diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be8e397..3587cff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,4 +22,4 @@ jobs:
       root_permission_varname: 'keycloak_install_requires_become'
       debug_verbosity: "${{ github.event.inputs.debug_verbosity }}"
       molecule_tests: >-
-        [ "debian", "quarkus", "quarkus_ha", "quarkus_ha_remote", "quarkus_ha_26.4_below", "default", "quarkus_devmode", "quarkus_upgrade", "keycloak_modules" ]
+        [ "debian", "sso_test", "quarkus", "quarkus_ha", "quarkus_ha_remote", "quarkus_ha_26.4_below", "default", "quarkus_devmode", "quarkus_upgrade", "keycloak_modules" ]
diff --git a/molecule/sso_test/converge.yml b/molecule/sso_test/converge.yml
new file mode 100644
index 0000000..f498e03
--- /dev/null
+++ b/molecule/sso_test/converge.yml
@@ -0,0 +1,22 @@
+---
+- name: Converge
+  hosts: all
+  vars_files:
+    - ../group_vars/all/vars.yml
+  vars:
+    keycloak_admin_password: "remembertochangeme"
+    keycloak_enable: true
+    keycloak_offline_install: false
+  roles:
+    - role: keycloak
+    - role: keycloak_realm
+      keycloak_url: "http://instance:8080"
+      keycloak_context: "/auth"
+      keycloak_admin_user: "admin"
+      keycloak_admin_password: "remembertochangeme"
+      keycloak_realm: TestRealm
+      keycloak_clients:
+        - name: TestClient
+          realm: "{{ keycloak_realm }}"
+          public_client: true
+          client_id: TestClient
diff --git a/molecule/sso_test/molecule.yml b/molecule/sso_test/molecule.yml
new file mode 100644
index 0000000..045fd3f
--- /dev/null
+++ b/molecule/sso_test/molecule.yml
@@ -0,0 +1,31 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: registry.access.redhat.com/ubi9/ubi-init:latest
+    command: /usr/sbin/init
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callbacks_enabled: profile_tasks, timer, yaml
+    ssh_connection:
+      pipelining: false
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+  inventory:
+    host_vars:
+      instance:
+        ansible_user: root
+verifier:
+  name: ansible
diff --git a/molecule/sso_test/prepare.yml b/molecule/sso_test/prepare.yml
new file mode 100644
index 0000000..098c31c
--- /dev/null
+++ b/molecule/sso_test/prepare.yml
@@ -0,0 +1,11 @@
+---
+- name: Prepare
+  hosts: all
+  vars_files:
+    - ../group_vars/all/vars.yml
+  gather_facts: yes
+  vars:
+    sudo_pkg_name: sudo
+  tasks:
+    - name: "Run preparation common to all scenario"
+      ansible.builtin.include_tasks: ../prepare.yml
diff --git a/molecule/sso_test/verify.yml b/molecule/sso_test/verify.yml
new file mode 100644
index 0000000..8b1835e
--- /dev/null
+++ b/molecule/sso_test/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: Verify
+  hosts: all
+  vars:
+    keycloak_admin_password: "remembertochangeme"
+    keycloak_admin_user: "admin"
+    keycloak_uri: "http://localhost:8080"
+    keycloak_context: "/auth"
+  tasks:
+    - name: Populate service facts
+      ansible.builtin.service_facts:
+    - name: Check if keycloak service started
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.services["keycloak.service"]["state"] == "running"
+          - ansible_facts.services["keycloak.service"]["status"] == "enabled"
+    - name: Verify token api call
+      ansible.builtin.uri:
+        url: "{{ keycloak_uri }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token"
+        method: POST
+        body: "client_id=admin-cli&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password"
+        validate_certs: no
+      register: keycloak_auth_response
+      until: keycloak_auth_response.status == 200
+      retries: 2
+      delay: 2
diff --git a/roles/keycloak/meta/argument_specs.yml b/roles/keycloak/meta/argument_specs.yml
index a2bf965..4f9829a 100644
--- a/roles/keycloak/meta/argument_specs.yml
+++ b/roles/keycloak/meta/argument_specs.yml
@@ -388,6 +388,6 @@ argument_specs:
                 description: "Red Hat SSO patch archive filename"
                 type: "str"
             sso_product_category:
-                default: "core.service.rhsso"
-                description: "JBossNetwork API category for Single Sign-On"
+                default: "CORE.SERVICE.RHSSO"
+                description: "Unified Downloads API category for Single Sign-On"
                 type: "str"
diff --git a/roles/keycloak/tasks/install.yml b/roles/keycloak/tasks/install.yml
index 5429af2..ce29fc5 100644
--- a/roles/keycloak/tasks/install.yml
+++ b/roles/keycloak/tasks/install.yml
@@ -120,7 +120,7 @@
 
