Keycloak

Limitations

• Infinispan clustering overhead: High-availability clusters depend on embedded Infinispan caches for user sessions; network splits or JGroups misconfigurations can drop active sessions during rolling deployments.
• No native SCIM 2.0 server: Inbound automated provisioning via the SCIM protocol is not supported natively, requiring third-party extensions for directory synchronization (GitHub issue #13484).
• High baseline memory usage: The Java runtime requires roughly 1 GB of RAM per pod, making Keycloak heavier to run than lightweight Go- or Rust-based identity proxies.
• Configuration drift in GitOps: Managing realm configurations and custom authentication flows through version control remains difficult because Keycloak relies on JSON imports and its administrative API rather than native declarative configuration files (GitHub issue #33800).

Who should use it

• DevOps engineers managing enterprise infrastructure: Keycloak unifies access control across legacy LDAP servers and modern containerized workloads behind one self-hosted single sign-on layer.
• SaaS teams requiring multi-tenant auth: Keycloak isolates customer environments into separate realms without imposing per-user licensing fees.
• Organizations with data sovereignty requirements: Keycloak runs in air-gapped or private cloud environments, keeping credentials, sessions, and audit logs within internal networks.

FAQ

Is Keycloak free for commercial use? Yes. Keycloak is open-source software with no paid feature gates or artificial user caps.

Keycloak vs Okta — which should you choose? Choose Okta for a fully managed cloud service with zero infrastructure maintenance if you can afford per-user pricing. Choose Keycloak if you want complete data ownership and have the platform skills to operate containerized services.

Can Keycloak run in Kubernetes? Yes. Keycloak provides an official Kubernetes Operator that automates cluster provisioning, database configuration, and ingress setup.

Verdict

Keycloak is the logical choice when an engineering team has the container operations expertise to host identity infrastructure and wants to avoid paying per-user SaaS fees. The project is actively maintained with regular updates from Red Hat and the CNCF community, and its Apache-2.0 license grants complete freedom to customize and deploy the platform without commercial restrictions.

Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 52 s: postgres:18, quay.io/keycloak/keycloak:26.8.1.

Based on the upstream setup. The documented production container (start with PostgreSQL) as compose: HTTP enabled for a TLS-terminating reverse proxy, hostname, admin and database passwords in .env, PostgreSQL 18 as tested upstream.

