Getting Forbidden instead of redirect to keycloak auth

Question

Im trying to secure my java ee rest api by keycloak but if I try to access path that should be protected I got only Forbidden writen on screen and thats it. I have no errors in logs and do not know where to look for bug.

web.xml:

<security-constraint>
        <web-resource-collection>
            <web-resource-name></web-resource-name>
            <description>Protects all resources</description>
            <url-pattern>/pato-api/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>
        </auth-constraint>
    </security-constraint>
    <security-role>
        <role-name>admin</role-name>
    </security-role>
    <login-config>
        <auth-method>KEYCLOAK</auth-method>
        <realm-name>pato</realm-name>
    </login-config>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>user/</web-resource-name>
            <url-pattern>/user/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>user</role-name>
        </auth-constraint>
    </security-constraint>
    <security-role>
        <role-name>user</role-name>
    </security-role>

I do not realy know where to look keycloak is running wildfly is running database is running... If I access secured path I got this