Repository navigation
User session limit generates fatal error #48040
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
No response
Describe the bug
UserSessionLimitsAuthenticator implicitly assumes that whenever the realm session limit is exceeded, all client session limits are also exceeded.
Introduced by #38016
Version
26.5.6
Regression
- The issue is a regression
Expected behavior
UserSessionLimitsAuthenticator should correctly handle cases where a user exceeds the realm session limit without exceeding all client session limits, and must do so without causing a runtime error.
As a possible solution, when the realm limit is exceeded but some client limits are not, the system could purge the oldest user sessions across all clients, rather than restricting the cleanup to sessions of the current client.
Actual behavior
When a user exceeds the realm session limit but has not exceeded the session limit for a specific client, attempting to log in to that client results in a runtime error.
How to Reproduce?
Steps to reproduce:
- Create a realm with two clients, A and B.
- Configure an authentication flow with identical session limits applied at both the realm and client levels.
- Log in repeatedly to client A until both the realm session limit and client A’s session limit are exceeded for a specific user.
- Attempt to log in to client B using the same user.
Actual result:
The login attempt fails with an internal server error.
Anything else?
Relevant code (UserSessionLimitsAuthenticator.java)
if (newUserSession && exceedsLimit(userSessionCountForRealm, userRealmLimit)) {
logger.infof("Too many session in this realm for the current user. Session count: %s", userSessionCountForRealm);
String eventDetails = String.format("Realm session limit exceeded. Realm: %s, Realm limit: %s. Session count: %s, User id: %s",
context.getRealm().getName(), userRealmLimit, userSessionCountForRealm, context.getUser().getId());
var removedClientSessions = handleLimitExceeded(context, userSessionsForClient, eventDetails, userClientLimit);
When the realm limit is exceeded, the implementation attempts to purge sessions based on the current client’s limit first.
private long getNumberOfSessionsThatNeedToBeLoggedOut(long count, long limit) {
return count - (limit - 1);
}
This method is used to determine how many sessions should be removed for the current client. However, it returns a negative value when the client limit has not been exceeded.
List<UserSessionModel> userSessionsToBeRemoved = userSessions
.stream()
.sorted(Comparator.comparingInt(UserSessionModel::getLastSessionRefresh))
.limit(numberOfSessionsThatNeedToBeLoggedOut)
.toList();
A negative number as argument to limit() produces an runtime exception which leads to the internal server error.
Activity
[-]User session limit generates fatal error . Introduced by #38016[/-][+]User session limit generates fatal error[/+]keycloak-github-bot commentedon Apr 14, 2026
Due to the amount of issues reported by the community we are not able to prioritise resolving this issue at the moment.
If you are affected by this issue, upvote it by adding a 👍 to the description. We would also welcome a contribution to fix the issue.
12 remaining items
when the realm session limit is exceeded and behavior is set to Termi… (
when the realm session limit is exceeded and behavior is set to Termi…
when the realm session limit is exceeded and behavior is set to Termi… (