     - name: Determine install zipfile from search results
       ansible.builtin.set_fact:
-        rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_archive + '$') }}"
+        rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '.*rh-sso-' + sso_version.split('.')[:2] | join('.') + '.*-server-dist\\.zip$') | rejectattr('file_name', 'search', 'maven|src|license|provenance|adapter') | list }}"
       delegate_to: localhost
       run_once: true
 
@@ -226,7 +226,7 @@
     mode: '0640'
   notify:
     - restart keycloak
-  when: keycloak_config_override_template | length > 0
+  when: (keycloak_config_override_template | default('', true)) | length > 0
 
 - name: "Deploy standalone {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
@@ -240,7 +240,7 @@
     - restart keycloak
   when:
     - not keycloak_ha_enabled
-    - keycloak_config_override_template | length == 0
+    - (keycloak_config_override_template | default('', true)) | length == 0
 
 - name: Create tcpping cluster node list
   ansible.builtin.set_fact:
@@ -269,7 +269,7 @@
   when:
     - keycloak_ha_enabled
     - not keycloak_remote_cache_enabled
-    - keycloak_config_override_template | length == 0
+    - (keycloak_config_override_template | default('', true)) | length == 0
 
 - name: "Deploy HA {{ keycloak.service_name }} config with infinispan remote cache store to {{ keycloak_config_path_to_standalone_xml }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
@@ -284,7 +284,7 @@
   when:
     - keycloak_ha_enabled
     - keycloak_remote_cache_enabled
-    - keycloak_config_override_template | length == 0
+    - (keycloak_config_override_template | default('', true)) | length == 0
 
 - name: "Deploy profile.properties file to {{ keycloak_config_path_to_properties }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
@@ -296,4 +296,4 @@
     mode: '0640'
   notify:
     - restart keycloak
-  when: keycloak_features | length > 0
+  when: (keycloak_features | default([], true)) | length > 0
diff --git a/roles/keycloak/tasks/prereqs.yml b/roles/keycloak/tasks/prereqs.yml
index d97390c..7e2e8e3 100644
--- a/roles/keycloak/tasks/prereqs.yml
+++ b/roles/keycloak/tasks/prereqs.yml
@@ -2,7 +2,7 @@
 - name: Validate admin console password
   ansible.builtin.assert:
     that:
-      - keycloak_admin_password | length > 12
+      - (keycloak_admin_password | default('', true)) | length > 12
     quiet: true
     fail_msg: >
       The console administrator password is empty or invalid. Please set the keycloak_admin_password variable to a 12+ char long string
@@ -31,9 +31,9 @@
   ansible.builtin.assert:
     that:
       - keycloak_jdbc_engine is defined and keycloak_jdbc_engine in [ 'postgres', 'mariadb', 'sqlserver' ]
-      - keycloak_jdbc_url | length > 0
-      - keycloak_db_user | length > 0
-      - keycloak_db_pass | length > 0
+      - (keycloak_jdbc_url | default('', true)) | length > 0
+      - (keycloak_db_user | default('', true)) | length > 0
+      - (keycloak_db_pass | default('', true)) | length > 0
     quiet: true
     fail_msg: "Configuration for the JDBC persistence is invalid or incomplete"
     success_msg: "Configuring JDBC persistence using {{ keycloak_jdbc_engine }} database"
diff --git a/roles/keycloak/tasks/rhsso_patch.yml b/roles/keycloak/tasks/rhsso_patch.yml
index 5abe1b7..718d1af 100644
--- a/roles/keycloak/tasks/rhsso_patch.yml
+++ b/roles/keycloak/tasks/rhsso_patch.yml
@@ -39,14 +39,14 @@
         filtered_versions: "{{ rhn_products.results | map(attribute='file_name') | \
                                select('match', '^[^/]*/rh-sso-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | \
                                map('regex_replace', '[^/]*/rh-sso-([0-9]*[.][0-9]*[.][0-9]*(-[0-9])?)-.*', '\\1') | list | unique }}"
-      when: sso_patch_version is not defined or sso_patch_version | length == 0
+      when: (sso_patch_version | default('', true)) | length == 0
       delegate_to: localhost
       run_once: true
 
