Setup Elytron with Keycloak using the new OIDC subsystem and register the secure deployment using the standalone.xml file (instead of WEB-INF/json).  For reference, here is a piece of concern with the standalone.xml:   <subsystem xmlns="urn:wildfly:elytron-oidc-client:1.0"> <provider name="keycloak"> <provider-url> http://localhost:8081/auth/realms/test-realm </provider-url> <ssl-required>external</ssl-required> <enable-cors>true</enable-cors> </provider> <secure-deployment name="myapp.war"> <provider>keycloak</provider> <client-id>myapp</client-id> <credential name="secret" secret="test-secret"/> </secure-deployment>

There are a few different ways to work around the problem: 1) Use auth-server-url and realm instead of provider . OR 2) Move the provider configuration into the secure-deployment configuration, e.g., <subsystem xmlns= "urn:wildfly:elytron-oidc-client:1.0" > <secure-deployment name= "myapp.war" > <provider-url>http: //localhost:8081/auth/realms/test-realm</provider-url> <ssl-required>external</ssl-required> <enable-cors> true </enable-cors> <client-id>myapp</client-id> <credential name= "secret" secret= "test-secret" /> </secure-deployment> OR 3) Instead of adding configuration in the elytron-oidc-client subsystem, an oidc.json file can be included with the deployment instead (for example, see https://wildfly-security.github.io/wildfly-elytron/blog/securing-wildfly-apps-openid-connect/ ).