Question on Keycloak login issue

Describe the bug

Appreciate some guidance on keycloak authentication with UnityCatalog.

The application is deployed on a kubernetes cluster, stable and running.

The unitycatalog-server statefulset pod is running and with cli, can create users, catalog, schemas etc.

The issue I have is Keycloak authentication from unitycatalog-ui pod.

Followed the steps in the docs here https://docs.unitycatalog.io/server/auth/ with some ChatGPT assistance.

keycloak client is created and necessary variables injected into the /ui/.env file as a configmap.

While testing, noticed that the following:

When variables:  REACT_APP_GOOGLE_AUTH_ENABLED=true  and REACT_APP_GOOGLE_CLIENT_ID=<any-string> ; Continue with Google and Keycloak button show up while trying to authenticate
When varibles:   REACT_APP_GOOGLE_AUTH_ENABLED=true  and REACT_APP_GOOGLE_CLIENT_ID= ; Only Continue withe Keycloak button show us
when variables:  REACT_APP_GOOGLE_AUTH_ENABLED=      and REACT_APP_GOOGLE_CLIENT_ID= ; no login option is provided. 

It does not matter what other flags are turned on or off in the .env file. Its as if all other env settings are ignored.

When the KC button shows up and is clicked, it seems to be tryintg to authenticate with Google. Errors of the form below appear in the developer tools

GET wss://c<cluster-domain>:3000/ws   NS_ERROR_NET_TIMEOUT

[GSI_LOGGER]: The given client ID is not found.  << this shows up when an client id is added to the  `REACT_APP_GOOGLE_CLIENT_ID=blah`. The error is understandable because a google client does not really exist.

How can I make the app run the Keycloak configuration options and not Google? Thanks for your time.

To Reproduce

Steps to reproduce the behavior:

Steps to reproduce the behavior:

1. Add needed variables in a configmap (like below) and Deploy the unitycatalog-ui deployment with confimap mount to /ui/.env

---
kind: ConfigMap
metadata:
  name: unitycatalog-server-cm-ui-env
  namespace: unitycatalog
apiVersion: v1
data:
  .env: |-
    # Google config
    REACT_APP_GOOGLE_AUTH_ENABLED=true          # when true, Keycloak button shows up. When false, their is not authentiation.
    REACT_APP_GOOGLE_CLIENT_ID=unitycatalog     # with this set, the Google button shows up, else it does not
    # Okta config
    REACT_APP_OKTA_AUTH_ENABLED=false
    REACT_APP_OKTA_DOMAIN=
    REACT_APP_OKTA_CLIENT_ID=
    # Keycloak config
    REACT_APP_KEYCLOAK_AUTH_ENABLED=true
    REACT_APP_KEYCLOAK_URL=https://<my-domain>/auth/realms/<my-realm>/protocol/openid-connect/auth
    REACT_APP_KEYCLOAK_REALM=<my-domain>
    REACT_APP_KEYCLOAK_REDIRECT_URI=https://catalog.<my-domain>
    REACT_APP_KEYCLOAK_CLIENT_ID=unitycatalog
    REACT_APP_KEYCLOAK_CLIENT_SECRET=my-secret
    REACT_APP_KEYCLOAK_PKCE_METHOD=S256
    REACT_APP_KEYCLOAK_ENABLE_LOGGING=true
    REACT_APP_KEYCLOAK_STORE_TOKENS=localStorage
    DANGEROUSLY_DISABLE_HOST_CHECK=true

2. Click on the Continue with Keycloak button
3. Google related erros shows up and nothing related to Keycloak configuration

Expected behavior

Keycloak defined authentication should be processed. Instead Google related errors show up in browser DevTools. Ingress configuration has been tweaked to include a combination of the annotations below. None seem to help.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: unitycatalog-ui
  annotations:

    nginx.ingress.kubernetes.io/backend-protocol: HTTP
    nginx.ingress.kubernetes.io/proxy-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    nginx.ingress.kubernetes.io/connection-proxy-header: "keep-alive"
    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "7200"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "7200"
    nginx.ingress.kubernetes.io/enable-websocket: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/upstream-vhost: "unitycatalog-ui.unitycatalog.svc.cluster.local"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-name: "my-session-cookie"
    nginx.ingress.kubernetes.io/session-cookie-path: "/"
spec:
  ingressClassName: nginx
  rules:
  - host: catalog.<my-domain>
    http:
      paths:
      - backend:
          service:
            name: unitycatalog-ui
            port:
              number: 3000
        path: /*


**System [please complete the following information]:**

-   OS: Amazon Linux
-   kubernetes version: v1.33.4-eks-99d6cc


**Additional context**

<!-- Add any other context about the problem here. -->

<img width="1011" height="535" alt="Image" src="https://github.com/user-attachments/assets/6cbf660c-6a03-4581-b65b-5f1f4aa81490" />
<img width="1700" height="300" alt="Image" src="https://github.com/user-attachments/assets/d0064410-1971-4992-a158-8d782172d8b2" />
<img width="1471" height="861" alt="Image" src="https://github.com/user-attachments/assets/b729c8a0-4d6f-4186-9d79-3b48faf52923" />

The issue names the /ui/.env ConfigMap, the unitycatalog-ui deployment, and the server authentication documentation as starting points; compare the UI environment configuration with the documented Keycloak variables and inspect browser DevTools for provider selection. Done means the Keycloak option uses the supplied configuration without Google-related authentication errors; no source file or test is identified in the report.