     - name: Determine latest version
       ansible.builtin.set_fact:
         sso_latest_version: "{{ filtered_versions | middleware_automation.common.version_sort | last }}"
-      when: sso_patch_version is not defined or sso_patch_version | length == 0
+      when: (sso_patch_version | default('', true)) | length == 0
       delegate_to: localhost
       run_once: true
 
@@ -55,7 +55,7 @@
         rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + sso_latest_version + '-patch.zip$') }}"
         patch_bundle: "rh-sso-{{ sso_latest_version }}-patch.zip"
         patch_version: "{{ sso_latest_version }}"
-      when: sso_patch_version is not defined or sso_patch_version | length == 0
+      when: (sso_patch_version | default('', true)) | length == 0
       delegate_to: localhost
       run_once: true
 
diff --git a/roles/keycloak/templates/standalone.xml.j2 b/roles/keycloak/templates/standalone.xml.j2
index 6c3c0f8..39b7614 100644
--- a/roles/keycloak/templates/standalone.xml.j2
+++ b/roles/keycloak/templates/standalone.xml.j2
@@ -526,7 +526,7 @@
                     <properties>
                         <property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
                         <property name="forceBackendUrlToFrontendUrl" value="{{ keycloak_modcluster.force_frontend_url }}"/>
-{% if keycloak_modcluster.admin_url | length > 0 %}
+{% if (keycloak_modcluster.admin_url | default('', true)) | length > 0 %}
                         <property name="adminUrl" value="{{ keycloak_modcluster.admin_url }}" />
 {% endif %}
                     </properties>
@@ -541,7 +541,7 @@
         <subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
 {% if keycloak_modcluster.enabled %}
         <subsystem xmlns="urn:jboss:domain:modcluster:5.0">
-            <proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product(keycloak_modcluster.reverse_proxy_urls | map(attribute='host')) | map('join') | list | join(' ') }}">
+            <proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product((keycloak_modcluster.reverse_proxy_urls | default([])) | map(attribute='host')) | map('join') | list | join(' ') }}">
                 <dynamic-load-provider>
                     <load-metric type="cpu"/>
                 </dynamic-load-provider>
diff --git a/roles/keycloak_quarkus/meta/argument_specs.yml b/roles/keycloak_quarkus/meta/argument_specs.yml
index e052b3e..2244420 100644
--- a/roles/keycloak_quarkus/meta/argument_specs.yml
+++ b/roles/keycloak_quarkus/meta/argument_specs.yml
@@ -564,5 +564,5 @@ argument_specs:
                 type: "str"
             rhbk_product_category:
                 default: "RHBK"
-                description: "JBossNetwork API category for Red Hat Build of Keycloak"
+                description: "Unified Downloads API category for Red Hat Build of Keycloak"
                 type: "str"