We have a WildFly instance setup with KeyCloak protecting console/management interface.
 
In menu 'Runtime > Log files' there is 2 places to download those. In context menu of the log entry or in toolbar of log entry viewer.
 
Both options can't download log file because no bearer token is send in request. Download request is a simple link html tag like this one: 

<a data-element="download" href="https://server.none.com/management/subsystem/logging/log-file/server.log?operation=attribute&name=stream&useStreamAsResponse" class="btn btn-default clickable" data-toggle="tooltip" data-container="body" data-placement="top" data-animation="false" title="" data-original-title="Download" download="server.log"><i class="fa fa-download"></i></a>

Keycloak steps: https://docs.jboss.org/author/display/WFLY/Protecting%20Wildfly%20Adminstration%20Console%20With%20Keycloak.html