Emit RISC account-disabled/account-enabled SSF events - #51318

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:143

• The warm-up updates enqueue their pushes asynchronously, so pushes.clear() does not wait for either outbox row to be delivered. A delayed warm-up account-disabled/enabled SET can therefore satisfy a later positive assertion or make either no-push test fail; wait until the warm-up account-enabled SET has actually arrived (or otherwise await an empty outbox) before clearing the queue.

        setUserEnabled(false);
        setUserEnabled(true);
        pushes.clear();

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SecurityEventTokenMapper.java:839

• The permanent-lockout trigger is only covered with a manually constructed Event, so the asynchronous brute-force transaction, listener dispatch, and resulting push are never exercised. Add an integration test that causes a real permanent lockout and asserts an account-disabled SET with the brute-force reason and policy initiator, matching the end-to-end coverage added for the admin trigger.

            case USER_DISABLED_BY_PERMANENT_LOCKOUT ->
                    generateAccountDisabledEvent(event, adminEvent, stream, RiscAccountDisabled.REASON_BRUTE_FORCE);

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/stream/storage/client/ClientStreamStore.java:363

• This WARN runs on every convertible user/admin event and eagerly formats every receiver candidate, creating production log noise and per-event allocation for a temporary CI diagnostic. Remove it before merging (or move targeted diagnostics behind a debug/rate-limited guard).

        log.warnf("SSF-DIAG findStreamsForSsfReceiverClients: realm=%s(%s) rawCandidates=%s",

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:150

• These ignored poll results make the exact first-event loss described above an accepted outcome: after priming, every test can pass even though a newly created production stream drops its first event. The first delivery should remain asserted and the lookup race should be fixed rather than hidden by warm-up traffic.

        setUserEnabled(false);
        pushes.poll(PUSH_WAIT_SECONDS, TimeUnit.SECONDS);
        setUserEnabled(true);
        pushes.poll(PUSH_WAIT_SECONDS, TimeUnit.SECONDS);

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SecurityEventTokenMapper.java:702

• The brute-force path is covered only by constructing this event directly in the mapper unit test; no SSF integration test triggers DefaultBruteForceProtector and verifies delivery. Add an end-to-end permanent-lockout case asserting account-disabled, disabled-by-bruteforce, and POLICY so the producer/listener boundary is covered like the admin path.

            case USER_DISABLED_BY_PERMANENT_LOCKOUT -> true;

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:150

• This warm-up hides the actual delivery defect: when the first post-creation lookup returns no streams, the account-state event is dropped without retry, and consuming an unasserted throwaway transition merely lets the test pass. Fix or explicitly synchronize stream visibility before exercising delivery, then remove this discard cycle so the test verifies the first real event—the behavior production callers receive.

        setUserEnabled(false);
        pushes.poll(PUSH_WAIT_SECONDS, TimeUnit.SECONDS);
        setUserEnabled(true);
        pushes.poll(PUSH_WAIT_SECONDS, TimeUnit.SECONDS);

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/stream/storage/client/ClientStreamStore.java:363

• This temporary diagnostic materializes every matching receiver, builds identifiers/configuration strings, and emits them at WARN on every mapped SSF event. Remove it before merging; otherwise routine event delivery creates noisy logs and avoidable per-event allocation while exposing receiver and stream identifiers.

        // TEMPORARY DIAGNOSTIC — investigating an intermittent CI failure where
        // this returns empty for a client whose stream was just created
        // (keycloak/keycloak#51318). Remove once root-caused.
        List<ClientModel> rawCandidates = session.clients()
                .searchClientsByAttributes(realm, attributes, null, null)
                .toList();
        log.warnf("SSF-DIAG findStreamsForSsfReceiverClients: realm=%s(%s) rawCandidates=%s",
                realm.getName(), realm.getId(),
                rawCandidates.stream()
                        .map(c -> c.getClientId() + "[enabled=" + c.isEnabled()
                                + ",ssf.enabled=" + c.getAttribute(SSF_ENABLED_KEY)
                                + ",streamId=" + c.getAttribute(SSF_STREAM_ID_KEY) + "]")
                        .toList());
        return rawCandidates.stream()

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SsfTransmitterEventListener.java:323

• The unconditional WARN records every admin event before filtering and serializes its full details map, causing log flooding and unnecessary exposure of admin-event metadata in normal production traffic. Remove the temporary SSF-DIAG instrumentation (including the other added WARN branches in this method), or keep narrowly needed diagnostics behind DEBUG/TRACE without dumping details.

        log.warnf("SSF-DIAG onEvent: canConvert=%s id=%s operationType=%s resourceType=%s resourcePath=%s details=%s",
                canConvert, adminEvent.getId(), adminEvent.getOperationType(), adminEvent.getResourceType(),
                adminEvent.getResourcePath(), adminEvent.getDetails());

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SsfTransmitterEventListener.java:324

• This unconditional WARN executes for every admin event in an SSF-enabled realm, including ordinary non-convertible updates, and serializes the full details map into production logs. Remove this temporary diagnostic and keep the predicate as the original direct guard.

        boolean canConvert = transmitter.securityEventTokenMapper().canConvert(adminEvent);
        log.warnf("SSF-DIAG onEvent: canConvert=%s id=%s operationType=%s resourceType=%s resourcePath=%s details=%s",
                canConvert, adminEvent.getId(), adminEvent.getOperationType(), adminEvent.getResourceType(),
                adminEvent.getResourcePath(), adminEvent.getDetails());

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:137

• This warm-up deliberately discards the first post-stream-creation events, so the integration tests can pass while the exact production workflow under test loses its first account-state notification. Fix the stream-visibility race and assert delivery of the first transition instead of priming around it.

