diff --git a/xpra/server/auth/keycloak_auth.py b/xpra/server/auth/keycloak_auth.py
index c91f6d6131..0b14a25f33 100644
--- a/xpra/server/auth/keycloak_auth.py
+++ b/xpra/server/auth/keycloak_auth.py
@@ -105,9 +105,16 @@ def check(self, response_json) -> bool:
             return False
 
         try:
+            # pylint: disable=import-outside-toplevel
             from keycloak import KeycloakOpenID
             from keycloak.exceptions import KeycloakError
+        except ImportError as e:
+            log("check(..)", exc_info=True)
+            log.warn("Warning: cannot use keycloak authentication:")
+            log.warn(" %s", e)
+            return False
 
+        try:
             # Configure client
             keycloak_openid = KeycloakOpenID(server_url=self.server_url,
                               client_id=self.client_id,
@@ -153,11 +160,6 @@ def check(self, response_json) -> bool:
             log.error("Error: keycloak authentication failed")
             log.error(" error code %s: %s", e.response_code, e.error_message)
             return False
-        except ImportError as e:
-            log("check(..)", exc_info=True)
-            log.warn("Warning: cannot use keycloak authentication:")
-            log.warn(" %s", e)
-            return False
 
 
 def main(args): # pragma: no cover