[Hawkular-dev] Token errors with WebSockets and other backend calls

All, I've seen some problems lately that are hard to debug and may cause you to waste valuable time. In short, if you face "strange" issues related to authentication, specially when trying features that make use of WebSockets (ie: add deployment), make sure you are accessing the web UI via 127.0.0.1 , and not localhost . In case you are interested in the details, keep reading. Upon login, Keycloak issues a token for the client, taking the auth server host into consideration (as the "issuer authority"). If you use localhost, then that's the hostname that Keycloak will use inside the token. This value is later used to validate the incoming token. Ideally, all the hostnames would be a match, and that's usually the case if you use the "-b" switch when starting Wildfly. But if you don't specify, we fall back to 127.0.0.1 [1] , causing the "backend call" to be 127.0.0.1, while the "frontend call" came via localhost. I have a couple of ideas on how to solve this in our side, but until a fix is done, tested and merged, please use 127.0.0.1 on the UI. 1 - http://git.io/vnJfx - Juca.