I want to write a vaadin web-app and secure it by a keycloak idp,

According to the docs https://docs.spring.io/spring-security/reference/servlet/oauth2/login/core.html.
It should be pretty strait forward in the secure all pages.
Only the properties should be set an the app should be secure (or do I got something wrong?).

logging.level.org.springframework.security=DEBUG

spring.security.oauth2.client.registration.my-app.client-id=my-app
spring.security.oauth2.client.registration.my-app.client-secret=mysecret
spring.security.oauth2.client.registration.my-app.scope=openid, profile, roles
spring.security.oauth2.client.registration.my-app.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.my-app.redirect-uri=http://localhost:8080/login/oauth2/code/my-app

spring.security.oauth2.client.provider.my-app.issuer-uri=https://my.idp.keycloak/realms/my-app

The securing part seams to work, I get redirected to the login page, but after entering the credentials spring sends me again back to the idp instead of parsing the result give in url by the idp.

I get redirected to:
https://my.idp.keycloak/login/oauth2/code/my-app?state=E_XIdufZ02xFcB-0lhZA0aXeAqQEJ67P1r-RTXQ8Oww%3D&session_state=asdf&iss=https%3A%2F%2Fmy.idp.keycloak%2Frealms%2Fmy-app&code=asdf

I did nothing fancy like doing any SecurityConfiguration (yet), at the moment I just want an easy authentication via oauth.