When a use the default package mechanism of Apache Maven, the final name of the WAR inside the EAR uses this pattern ${artifactId}-${version}.war, so, we need to change that. one way to do that is to configure the maven-ear-plugin to change the final name to ${artifactId}.war like the above example:

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-ear-plugin</artifactId>
<version>2.10.1</version>
<configuration>
<modules>
<webModule>
<groupId>com.redhat.asouza.demo</groupId>
<artifactId>keycloak-demo-web</artifactId>
<contextRoot>/keycloak-demo-web</contextRoot>
<bundleFileName>keycloak-demo-web.war</bundleFileName>
</webModule>
</modules>
<version>6</version>
<defaultLibBundleDir>lib</defaultLibBundleDir>
</configuration>
</plugin>

I create and attached a reproducer of the issue. Here is the steps:

• Create a user with demo role in RH-SSO
• Create a client in RH-SSO
  • Client ID: keycloak-demo-web
  • Root URL: http://localhost:8080/keycloak-demo-web/
• Configure the secure-deployment in the keycloak subsystem of your JBoss EAP 6.4 standalone file
• Unzip the reproducer
• $ cd keycloak-demo
• $ mvn clean package
• Deploy the EAR in a JBoss
• Access http://localhost:8080/keycloak-demo-web/
• BASIC authetication dialog will show, so the then keycloak conf did not work.

if you uncomment the maven-ear-plugin in keycloak-demo/keycloak-demo-ear/pom.xml file, the example works fine