Source:
<code>protected AuthenticationSessionModel createAuthenticationSession(ClientModel client, String requestState) { AuthenticationSessionManager manager = new AuthenticationSessionManager(session); RootAuthenticationSessionModel rootAuthSession = manager.getCurrentRootAuthenticationSession(realm); AuthenticationSessionModel authSession; if (rootAuthSession != null) { authSession = rootAuthSession.createAuthenticationSession(client); logger.debugf("Sent request to authz endpoint. Root authentication session with ID '%s' exists. Client is '%s' . Created new authentication session with tab ID: %s", rootAuthSession.getId(), client.getClientId(), authSession.getTabId()); } else { UserSessionCrossDCManager userSessionCrossDCManager = new UserSessionCrossDCManager(session); UserSessionModel userSession = userSessionCrossDCManager.getUserSessionIfExistsRemotely(manager, realm); if (userSession != null) { UserModel user = userSession.getUser(); if (user != null && !user.isEnabled()) { authSession = createNewAuthenticationSession(manager, client); <START> session.sessions().removeUserSession(realm, userSession); <END> } else { String userSessionId = userSession.getId(); rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(userSessionId, realm); authSession = rootAuthSession.createAuthenticationSession(client); logger.debugf("Sent request to authz endpoint. We don't have root authentication session with ID '%s' but we have userSession." + "Re-created root authentication session with same ID. Client is: %s . New authentication session tab ID: %s", userSessionId, client.getClientId(), authSession.getTabId()); } } else { authSession = createNewAuthenticationSession(manager, client); } } session.getProvider(LoginFormsProvider.class).setAuthenticationSession(authSession); return authSession; }</code><technical_language>@martin-kanis Based discussion keycloak-dev, handle case of disabled user differently case of user registration. I for confusion :) I slightly call "authenticationManager.backchannelLogout" instead of call "removeUserSession" . attempt propagate logout applications identity brokers, is good. Is possible? I accept this PR afterwards</technical_language>

Target:
protected AuthenticationSessionModel createAuthenticationSession(ClientModel client, String requestState) { AuthenticationSessionManager manager = new AuthenticationSessionManager(session); RootAuthenticationSessionModel rootAuthSession = manager.getCurrentRootAuthenticationSession(realm); AuthenticationSessionModel authSession; if (rootAuthSession != null) { authSession = rootAuthSession.createAuthenticationSession(client); logger.debugf("Sent request to authz endpoint. Root authentication session with ID '%s' exists. Client is '%s' . Created new authentication session with tab ID: %s", rootAuthSession.getId(), client.getClientId(), authSession.getTabId()); } else { UserSessionCrossDCManager userSessionCrossDCManager = new UserSessionCrossDCManager(session); UserSessionModel userSession = userSessionCrossDCManager.getUserSessionIfExistsRemotely(manager, realm); if (userSession != null) { UserModel user = userSession.getUser(); if (user != null && !user.isEnabled()) { authSession = createNewAuthenticationSession(manager, client); AuthenticationManager.backchannelLogout(session, userSession, true); } else { String userSessionId = userSession.getId(); rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(userSessionId, realm); authSession = rootAuthSession.createAuthenticationSession(client); logger.debugf("Sent request to authz endpoint. We don't have root authentication session with ID '%s' but we have userSession." + "Re-created root authentication session with same ID. Client is: %s . New authentication session tab ID: %s", userSessionId, client.getClientId(), authSession.getTabId()); } } else { authSession = createNewAuthenticationSession(manager, client); } } session.getProvider(LoginFormsProvider.class).setAuthenticationSession(authSession); return authSession; }