postgres-1  | 2026-11-01T20:22:23.056826718Z 
postgres-1  | 2026-11-01T20:22:23.056856135Z /usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*
postgres-1  | 2026-11-01T20:22:23.056875468Z 
postgres-1  | 2026-11-01T20:22:23.057288427Z waiting for server to shut down...2026-11-01 20:22:23.057 UTC [53] LOG:  received fast shutdown request
postgres-1  | 2026-11-01T20:22:23.059458885Z .2026-11-01 20:22:23.059 UTC [53] LOG:  aborting any active transactions
postgres-1  | 2026-11-01T20:22:23.060482260Z 2026-11-01 20:22:23.060 UTC [53] LOG:  background worker "logical replication launcher" (PID 62) exited with exit code 1
postgres-1  | 2026-11-01T20:22:23.060682760Z 2026-11-01 20:22:23.060 UTC [57] LOG:  shutting down
postgres-1  | 2026-11-01T20:22:23.061206927Z 2026-11-01 20:22:23.061 UTC [57] LOG:  checkpoint starting: shutdown immediate
postgres-1  | 2026-11-01T20:22:23.081836218Z 2026-11-01 20:22:23.081 UTC [57] LOG:  checkpoint complete: wrote 943 buffers (5.8%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=0.007 s, sync=0.013 s, total=0.022 s; sync files=303, longest=0.005 s, average=0.001 s; distance=4352 kB, estimate=4352 kB; lsn=0/1BA1BF0, redo lsn=0/1BA1BF0
postgres-1  | 2026-11-01T20:22:23.086178802Z 2026-11-01 20:22:23.086 UTC [53] LOG:  database system is shut down
postgres-1  | 2026-11-01T20:22:23.157556802Z  done
postgres-1  | 2026-11-01T20:22:23.157580677Z server stopped
postgres-1  | 2026-11-01T20:22:23.158177302Z 
postgres-1  | 2026-11-01T20:22:23.158181468Z PostgreSQL init process complete; ready for start up.
postgres-1  | 2026-11-01T20:22:23.158183177Z 
postgres-1  | 2026-11-01T20:22:23.168867593Z 2026-11-01 20:22:23.168 UTC [1] LOG:  starting PostgreSQL 18.6 (Debian 18.6-1.pgdg13+2) on aarch64-unknown-linux-gnu, compiled by gcc (Debian 14.2.0-19) 14.2.0, 64-bit
postgres-1  | 2026-11-01T20:22:23.169003135Z 2026-11-01 20:22:23.168 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres-1  | 2026-11-01T20:22:23.169006510Z 2026-11-01 20:22:23.168 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres-1  | 2026-11-01T20:22:23.170132093Z 2026-11-01 20:22:23.170 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres-1  | 2026-11-01T20:22:23.172753677Z 2026-11-01 20:22:23.172 UTC [75] LOG:  database system was shut down at 2026-11-01 20:22:23 UTC
postgres-1  | 2026-11-01T20:22:23.174078052Z 2026-11-01 20:22:23.173 UTC [1] LOG:  database system is ready to accept connections
postgres-1  | 2026-11-01T20:22:35.112471918Z 2026-11-01 20:22:35.112 UTC [94] ERROR:  relation "migration_model" does not exist at character 25
postgres-1  | 2026-11-01T20:22:35.112490001Z 2026-11-01 20:22:35.112 UTC [94] STATEMENT:  SELECT ID, VERSION FROM MIGRATION_MODEL ORDER BY UPDATE_TIME DESC
postgres-1  | 2026-11-01T20:22:35.635659502Z 2026-11-01 20:22:35.635 UTC [95] ERROR:  relation "public.databasechangeloglock" does not exist at character 22
postgres-1  | 2026-11-01T20:22:35.635677627Z 2026-11-01 20:22:35.635 UTC [95] STATEMENT:  SELECT COUNT(*) FROM public.databasechangeloglock
keycloak-1  | 2026-11-01T20:22:28.656667888Z Changes detected in configuration. Updating the server image.
keycloak-1  | 2026-11-01T20:22:28.661020138Z Updating the configuration and installing your custom providers, if any. Please wait.
keycloak-1  | 2026-11-01T20:22:30.305946889Z 2026-11-01 20:22:30,305 WARN  [org.keycloak.common.Profile] (build-9) Deprecated features identity-brokering-api:v1, twitter-broker:v1 enabled by default. Check the upgrading guide for steps to use later versions if available.
keycloak-1  | 2026-11-01T20:22:32.922869750Z 2026-11-01 20:22:32,922 INFO  [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 3877ms
keycloak-1  | 2026-11-01T20:22:32.929384875Z Server configuration updated and persisted. Run the following command to review the configuration:
keycloak-1  | 2026-11-01T20:22:32.929395917Z 
keycloak-1  | 2026-11-01T20:22:32.929538709Z 	kc.sh show-config
keycloak-1  | 2026-11-01T20:22:32.929541750Z 
keycloak-1  | 2026-11-01T20:22:32.929890917Z Next time you run the server, just add --optimized to the command to ensure this build is used.
keycloak-1  | 2026-11-01T20:22:34.474690959Z 2026-11-01 20:22:33,826 WARN  [org.keycloak.models.sessions.infinispan.InfinispanStickySessionEncoderProviderFactory] (main) The option `shouldAttachRoute` is deprecated and will be removed in a future release. Disable it by setting `spi-sticky-session-encoder--infinispan--should-attach-route` to `false`
