Keycloak
Employee accounts are read from Keycloak; active sessions of approved accounts are terminated.
How it works
The connection uses a confidential client in the realm. The service account is given two roles only: view-users to read the account and manage-users to terminate the session.
Whether the permission was granted is read from inside the access token. If it is missing the connection is not treated as verified and the remediation preview produces no targets.
Active sessions are terminated. Offline sessions are not affected; they are designed to be long-lived and are revoked separately.
Limits
Passwords are not changed, accounts are not deleted, roles are not assigned and realm settings are not touched.
Accounts whose identity is managed elsewhere are out of scope; access is cut in the source system.
Tokens are not stored; a new one is fetched for every operation.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.