title: Redirect with URL OIDC parameters from Keycloak gives Bad Request
body: <p>My current setup is the following:</p>
  
  <ul>
  <li>Windows Server running an Active Directory. </li>
  <li>Keycloak server runningon a WildFly. </li>
  <li>Java test application with restricted access deployed on the WildFly.</li>
  </ul>
  
  <p>The authorization flow is that a user from the AD requests access to the application, the user is granted a Kerberos ticket, and trying the get access to the same application with that specific ticket.</p>
  
  <p>All the configuration with Kerberos, Keycloak and AD is done, and the agreements between the server and the client are running smoothly, <strong>but the last "GET" request, where the user has been granted access, it means making a request for the Keycloak redirect URL containing the OpenID-Connect parameters (state= and code=), returns a "bad request".</strong></p>
  
  <p>I am fairly new to the concept of using Keycloak as a SSO provider, so this could be something very trivial I missed.</p>
  
  <p>[EDIT]
  If I fire a request for the restriced page in Fiddler, it gives me a "No State Cookie", BUT when I use any kind of browser, it says "Forbidden", and my log says that  ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-9) failed verification of token: Invalid token issuer. Expected <a href="http://KEYCLOAK:9090/auth/realms/kerberos-realms/" rel="nofollow noreferrer">http://KEYCLOAK:9090/auth/realms/kerberos-realms/</a>" but expected "<a href="http://keycloak:8080/auth/realms/kerberos-realm" rel="nofollow noreferrer">http://keycloak:8080/auth/realms/kerberos-realm</a>"</p>