title: Spring security keycloak adapter bearer configuration
body: <p>I have java REST application that I wish to protect by keycloak. I did some tests, application works well with keycloak servlet filter but I'm having issues with spring security adapter.</p>
  
  <p>keycloak.json (values deleted)</p>
  
  <pre><code>{
    "realm": "",
    "realm-public-key": "",
    "bearer-only": true,
    "auth-server-url": "",
    "ssl-required": "external",
    "resource": ""
  }
  </code></pre>
  
  <p>As visible I need only bearer authorization, If request contains valid token then I expect http 200 if not http 401. I used this xml configuration:</p>
  
  <pre><code>&lt;security:global-method-security  jsr250-annotations="enabled"/&gt;
  
      &lt;security:authentication-manager alias="authenticationManager"&gt;
          &lt;security:authentication-provider ref="keycloakAuthenticationProvider"/&gt;
      &lt;/security:authentication-manager&gt;
  
  
      &lt;bean id="keycloakAuthenticationEntryPoint"
                  class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationEntryPoint"&gt;
              &lt;/bean&gt;
      &lt;bean id="keycloakAuthenticationProvider"
                  class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider"&gt;
          &lt;property name="grantedAuthoritiesMapper"&gt;
              &lt;bean class="org.springframework.security.core.authority.mapping.SimpleAuthorityMapper"&gt;
                  &lt;property name="convertToUpperCase" value="true"/&gt;
                  &lt;property name="prefix" value="ROLE_"/&gt;
              &lt;/bean&gt;
  
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="keycloakPreAuthActionsFilter"
                  class="org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter"/&gt;
      &lt;bean id="keycloakAuthenticationProcessingFilter"
                  class="org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter"&gt;
          &lt;constructor-arg name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="adapterDeploymentContext" class="org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean"&gt;
          &lt;constructor-arg value="/WEB-INF/keycloak.json" /&gt;
      &lt;/bean&gt;
  
  
      &lt;security:http auto-config="false" entry-point-ref="keycloakAuthenticationEntryPoint" create-session="stateless"&gt;
          &lt;security:custom-filter ref="keycloakPreAuthActionsFilter" before="LOGOUT_FILTER" /&gt;
          &lt;security:custom-filter ref="keycloakAuthenticationProcessingFilter" before="FORM_LOGIN_FILTER"/&gt;
  
  
          &lt;security:intercept-url pattern="*" access="permitAll()" /&gt;
          &lt;security:intercept-url pattern="/services/protected/*" access="isFullyAuthenticated()" /&gt;
          &lt;security:csrf disabled="true"/&gt;
      &lt;/security:http&gt;
  </code></pre>
  
  <p>What is really happening? Request is authenticated however after success I'm redirected to '/'. Then I'm authenticated again and again. 
  Logs:</p>
  
  <pre><code>11:18:36,492 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 2 of 9 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 3 of 9 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 4 of 9 in additional filter chain; firing Filter: 'KeycloakPreAuthActionsFilter'
  11:18:36,508 DEBUG [org.keycloak.adapters.PreAuthActionsHandler] (http-0.0.0.0:8080-4) adminRequest http://test.srv:8080/core2/services/protected/getAttributes
  11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 5 of 9 in additional filter chain; firing Filter: 'KeycloakAuthenticationProcessingFilter'
  11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0.0:8080-4) Trying to match using Ant [pattern='/sso/login']
  11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.AntPathRequestMatcher] (http-0.0.0.0:8080-4) Checking match of request : '/services/protected/getAttributes'; against '/sso/login'
  11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0.0:8080-4) Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=Authorization, expectedHeaderValue=null]
  11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0`enter code here`.0:8080-4) matched
  11:18:36,508 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Request is to process authentication
  11:18:36,508 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Attempting Keycloak authentication
  11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.authentication.SpringSecurityRequestAuthenticator] (http-0.0.0.0:8080-4) Completing bearer authentication. Bearer roles: [uma_authorization] 
  11:18:36,555 DEBUG [org.keycloak.adapters.RequestAuthenticator] (http-0.0.0.0:8080-4) User 'e9ae6919-c0f3-4dcb-96f6-82e3373932e9' invoking 'http://test.srv:8080/core2/services/protected/getAttributes' on client 'mak_test'
  11:18:36,555 DEBUG [org.keycloak.adapters.RequestAuthenticator] (http-0.0.0.0:8080-4) Bearer AUTHENTICATED
  11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Auth outcome: AUTHENTICATED
  11:18:36,555 DEBUG [org.springframework.security.authentication.ProviderManager] (http-0.0.0.0:8080-4) Authentication attempt using org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider
  11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Authentication success. Updating SecurityContextHolder to contain: org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken@65776c48: Principal: e9ae6919-c0f3-4dcb-96f6-82e3373932e9; Credentials: [PROTECTED]; Authenticated: true; Details: org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount@44667d3a; Granted Authorities: ROLE_UMA_AUTHORIZATION
  11:18:36,555 DEBUG [org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler] (http-0.0.0.0:8080-4) Using default Url: /
  11:18:36,555 DEBUG [org.springframework.security.web.DefaultRedirectStrategy] (http-0.0.0.0:8080-4) Redirecting to '/core2/'
  11:18:36,555 DEBUG [org.springframework.security.web.header.writers.HstsHeaderWriter] (http-0.0.0.0:8080-4) Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@159e9b90
  11:18:36,555 DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] (http-0.0.0.0:8080-4) SecurityContextHolder now cleared, as request processing completed
  11:18:36,570 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) / at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  </code></pre>
  
  <p>I'm testing this endpoit by Junit</p>
  
  <pre><code>@Test
      public void protectedTest() throws IOException {
          String token = getToken();
          long time1 = System.currentTimeMillis();
          String url =  server + "/services/protected/getAttributes";
          URL obj = new URL(url);
          HttpURLConnection con = (HttpURLConnection) obj.openConnection();
          con.setRequestMethod("GET");
          con.setRequestProperty("Authorization", token);
          Assert.assertEquals(200, con.getResponseCode());
          System.out.print(String.format("Authorized time: %s ms ", (System.currentTimeMillis() - time1)));
      }
  </code></pre>
  
  <p>Endpoint code:</p>
  
  <pre><code>@RestController
  public class ProtectedService {
  
      @RequestMapping(value = "/services/protected/getAttributes",
              method = RequestMethod.GET,
              produces = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE})
      @ResponseBody
      @RolesAllowed("ROLE_UMA_AUTHORIZATION")
      public GetCustAttrsRes getAttributes() {
          return new GetCustAttrsRes();
      }
  }
  </code></pre>
  
  <p>Keycloak server version: 2.1.0.Final</p>
  
  <p>Keycloak related pom part:</p>
  
  <pre><code>&lt;dependency&gt;
              &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
              &lt;artifactId&gt;keycloak-spring-security-adapter&lt;/artifactId&gt;
              &lt;version&gt;2.2.1.Final&lt;/version&gt;
          &lt;/dependency&gt;
    &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
              &lt;version&gt;4.1.3.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
              &lt;version&gt;4.1.3.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
              &lt;version&gt;4.1.3.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
  </code></pre>
  
  <p>Any suggestions welcomed.</p>