keycloak-1  | 2026-11-01T20:22:34.477540209Z 2026-11-01 20:22:34,467 INFO  [org.infinispan.CONTAINER] (main) ISPN000974: Virtual threads support: disabled
keycloak-1  | 2026-11-01T20:22:35.066332293Z 2026-11-01 20:22:35,066 INFO  [org.hibernate.orm.jdbc.batch] (JPA Startup Thread) HHH100501: Automatic JDBC statement batching enabled (maximum batch size 32)
keycloak-1  | 2026-11-01T20:22:35.101494418Z 2026-11-01 20:22:35,101 WARN  [org.keycloak.common.Profile] (executor-thread-1) Deprecated features identity-brokering-api:v1, twitter-broker:v1 enabled by default. Check the upgrading guide for steps to use later versions if available.
keycloak-1  | 2026-11-01T20:22:35.189169835Z 2026-11-01 20:22:35,188 INFO  [io.quarkus] (main) Keycloak 26.8.1 on JVM (powered by Quarkus 3.40.1) started in 2.198s. Listening on: http://0.0.0.0:8080. Management interface listening on http://0.0.0.0:9000.
keycloak-1  | 2026-11-01T20:22:35.189213668Z 2026-11-01 20:22:35,189 INFO  [io.quarkus] (main) Profile prod activated. 
keycloak-1  | 2026-11-01T20:22:35.189215835Z 2026-11-01 20:22:35,189 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-postgresql, keycloak, narayana-jta, opentelemetry, rest, rest-jackson, smallrye-context-propagation, smallrye-health, vertx]
keycloak-1  | 2026-11-01T20:22:35.653174918Z 2026-11-01 20:22:35,652 INFO  [org.keycloak.quarkus.runtime.storage.database.liquibase.QuarkusJpaUpdaterProvider] (executor-thread-1) Initializing database schema. Using changelog META-INF/jpa-changelog-master.xml
keycloak-1  | 2026-11-01T20:22:37.470018294Z 2026-11-01 20:22:37,469 WARN  [org.keycloak.quarkus.runtime.services.BootstrapFilter] (vert.x-eventloop-thread-1) Request received during bootstrapping, returning a 503 error. Use the readiness health endpoint to ensure the service is ready before forwarding requests to the service.
keycloak-1  | 2026-11-01T20:22:40.640724129Z 2026-11-01 20:22:40,640 INFO  [org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator] (executor-thread-1) JGroups JDBC_PING discovery enabled.
keycloak-1  | 2026-11-01T20:22:40.999810462Z 2026-11-01 20:22:40,999 INFO  [org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator] (executor-thread-1) JGroups Encryption enabled (mTLS).
keycloak-1  | 2026-11-01T20:22:41.310032713Z 2026-11-01 20:22:41,309 INFO  [org.keycloak.jgroups.certificates.CertificateReloadManager] (executor-thread-1) Starting JGroups certificate reload manager
keycloak-1  | 2026-11-01T20:22:41.458053421Z 2026-11-01 20:22:41,457 INFO  [org.infinispan.CONTAINER] (executor-thread-1) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'
keycloak-1  | 2026-11-01T20:22:41.513775046Z 2026-11-01 20:22:41,513 INFO  [org.infinispan.CLUSTER] (executor-thread-1) ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`
keycloak-1  | 2026-11-01T20:22:41.514599379Z 2026-11-01 20:22:41,514 INFO  [org.jgroups.JChannel] (executor-thread-1) local_addr: 00000000-0000-0000-0000-000000000001(v=16.0.15), name: 39e3a3d5b502-30925
keycloak-1  | 2026-11-01T20:22:41.528062379Z 2026-11-01 20:22:41,527 INFO  [org.jgroups.protocols.FD_SOCK2] (executor-thread-1) server listening on *:57800
keycloak-1  | 2026-11-01T20:22:41.559931296Z 2026-11-01 20:22:41,559 INFO  [org.infinispan.CLUSTER] (executor-thread-1) ISPN000094: Received new cluster view for channel ISPN: [39e3a3d5b502-30925(v=16.0.15)|0] (1) [39e3a3d5b502-30925(v=16.0.15)]
keycloak-1  | 2026-11-01T20:22:41.567924838Z 2026-11-01 20:22:41,567 INFO  [org.keycloak.jgroups.certificates.CertificateReloadManager] (blocking-thread--p3-t2) Reloading JGroups Certificate
keycloak-1  | 2026-11-01T20:22:41.601594338Z 2026-11-01 20:22:41,601 INFO  [org.infinispan.CLUSTER] (executor-thread-1) ISPN000079: Channel `ISPN` local address is `39e3a3d5b502-30925`, physical addresses are `[172.18.0.3:7800]`
keycloak-1  | 2026-11-01T20:22:41.896222296Z 2026-11-01 20:22:41,896 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (executor-thread-1) Node name: 39e3a3d5b502-30925, Site name: null, Cluster name: ISPN
keycloak-1  | 2026-11-01T20:22:42.067539671Z 2026-11-01 20:22:42,066 INFO  [org.keycloak.models.workflow.WorkflowsEventListenerFactory] (executor-thread-1) Workflow runner task scheduled: next execution at 08:22:42, then every PT12H
