Currently the user federation instances are not maintained by the Keycloak session so they're not always closed. This is not strictly a bug as it was intended to be like this. We'll probably improve this in the future and have instances managed by the Keycloak session so there's only one per session/request and it's closed when the session is closed. We're currently discussing how to do this. In the mean time enlistForClose should work.