Keycloak supports Backchannel logout URL:
URL that will cause the client to log itself out when a logout request is sent to this realm (via end_session_endpoint). If omitted, no logout request will be sent to the client is this case.
It would be great, if this plugin exposes some endpoint, which accepts payload from Keycloak and logouts immediately some user from all sessions. Otherwise, when we disable user in Keycloak, we must wait maximum session age (which is pretty big by-default)