keycloak-1  | 2026-11-01T20:22:42.106737338Z 2026-11-01 20:22:42,106 INFO  [org.keycloak.services] (executor-thread-1) KC-SERVICES0050: Initializing master realm
keycloak-1  | 2026-11-01T20:22:42.717567880Z 2026-11-01 20:22:42,717 INFO  [org.keycloak.services] (executor-thread-1) KC-SERVICES0077: Created temporary admin user with username admin
keycloak-1  | 2026-11-01T20:22:42.791370297Z 2026-11-01 20:22:42,791 INFO  [org.keycloak.services.resources.KeycloakApplication] (executor-thread-1) Bootstrap completed in 7.689000 seconds
keycloak-1  | 2026-11-01T20:22:58.918093221Z 2026-11-01 20:22:58,916 WARN  [org.keycloak.services] (executor-thread-4) KC-SERVICES0112: Client registration provider 'default' is deprecated and will be removed in a future release. Migrate to the Admin REST API.
keycloak-1  | 2026-11-01T20:22:58.921079596Z 2026-11-01 20:22:58,920 WARN  [org.keycloak.services] (executor-thread-7) KC-SERVICES0112: Client registration provider 'default' is deprecated and will be removed in a future release. Migrate to the Admin REST API.
keycloak-1  | 2026-11-01T20:23:00.933683472Z 2026-11-01 20:23:00,933 ERROR [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-0) Failed to parse a port from "forwarded"-type headers, using the default port -1
keycloak-1  | 2026-11-01T20:23:00.934573805Z 2026-11-01 20:23:00,934 ERROR [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-0) Failed to parse a port from "forwarded"-type headers, using the default port -1
keycloak-1  | 2026-11-01T20:23:00.935369555Z 2026-11-01 20:23:00,935 ERROR [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-0) Failed to parse a port from "forwarded"-type headers, using the default port -1
keycloak-1  | 2026-11-01T20:23:01.899599472Z 2026-11-01 20:23:01,896 ERROR [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Failed to parse a port from "forwarded"-type headers, using the default port -1
keycloak-1  | 2026-11-01T20:23:01.902906222Z 2026-11-01 20:23:01,901 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-7) Uncaught server error: java.lang.RuntimeException: java.net.URISyntaxException: Illegal character in authority at index 10: http://xxx{{['cat /etc/passwd']|filter('system')}}bbb/
keycloak-1  | 2026-11-01T20:23:01.902923181Z 	at org.jboss.resteasy.reactive.server.jaxrs.UriInfoImpl.getRequestUri(UriInfoImpl.java:103)
keycloak-1  | 2026-11-01T20:23:01.902925889Z 	at org.keycloak.models.KeycloakUriInfo.getRequestUri(KeycloakUriInfo.java:62)
keycloak-1  | 2026-11-01T20:23:01.902927431Z 	at org.keycloak.services.resources.WelcomeResource.getWelcomePage(WelcomeResource.java:94)
keycloak-1  | 2026-11-01T20:23:01.902929347Z 	at org.keycloak.services.resources.WelcomeResource$quarkusrestinvoker$getWelcomePage_88e9d8d2443c979657fafa960095f3dcca00c556.invoke(Unknown Source)
keycloak-1  | 2026-11-01T20:23:01.902930972Z 	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
keycloak-1  | 2026-11-01T20:23:01.902932431Z 	at org.keycloak.quarkus.runtime.integration.resteasy.TransactionalSessionHandler.handle(TransactionalSessionHandler.java:85)
keycloak-1  | 2026-11-01T20:23:01.902933972Z 	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:195)
keycloak-1  | 2026-11-01T20:23:01.902935431Z 	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:150)
keycloak-1  | 2026-11-01T20:23:01.902936847Z 	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:695)
keycloak-1  | 2026-11-01T20:23:01.902938181Z 	at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651)
keycloak-1  | 2026-11-01T20:23:01.902939472Z 	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630)
keycloak-1  | 2026-11-01T20:23:01.902940847Z 	at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622)
keycloak-1  | 2026-11-01T20:23:01.902942181Z 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589)
keycloak-1  | 2026-11-01T20:23:01.902943472Z 	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
keycloak-1  | 2026-11-01T20:23:01.902944806Z 	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
keycloak-1  | 2026-11-01T20:23:01.902946097Z 	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
keycloak-1  | 2026-11-01T20:23:01.902947389Z 	at java.base/java.lang.Thread.run(Thread.java:1583)
keycloak-1  | 2026-11-01T20:23:01.902949389Z Caused by: java.net.URISyntaxException: Illegal character in authority at index 10: http://xxx{{['cat /etc/passwd']|filter('system')}}bbb/
