title: Full authentication is required to access this resource with Spring Security and Keycloak
body: <p>I am trying to configure my <strong>Spring Security</strong> with <strong>Keycloak</strong>. I am using <strong>Spring Boot</strong>. I have the following dependencies in my pom.</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
      &lt;artifactId&gt;keycloak-spring-boot-starter&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
      &lt;artifactId&gt;keycloak-spring-security-adapter&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
      &lt;artifactId&gt;keycloak-tomcat8-adapter&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>I use the spring boot version <strong>1.5.7.RELEASE</strong>. And the keycloak version <strong>3.2.1.Final</strong>
  And the following properties in my <strong>application.properties</strong>:</p>
  
  <pre><code>keycloak.enabled=true
  keycloak.realm=test
  keycloak.auth-server-url=http://localhost:8080/auth
  keycloak.ssl-required=external
  keycloak.resource=rest
  keycloak.bearer-only=true
  keycloak.credentials.secret=&lt;secret&gt;
  keycloak.principal-attribute=preferred_username
  keycloak.security-constraints[0].authRoles[0]=application
  keycloak.security-constraints[0].securityCollections[0].name=spring secured api
  keycloak.security-constraints[0].securityCollections[0].patterns[0]=/api/**
  
  management.security.enabled=false
  </code></pre>
  
  <p>I don't have any other configuration. For my endpoints I use JAX-RS.
  To request my token I use the Chrome Application Postman. Here is the request:</p>
  
  <pre><code>POST /auth/realms/test/protocol/openid-connect/token HTTP/1.1
  Host: localhost:8080
  Cache-Control: no-cache
  Postman-Token: &lt;postman token&gt;
  Content-Type: application/x-www-form-urlencoded
  
  grant_type=password&amp;client_id=postman&amp;username=root&amp;password=12345678
  </code></pre>
  
  <p>And my application request:</p>
  
  <pre><code>GET /api/product HTTP/1.1
  Host: localhost:18888
  Authorization: Bearer &lt;keycloak token from the request above&gt;
  Cache-Control: no-cache
  Postman-Token: &lt;postman token&gt;
  </code></pre>
  
  <p>But my response is:</p>
  
  <pre><code>{
      "timestamp": &lt;timestamp&gt;,
      "status": 401,
      "error": "Unauthorized",
      "message": "Full authentication is required to access this resource",
      "path": "/api/product"
  }
  </code></pre>