I've just fixed this issue for the AeroGear guys: https://issues.jboss.org/browse/KEYCLOAK-556 While doing it I noticed that it works with auth-method=BASIC on AS7, but on WildFly/Undertow I had to change it to Keycloak. Is there a reason why this isn't the same on both?