When Keycloak’s Event Store Runs on Defaults Without `enabled_event_types`

Keycloak 26.7.4 + keycloak provider v5.9.0, enabled_event_types omitted ("Omitting this field enables all event types"): the event store kept LOGIN, not REFRESH_TOKEN; the log listener got both.

When It Runs — Run Report #RR07_ ·_ Testing what infrastructure actually does.

Provider · Component: Keycloak · realm user-event storage (the event store) — what gets saved when user events are turned on through the keycloak organization's IaC provider (keycloak_realm_events) with enabled_event_types left out Versions tested: measured — Keycloak 26.7.4 with the keycloak provider v5.9.0 (keycloak/terraform-provider-keycloak; both the latest release as of 2026-09-26; Keycloak 26.7.5, 26.8.0 and 26.8.1, released on 2026-09-30, 2026-10-01 and 2026-10-13, and provider v5.10.0, released on 2026-10-05, were not measured; a single version pair), applied with OpenTofu 1.12.6. source-read — the Keycloak 26.7.4 and provider v5.9.0 tags. Config profile: the official image quay.io/keycloak/keycloak:26.7.4 (digest-pinned) in start-dev mode on a dedicated test VM, with the event listener's log category at debug; through OpenTofu, two realms with keycloak_realm_events (events_enabled = true, events_listeners = ["jboss-logging"]) — enabled_event_types left out in rr07, set to four types in the comparison realm rr07-explicit; in each realm a public client with direct access grants and one user; a successful and a failed password grant, then a successful and a failed refresh-token grant. Verified on: 2026-10-13 (desk sources re-checked; Keycloak 26.8.1 and provider v5.10.0 were the latest releases) · lab measured 2026-09-27 on Keycloak 26.7.4 with provider v5.9.0. Affects: Keycloak 26.7.4 realms whose user-event saving is turned on through the keycloak provider v5.9.0 keycloak_realm_events resource with enabled_event_types left out: the event store keeps only Keycloak's default saved types, so REFRESH_TOKEN and REFRESH_TOKEN_ERROR are not saved (checked 5 and 120 seconds after the requests). Event listeners, such as the jboss-logging log listener, still receive those events. TL;DR: With Keycloak 26.7.4 and the keycloak provider v5.9.0, turning on realm events without enabled_event_types, which the provider documents as "Omitting this field enables all event types," saved LOGIN and LOGIN_ERROR to the event store but not REFRESH_TOKEN or REFRESH_TOKEN_ERROR, which reached only the log listener.

Full report: https://whenitruns.substack.com/p/when-keycloaks-event-store-runs-on

Reproduction repo: https://github.com/whenitruns/when-keycloaks-event-store-runs-on-defaults-without-enabled-event-types