keycloak-1  | 2026-11-01T20:23:01.902960847Z 	at java.base/java.net.URI$Parser.fail(URI.java:2995)
keycloak-1  | 2026-11-01T20:23:01.902962764Z 	at java.base/java.net.URI$Parser.parseAuthority(URI.java:3344)
keycloak-1  | 2026-11-01T20:23:01.902964097Z 	at java.base/java.net.URI$Parser.parseHierarchical(URI.java:3240)
keycloak-1  | 2026-11-01T20:23:01.902965389Z 	at java.base/java.net.URI$Parser.parse(URI.java:3196)
keycloak-1  | 2026-11-01T20:23:01.902966639Z 	at java.base/java.net.URI.<init>(URI.java:645)
keycloak-1  | 2026-11-01T20:23:01.902968097Z 	at org.jboss.resteasy.reactive.server.jaxrs.UriInfoImpl.getRequestUri(UriInfoImpl.java:100)
keycloak-1  | 2026-11-01T20:23:01.902969514Z 	... 16 more
keycloak-1  | 2026-11-01T20:23:01.902970681Z 
keycloak-1  | 2026-11-01T20:23:01.923472847Z 2026-11-01 20:23:01,923 ERROR [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Failed to parse a port from "forwarded"-type headers, using the default port -1
keycloak-1  | 2026-11-01T20:23:01.935677722Z 2026-11-01 20:23:01,935 ERROR [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Failed to parse a port from "forwarded"-type headers, using the default port -1
keycloak-1  | 2026-11-01T20:23:02.894255890Z 2026-11-01 20:23:02,893 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-5) Uncaught server error: java.lang.RuntimeException: java.net.URISyntaxException: Illegal character in authority at index 10: http://xxx{{['cat /etc/passwd']|filter('system')}}bbb/
keycloak-1  | 2026-11-01T20:23:02.894289223Z 	at org.jboss.resteasy.reactive.server.jaxrs.UriInfoImpl.getRequestUri(UriInfoImpl.java:103)
keycloak-1  | 2026-11-01T20:23:02.894292723Z 	at org.keycloak.models.KeycloakUriInfo.getRequestUri(KeycloakUriInfo.java:62)
keycloak-1  | 2026-11-01T20:23:02.894294556Z 	at org.keycloak.services.resources.WelcomeResource.getWelcomePage(WelcomeResource.java:94)
keycloak-1  | 2026-11-01T20:23:02.894296515Z 	at org.keycloak.services.resources.WelcomeResource$quarkusrestinvoker$getWelcomePage_88e9d8d2443c979657fafa960095f3dcca00c556.invoke(Unknown Source)
keycloak-1  | 2026-11-01T20:23:02.894298515Z 	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
keycloak-1  | 2026-11-01T20:23:02.894300056Z 	at org.keycloak.quarkus.runtime.integration.resteasy.TransactionalSessionHandler.handle(TransactionalSessionHandler.java:85)
keycloak-1  | 2026-11-01T20:23:02.894301598Z 	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:195)
keycloak-1  | 2026-11-01T20:23:02.894303098Z 	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:150)
keycloak-1  | 2026-11-01T20:23:02.894304556Z 	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:695)
keycloak-1  | 2026-11-01T20:23:02.894306515Z 	at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651)
keycloak-1  | 2026-11-01T20:23:02.894308056Z 	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630)
keycloak-1  | 2026-11-01T20:23:02.894309431Z 	at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622)
keycloak-1  | 2026-11-01T20:23:02.894310848Z 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589)
keycloak-1  | 2026-11-01T20:23:02.894334223Z 	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
keycloak-1  | 2026-11-01T20:23:02.894337223Z 	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
keycloak-1  | 2026-11-01T20:23:02.894338598Z 	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
keycloak-1  | 2026-11-01T20:23:02.894339973Z 	at java.base/java.lang.Thread.run(Thread.java:1583)
keycloak-1  | 2026-11-01T20:23:02.894342723Z Caused by: java.net.URISyntaxException: Illegal character in authority at index 10: http://xxx{{['cat /etc/passwd']|filter('system')}}bbb/
keycloak-1  | 2026-11-01T20:23:02.894344390Z 	at java.base/java.net.URI$Parser.fail(URI.java:2995)
keycloak-1  | 2026-11-01T20:23:02.894345806Z 	at java.base/java.net.URI$Parser.parseAuthority(URI.java:3344)
keycloak-1  | 2026-11-01T20:23:02.894347140Z 	at java.base/java.net.URI$Parser.parseHierarchical(URI.java:3240)
keycloak-1  | 2026-11-01T20:23:02.894348431Z 	at java.base/java.net.URI$Parser.parse(URI.java:3196)
keycloak-1  | 2026-11-01T20:23:02.894349723Z 	at java.base/java.net.URI.<init>(URI.java:645)
keycloak-1  | 2026-11-01T20:23:02.894351223Z 	at org.jboss.resteasy.reactive.server.jaxrs.UriInfoImpl.getRequestUri(UriInfoImpl.java:100)
keycloak-1  | 2026-11-01T20:23:02.894352640Z 	... 16 more
keycloak-1  | 2026-11-01T20:23:02.894353848Z