When integrating RH-SSO with KIE-SERVER, the KIE-SERVER container results with a standalone-openshift.xml configuration that contains the following section:

<subsystem xmlns="urn:jboss:domain:keycloak:1.1"><realm name="kie-realm"><!-- ##KEYCLOAK_PUBLIC_KEY## -><auth-server-url>https://sso-rhsso-sso0.apps-8735.generic.opentlc.com/auth</auth-server-url><register-node-at-startup>true</register-node-at-startup><register-node-period>600</register-node-period><ssl-required>external</ssl-required><disable-trust-manager>true</disable-trust-manager><!- ##KEYCLOAK_TRUSTSTORE## --><allow-any-hostname>false</allow-any-hostname></realm> <secure-deployment name="ROOT.war"><realm>kie-realm</realm><resource>kie-server</resource><auth-server-url>https://sso-rhsso-sso0.apps-8735.generic.opentlc.com/auth</auth-server-url><enable-basic-auth>true</enable-basic-auth><credential name="secret">252793ed-7118-4ca8-8dab-5622fa97d892</credential><enable-cors>false</enable-cors><bearer-only>false</bearer-only></secure-deployment></subsystem>

Note the use of <enable-cors>false</enable-cors>; when connecting a client application that sends a request to the kie-server; some browsers will send an "OPTIONS" request for pre-flight for the security configuration. The `false` value configured here causes that pre-flight to don't include any of the configured web-origins in the "Access-Control-Allow-Origin" Header; thus the CORS fails to fill the pre-flight:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'example://example.ex' is therefore not allowed access.

To delegate the addition of these headers to Red Hat SSO it is required to set <enable-cors>true</enable-cors> in the configuration.