The UPS currently uses an old Keycloak version (1.3.1).

Updating to latest (e.g. 1.6.1) is not just updating the version in the parent pom.

Due to the active coding work in KC, and we are still (unfortunately) building our own WAR, we have to touch a bit of our own code (and configuration).