[ENVIRONMENT]

• JBoss EAP 8.0.7
• registry.redhat.io/jboss-eap-8/eap8-openjdk17-builder-openshift-rhel8
• Galleon Layers
• s2i

[SUMMARY]
The Galleon Layer cloud-default-config is adding the script /opt/eap/bin/launch/keycloak.sh in the container image with commands referencing the incorrect module name of the Keycloak SAML adapter.
In EAP 8.0.7, the right name is:

              <custom-realm name="KeycloakSAMLRealm" module="org.keycloak.keycloak-saml-wildfly-elytron-jakarta-adapter" class-name="org.keycloak.adapters.saml.elytron.KeycloakSecurityRealm"/>                                           

In /opt/eap/bin/launch/keycloak.sh we have:

$ podman run --rm localhost/eap8 grep org.keycloak.keycloak-saml-wildfly-elytron-adapter /opt/eap/bin/launch/keycloak.sh

    /subsystem=elytron/custom-realm=KeycloakSAMLRealm-$id:add(class-name=org.keycloak.adapters.saml.elytron.KeycloakSecurityRealm, module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)
    /subsystem=elytron/service-loader-http-server-mechanism-factory=keycloak-saml-http-server-mechanism-factory-$id:add(module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)

If only using the layer keycloak-client-saml without the cloud-default-config, no /opt/eap/bin/launch/keycloak.sh is added, this is why I suspect the cloud-default-config is the issue.

Customer reports this was working on EAP 8.0.6, so I believe Keycloak SAML adapter has renamed the module from org.keycloak.keycloak-saml-wildfly-elytron-adapter to org.keycloak.keycloak-saml-wildfly-elytron-jakarta-adapter

[HOW TO REPRODUCE]

• via Dockerfile

  $ cat Dockerfile 
  FROM registry.redhat.io/jboss-eap-8/eap8-openjdk17-builder-openshift-rhel8 AS builder
  
  ENV GALLEON_PROVISION_FEATURE_PACKS org.jboss.eap:wildfly-ee-galleon-pack,org.jboss.eap.cloud:eap-cloud-galleon-pack,org.keycloak:keycloak-saml-adapter-galleon-pack
  
  ENV GALLEON_PROVISION_LAYERS cloud-default-config,keycloak-client-saml
  
  ENV GALLEON_PROVISION_CHANNELS org.jboss.eap.channels:eap-8.0
  
  RUN /usr/local/s2i/assemble
  
  $ podman build -t eap8 -f Dockerfile 
  
  $  podman run --rm localhost/eap8 grep org.keycloak.keycloak-saml-wildfly-elytron-adapter /opt/eap/bin/launch/keycloak.sh
  
      /subsystem=elytron/custom-realm=KeycloakSAMLRealm-$id:add(class-name=org.keycloak.adapters.saml.elytron.KeycloakSecurityRealm, module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)
      /subsystem=elytron/service-loader-http-server-mechanism-factory=keycloak-saml-http-server-mechanism-factory-$id:add(module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)