title: I receive a status 401 error: Unauthorized when i attempt to call my Secured API by keycloak
body: <p>I expose to you my problem.
  I have a webapp that call a REST API to find the cart of the client.
  The application and the API are secured with spring security and a SSO Keycloak.</p>
  
  <p>Actually, my webapp is functional, if my don't protect my api, all are ready.</p>
  
  <p>But when i want to secure my api with role, i have every time an error 401 error: unauthorized. In fact is good, my api is secured, but the client that have role "USER" can't access to his cart.</p>
  
  <p>When i attempt to take my bearer token to keycloak, is a good token (past in jwt.io). I attempted to use curl, but the result is same.</p>
  
  <p>I use Feign in my webapp to call the API.</p>
  
  <p>My Keycloak configuration in my api</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @ConditionalOnProperty(name = "keycloak.enabled", havingValue = "true", matchIfMissing = true)
  @ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
  public static class KeycloakConfigurationAdapter extends KeycloakWebSecurityConfigurerAdapter{
  
      @Bean
      @Override
      protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
          return new NullAuthenticatedSessionStrategy();
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
          keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
          auth.authenticationProvider(keycloakAuthenticationProvider);
      }
  
      @Bean
      public KeycloakConfigResolver KeycloakConfigResolver(){
          return new KeycloakSpringBootConfigResolver();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
                  .csrf().disable()
                  .sessionManagement()
                      .sessionAuthenticationStrategy(sessionAuthenticationStrategy())
                      .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  
                  .and()
                      .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
                      .addFilterBefore(keycloakAuthenticationProcessingFilter(), X509AuthenticationFilter.class)
                      .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
  
                  .and()
                      .authorizeRequests().antMatchers(HttpMethod.OPTIONS).permitAll()
                      .antMatchers("/paniers/**").hasAuthority("USER")
                      .antMatchers("/commandes/**").hasRole("USER")
                      .anyRequest().permitAll();
      }
  }
  </code></pre>
  
  <p>My .properties for API</p>
  
  <pre><code>keycloak.auth-server-url=http://myserver:port/auth
  keycloak.realm=wild_adventures
  keycloak.resource=ms-commande
  keycloak.credentials.secret=#######-####-####-####-###########
  keycloak.bearer-only=true
  </code></pre>
  
  <p>My method in the controller of the api</p>
  
  <pre><code>@ApiOperation(value = "Récupère le panier avec la liste des évenements réservés ou renvoie un 404 NotFound")
  @GetMapping(value = "paniers/{clientUuid}")
  public Panier recupererPanier(@PathVariable(value = "clientUuid") String clientUuid) {
  
      Panier panier = this.panierManager.getPanierByClientUuid(clientUuid);
  
      if(panier == null)
          throw new PanierInexistantException("Le panier n'a pas été trouvé");
  
      return panier;
  }
  </code></pre>
  
  <p>Thx for your help.</p>