diff --git a/packages/auth/README.md b/packages/auth/README.md
index 41364011e92bda5245065e3770b0c22683d24cf9..9ac827e5b287fbd019f25bd7ac0e6c54a4812071 100644
--- a/packages/auth/README.md
+++ b/packages/auth/README.md
@@ -36,6 +36,17 @@ npm i @dbp-toolkit/auth
 - `silent-check-sso-redirect-uri` (optional): URI or path to a separate page for checking the login session in an iframe, see https://www.keycloak.org/docs/latest/securing_apps/#_javascript_adapter
 - `scope` (optional): Space separated list of scopes to request. These scopes get added in addition to the default ones, assuming the scope is in the optional scopes list of the Keycloak client in use.
 
+### Emitted attribute
+
+The component emits a `set-property` event for the attribute `auth`:
+
+- `auth.subject`: Keycloak username
+- `auth.token`: Keycloak token to send with your requests
+- `auth.user-full-name`: Full name of the user
+- `auth.person-id`: Person identifier of the user
+- `auth.person`: Person json object of the user (optional, enable by setting the `load-person` attribute)
+
+
 ## Login Button
 
 ### Usage
diff --git a/packages/auth/src/auth-keycloak.js b/packages/auth/src/auth-keycloak.js
index d7d2c73878ac7c6f6d705b7eca3c51734c82f17d..cb8cedf9f119b3ec5315672dd2caf683357c8496 100644
--- a/packages/auth/src/auth-keycloak.js
+++ b/packages/auth/src/auth-keycloak.js
@@ -10,12 +10,12 @@ import {AdapterLitElement} from "@dbp-toolkit/provider/src/adapter-lit-element";
  * Keycloak auth web component
  * https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter
  *
- * Sets some global variables:
- *   window.DBPAuthSubject: Keycloak username
- *   window.DBPAuthToken: Keycloak token to send with your requests
- *   window.DBPUserFullName: Full name of the user
- *   window.DBPPersonId: Person identifier of the user
- *   window.DBPPerson: Person json object of the user (optional, enable by setting the `load-person` attribute)
+ * Emits a set-property event for the attribute "auth":
+ *   auth.subject: Keycloak username
+ *   auth.token: Keycloak token to send with your requests
+ *   auth.user-full-name: Full name of the user
+ *   auth.person-id: Person identifier of the user
+ *   auth.person: Person json object of the user (optional, enable by setting the `load-person` attribute)
  */
 export class AuthKeycloak extends AdapterLitElement {
     constructor() {
@@ -70,12 +70,6 @@ export class AuthKeycloak extends AdapterLitElement {
             }
             this.personId = personId;
 
-            window.DBPAuthSubject = this.subject;
-            window.DBPAuthToken = this.token;
-            window.DBPUserFullName = this.name;
-            window.DBPPersonId = this.personId;
-            window.DBPPerson = this.person;
-
             this.sendSetPropertyEvents();
             this._setLoginStatus(LoginStatus.LOGGED_IN, tokenChanged || newPerson);
         } else {
@@ -88,12 +82,6 @@ export class AuthKeycloak extends AdapterLitElement {
             this.personId = "";
             this.person = null;
 
-            window.DBPAuthSubject = this.subject;
-            window.DBPAuthToken = this.token;
-            window.DBPUserFullName = this.name;
-            window.DBPPersonId = this.personId;
-            window.DBPPerson = this.person;
-
             this.sendSetPropertyEvents();
             this._setLoginStatus(LoginStatus.LOGGED_OUT);
         }
@@ -116,7 +104,6 @@ export class AuthKeycloak extends AdapterLitElement {
                 .then(response => response.json())
                 .then((person) => {
                     that.person = person;
-                    window.DBPPerson = person;
                     this.sendSetPropertyEvents();
                     this._setLoginStatus(this._loginStatus, true);
                 });