We have a war application protected with elytron-oidc-client, connected to Keycloak v20 in Wildlfy v26 or v34 

Security is enabled in web.xml as 
<security-constraint>

<web-resource-collection>

<web-resource-name>RS</web-resource-name>

<url-pattern>/api/rest/*</url-pattern>

</web-resource-collection>

<auth-constraint>

<role-name>*</role-name>

</auth-constraint>

</security-constraint>

<security-role>

<role-name>*</role-name>

</security-role>

I try to access application (can try even with non-existent, but on protected path, URL) with GET, POST, PUT, DELETE, PATCH and HEAD methods and provide invalid username or expired token.

All but PATCH methods would return 401 - Unauthorized but PATCH would return 400 - Bad request error.

Expected that PATCH would also return 401 error.