };
     }
 
-    private static RealmModel getRealmByName(KeycloakSession session, String realmName) {
-        RealmProvider realmProvider = session.getProvider(RealmProvider.class);
-        RealmModel realm = realmProvider.getRealmByName(realmName);
-        if (realm == null) {
-            throw new NotFoundException("Realm not found");
-        }
-        return realm;
+    public static FetchOnServerWrapper<Integer> getClientSessionsCountInUserSession(String sessionId) {
+        return new FetchOnServerWrapper<>() {
+            @Override
+            public FetchOnServer getRunOnServer() {
+                return session -> {
+                    RealmModel realm = session.getContext().getRealm();
+
+                    UserSessionModel sessionModel = session.sessions().getUserSession(realm, sessionId);
+                    if (sessionModel == null) {
+                        throw new NotFoundException("Session not found");
+                    }
+
+                    // TODO: Might need optimization to prevent loading client sessions from cache
+                    return sessionModel.getAuthenticatedClientSessions().size();
+                };
+            }
+
+            @Override
+            public Class<Integer> getResultClass() {
+                return Integer.class;
+            }
+        };
+    }
+
+    public static RunOnServer removeExpired() {
+        return session -> {
+            RealmModel realm = session.getContext().getRealm();
+
+            session.getProvider(UserSessionPersisterProvider.class).removeExpired(realm);
+            session.realms().removeExpiredClientInitialAccess();
+        };
+    }
+
+    /**
+     * Adds the following types to the email event listener included list.
+     * @param events The events to be included
+     */
+    public static RunOnServer addEventsToEmailEventListenerProvider(List<EventType> events) {
+        return session -> {
+            if (events != null && !events.isEmpty()) {
+                EmailEventListenerProviderFactory prov = (EmailEventListenerProviderFactory) session.getKeycloakSessionFactory()
+                        .getProviderFactory(EventListenerProvider.class, EmailEventListenerProviderFactory.ID);
+                prov.addIncludedEvents(events.toArray(EventType[]::new));
+            }
+        };
+    }
+
+    /**
+     * Removes the following types from the email event listener included list.
+     * @param events The events to be removed
+     */
+    public static RunOnServer removeEventsToEmailEventListenerProvider(List<EventType> events) {
+        return session -> {
+            if (events != null && !events.isEmpty()) {
+                EmailEventListenerProviderFactory prov = (EmailEventListenerProviderFactory) session.getKeycloakSessionFactory()
+                        .getProviderFactory(EventListenerProvider.class, EmailEventListenerProviderFactory.ID);
+                prov.removeIncludedEvents(events.toArray(EventType[]::new));
+            }
+        };
+    }
+
+    public static FetchOnServerWrapper<AccessTokenContext> getTokenContext(String tokenId) {
+        return new FetchOnServerWrapper<>() {
+            @Override
+            public FetchOnServer getRunOnServer() {
+                return session -> session.getProvider(TokenContextEncoderProvider.class).getTokenContextFromTokenId(tokenId);
+            }
+
+            @Override
+            public Class<AccessTokenContext> getResultClass() {
+                return AccessTokenContext.class;
+            }
+        };
+    }
+
+    /**
+     * If property-value is null, the system property will be unset (removed) on the server
+     */
+    public static RunOnServer setSystemPropertyOnServer(String propertyName, String propertyValue) {
+        return session -> {
+            if (propertyValue == null) {
+                System.getProperties().remove(propertyName);
+            } else {
+                System.setProperty(propertyName, propertyValue);
+            }
+        };
+    }
+
+    /**
+     * Re-initialize specified provider factory with system properties scope. This will allow to change providerConfig in runtime with {@link #setSystemPropertyOnServer}
+     * <p>
+     * This works just for the provider factories, which can be re-initialized without any side-effects (EG. some functionality already dependent
+     * on the previously initialized properties, which cannot be easily changed in runtime)
+     *
+     * @param providerType           fully qualified class name of provider (subclass of org.keycloak.provider.Provider)
+     * @param providerId             provider Id
+     * @param systemPropertiesPrefix prefix to be used for system properties
+     */
+    public static RunOnServer reinitializeProviderFactoryWithSystemPropertiesScope(String providerType, String providerId, String systemPropertiesPrefix) {
+        return session -> {
+            Class<? extends Provider> providerClass = (Class<? extends Provider>) Class.forName(providerType);
+            ProviderFactory<?> factory = session.getKeycloakSessionFactory().getProviderFactory(providerClass, providerId);
+            factory.init(new Config.SystemPropertiesScope(systemPropertiesPrefix));
+        };
     }
 
 }