How Testcontainers solves the painful Keycloak SPI testing feedback loop

Developers building custom Keycloak authenticators typically face a slow manual cycle of packaging, copying jars, restarting the server, and testing by hand. A DEV Community post outlines how Testcontainers can automate this by spinning up a real Keycloak instance with the built provider jar mounted before container startup. The approach catches deployment-level failures — such as incorrect META-INF/services entries or classloading errors — that unit tests with mocks cannot detect. A key practical finding was that waiting for the HTTP endpoint to respond, rather than relying on a log message, prevents flaky test failures in CI environments. The same pattern was applied to an event-listener SPI that publishes to Kafka, where a real Kafka broker was spun up via Testcontainers to validate producer configuration rather than masking it with mocks.