        // Observed in CI: the very first admin-event-triggered SSF lookup
        // (StreamService.findStreamsForSsfReceiverClients, via the admin-event
        // path) against a freshly started per-class test server can transiently
        // see no streams — likely a client-attribute-search cache/index warm-up
        // race, since every subsequent call in the same server instance (i.e.

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/stream/storage/client/ClientStreamStore.java:363

• This path runs for every mappable SSF event, so eagerly materializing all receiver clients and logging their IDs/configuration at WARN will create persistent log noise and allocation overhead in production. Remove the temporary diagnostic before merging.

        // TEMPORARY DIAGNOSTIC — investigating an intermittent CI failure where
        // this returns empty for a client whose stream was just created
        // (keycloak/keycloak#51318). Remove once root-caused.
        List<ClientModel> rawCandidates = session.clients()
                .searchClientsByAttributes(realm, attributes, null, null)

ssf/core/src/main/java/org/keycloak/ssf/event/risc/RiscAccountDisabled.java:20

• RISC 1.0 §2.3 restricts reason to hijacking or bulk-account; unlike CAEP credential_type, it does not permit mutually agreed extension values. Emitting disabled-by-admin/disabled-by-bruteforce therefore makes these advertised RISC events non-conformant—omit reason for these causes or carry them in a namespaced extension field, and reserve reason for the standard values.

     * RISC enumerates {@code hijacking} and {@code bulk-account} as reasons. Keycloak
     * additionally emits reasons describing its own native disablement triggers
     * (administrator action, brute-force lockout, ...) that aren't part of the spec's
     * list — mirroring how {@link org.keycloak.ssf.event.caep.CaepCredentialChange#getCredentialType()}
     * accepts values beyond its documented set. Receivers that don't recognize a given

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:231

• rep.getAttributes() can be null on some ClientRepresentation instances, which would cause a NullPointerException in the test setup/cleanup. Initialize the attributes map when it is null before calling put(...) (e.g., set an empty map on the representation first).

    protected void setEmitOnlyEvents(String... eventTypes) {
        ClientResource clientResource = realm.admin().clients().get(findClientByClientId(RECEIVER).getId());
        ClientRepresentation rep = clientResource.toRepresentation();
        rep.getAttributes().put(ClientStreamStore.SSF_EMIT_ONLY_EVENTS_KEY, String.join(",", eventTypes));
        clientResource.update(rep);
    }

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SsfTransmitterEventListener.java:383

• This log line is on the admin-event path but says “Skipping native auto-emit”, which is misleading (it’s not a native/user-event trigger). Consider changing the message to a neutral “Skipping auto-emit …” (or “Skipping admin-event auto-emit …”) so logs correctly reflect the path being executed.

            if (isAnyEventEmitOnlyForReceiver(securityEventToken, stream)) {
                log.debugf("Skipping native auto-emit — event type is in receiver's emitOnlyEvents set. "
                                + "streamId=%s clientId=%s jti=%s",
                        stream.getStreamId(), stream.getClientClientId(), securityEventToken.getJti());
                continue;
            }

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SecurityEventTokenMapper.java:333

• When token generation fails, the error log lacks key context that would help diagnosis (at least userId, streamId/client id, and reason). Include those fields in the log message so operators can identify the failing event without needing to reproduce with debug logging.

    public SsfSecurityEventToken generateAccountDisabledEvent(Event userEvent, AdminEvent adminEvent, StreamConfig stream, String reason) {
        try {
            String userId = userEvent.getUserId();

ssf/transmitter/src/main/java/org/keycloak/ssf/transmitter/event/SecurityEventTokenMapper.java:353

• When token generation fails, the error log lacks key context that would help diagnosis (at least userId, streamId/client id, and reason). Include those fields in the log message so operators can identify the failing event without needing to reproduce with debug logging.

        } catch (Exception e) {
            log.error("Error generating account disabled event", e);
            return null;
        }
    }

ssf/transmitter/src/test/java/org/keycloak/ssf/transmitter/event/SecurityEventTokenMapperTest.java:151

• These unit tests construct the mapper with a null session and rely on StreamConfig defaults to keep subject resolution on the iss_sub path. To avoid future flakiness if StreamConfig defaults change, explicitly configure the StreamConfig to use the intended subject/lookup behavior for these tests (so the tests remain session-independent by construction).

    private StreamConfig streamConfig() {
        return new StreamConfig();
    }

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:87

• The polling timeouts look tight for potentially slow CI or heavily loaded test environments (especially considering async drain interval + HTTP server scheduling). To reduce test flakiness, consider increasing these waits (or making them proportional to the configured outbox drainer interval) so intermittent delays don’t produce false negatives.

    static final long PUSH_WAIT_SECONDS = 5;
    static final long NO_PUSH_WAIT_SECONDS = 3;

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:148

• The polling timeouts look tight for potentially slow CI or heavily loaded test environments (especially considering async drain interval + HTTP server scheduling). To reduce test flakiness, consider increasing these waits (or making them proportional to the configured outbox drainer interval) so intermittent delays don’t produce false negatives.

        String push = pushes.poll(PUSH_WAIT_SECONDS, TimeUnit.SECONDS);

ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterAccountStateEventTests.java:188

• The polling timeouts look tight for potentially slow CI or heavily loaded test environments (especially considering async drain interval + HTTP server scheduling). To reduce test flakiness, consider increasing these waits (or making them proportional to the configured outbox drainer interval) so intermittent delays don’t produce false negatives.

        Assertions.assertNull(pushes.poll(NO_PUSH_WAIT_SECONDS, TimeUnit.SECONDS),
                "a profile update that leaves 'enabled' untouched must not produce an account-state SET");