I have implemented multi-tenancy in a Quarkus 2.16.10.Final app with Keycloak as ID Provider as described here
https://quarkus.io/version/2.16/guides/security-openid-connect-multitenancy

using annotations as the requirement is pretty basic (we need to have a second realm with passwords that never expire for one “technical” API (i.e., an API not called by human users)).

This works fine in the dev environment with a local Keycloak standalone server containing the second realm, and a Quarkus config that looks something like this

##############################################
# Quarkus OIDC configuration
##############################################

quarkus.http.auth.proactive=false

quarkus.oidc.auth-server-url = http://127.0.0.1:8180/realms/<DEFAULT_REALM_NAME>
quarkus.oidc.token.issuer = http://127.0.0.1:8180/realms/<DEFAULT_REALM_NAME>
quarkus.oidc.client-id = <DEFAULT_REALM_CLIENT_NAME>
quarkus.oidc.credentials.secret = <DEFAULT_REALM_CLIENT_SECRET>
quarkus.oidc.application-type = service

quarkus.oidc.test.auth-server-url = http://127.0.0.1:8180/realms/<SECOND_REALM_NAME>
quarkus.oidc.test.token.issuer=http://127.0.0.1:8180/realms/<SECOND_REALM_NAME>
quarkus.oidc.test.client-id = <SECOND_REALM_CLIENT_NAME>
quarkus.oidc.test.credentials.secret = <SECOND_REALM_CLIENT_SECRET>
quarkus.oidc.test.application-type = service

Calling the API with a curl request containing a JWT token.

However, when I move to production mode, Quarkus fails to use the “test” realm.

In the log I have

2024-05-02 13:21:42,329 DEBUG [io.qua.oid.run.OidcProviderClient] (vert.x-eventloop-thread-1) Get token on: https://<KEYCLOAK_SERVICE_NAME>.<NAMESPACE>.svc.cluster.local:8443/auth/realms/<DEFAULT_REALM_NAME>/protocol/openid-connect/token

-> wrong Realm (request going to the default Realm)

followed by

"description":"RoutingContext failure (500)","stacktrace":"io.quarkus.security.AuthenticationFailedExceptionntat io.quarkus.oidc.runtime.OidcIdentityProvider$6.apply(OidcIdentityProvider.java:227)ntat io.quarkus.oidc.runtime.OidcIdentityProvider$6.apply(OidcIdentityProvider.java:223) ...

Just to confirm the behaviour, I put the settings of the second realm in the default realm parameters, and the API call works, so there is not issue with the values for quarkus.oidc.test.* parameters.

Any idea as to what I’m doing wrong, or is there some know issue implementing multi-tenancy by annotation on Quarkus 2.16.10.Final?

Thanks