Install failed follow the official guide, configuration error : 'security-realms' isn't an allowed element here

Hello, I had the same problem and found a solution after many hours searching on JBoss documentation pages… Keycloak documentation really sucks, it is outdated. They switched authentication to Elytron, so you need to change host-slave.xml file.

You need to define username (authentication-name) and password (clear-text) to this section:

        <subsystem xmlns="urn:wildfly:elytron:15.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
            <authentication-client>
                <authentication-configuration name="hostAuthConfig"
                                              authentication-name="admin"
                                              realm="ManagementRealm">
                    <credential-reference clear-text="{{ vault_direct_insurance_api_keycloak_admin_password }}"/>
                </authentication-configuration>
                <authentication-context name="hcAuthContext">
                    <match-rule authentication-configuration="hostAuthConfig"/>
                </authentication-context>
            </authentication-client>

And reconfigure domain controller:

    <domain-controller>
        <remote authentication-context="hcAuthContext">
            <discovery-options>
                <static-discovery name="primary" protocol="${jboss.domain.master.protocol:remote+http}" host="${jboss.domain.master.address}" port="${jboss.domain.master.port:9990}"/>
            </discovery-options>
        </remote>

I was able to make it work. Turn out my issue was that for the password in credential-reference I was using the token that was generated in the last step of the bin/add-user.sh script as per the keycloak doc while in this case you need to use the HTTP password that you chose using said script. So the original fix from @marekvesely-direct was indeed correct ! Thanks for the help ! The Keyclock doc should indeed updated to reflect this change.