title: Connect to postgres from wildfly without password
body: <p>I would like to run a <code>keycloak</code> (which is running in <code>wildfly</code>) in google kubernetes engine (GKE) and store my data in a managed SQL instance to which I would like to connect using a google service account (GSA) using the built in IAM authentication. I'm mostly through the setup (cloud SQL auth proxy is running as sidecar next to <code>keycloak</code>, the proxy successfully authenticates to the managed instance, etc...), but I cannot convince <code>wildfly</code> not to provide a password when trying to connect to the db via localhost (where the sidecar is available).</p>
  <p>As an analogy to my problem I seem to have: <code>psql -U &lt;service_account&gt;@&lt;project&gt;.iam</code> works like a charm, where <code>psql -U &lt;service_account&gt;@&lt;project&gt;.iam -p</code> with empty password fails.</p>
  <p>I already tweak the container which is using <code>jboss/keycloak</code> docker image by mounting my own version of <code>/opt/jboss/tools/cli/databases/postgres/change-database.cli</code> where I remove the line that sets the password. The file new looks like:</p>
  <pre><code>/subsystem=datasources/data-source=KeycloakDS: remove()
  /subsystem=datasources/data-source=KeycloakDS: add(jndi-name=java:jboss/datasources/KeycloakDS,enabled=true,use-java-context=true,use-ccm=true, connection-url=jdbc:postgresql://${env.DB_ADDR:postgres}/${env.DB_DATABASE:keycloak}${env.JDBC_PARAMS:}, driver-name=postgresql)
  /subsystem=datasources/data-source=KeycloakDS: write-attribute(name=user-name, value=${env.DB_USER:keycloak})
  /subsystem=datasources/data-source=KeycloakDS: write-attribute(name=check-valid-connection-sql, value=&quot;SELECT 1&quot;)
  /subsystem=datasources/data-source=KeycloakDS: write-attribute(name=background-validation, value=true)
  /subsystem=datasources/data-source=KeycloakDS: write-attribute(name=background-validation-millis, value=60000)
  /subsystem=datasources/data-source=KeycloakDS: write-attribute(name=flush-strategy, value=IdleConnections)
  /subsystem=datasources/jdbc-driver=postgresql:add(driver-name=postgresql, driver-module-name=org.postgresql.jdbc, driver-xa-datasource-class-name=org.postgresql.xa.PGXADataSource)
  
  /subsystem=keycloak-server/spi=connectionsJpa/provider=default:write-attribute(name=properties.schema,value=${env.DB_SCHEMA:public})
  </code></pre>
  <p>(the standard content without the line: <code>/subsystem=datasources/data-source=KeycloakDS: write-attribute(name=password, value=${env.DB_PASSWORD:password})</code>).</p>
  <p>What am I missing?</p>