anchor.diff:  * _Credential_ - Use the password value for the _kie_ client. You can find it in the Keycloak admin console -> Clients -> kie -> Credentials tab -> Copy the value for the __secret__.
   
   For this example you have to take care about using your concrete values for _secure-deployment_ name, _realm-public-key_ and _credential_ password.
  -You can find detailed information about the https://keycloak.gitbooks.io/documentation/securing_apps/topics/oidc/java/jboss-adapter.html[JBoss EAP adapter configuration] in Keycloak documentation.
  +
  +[IMPORTANT]
  +====
  +Ensure the following tag is NOT present in the Widfly/EAP profile's configuration file (eg: standalone.xml):
  +[source]
  +----
  +<single-sign-on/>
  +----
  +It's enabled by default in some server versions. If present, it must be removed/disabled in order to allow Keycloak to properly handle the clients.
  +====
   
   === Run the environment
   
  
positive.code: * Via Keycloak subsystem
  
  In this example let's use the second option, use the Keycloak subsystem, so our WAR is free from this kind of settings.
  If you want to use the per WAR approach, please take a look https://keycloak.github.io/docs/userguide/keycloak-server/html/ch08.html#d4e932[here].
  
  Edit the configuration file _$JBPM_HOME/standalone/configuration/standalone-full.xml_ and locate the subsystem configuration section.
  Add the following content:
  
negative.code: 
  Let's install, setup and deploy the execution server:
  
  * Install another Wildfly server to use for the execution server and the KC client adapter as well. You can follow above instructions for the Workbench or follow the http://www.keycloak.org/docs/latest/securing_apps/index.html[securing applications guide]
  * Edit the _standalone-full.xml_ file from the Wildfly server's configuration path and configure the KC subsystem adapter as:
  +
  [source,xml]
  