title: Spring security with both SSO and form login
body: <p>My application had form login and now I want to integrate my freeIPA account using Keycloak.</p>
  
  <p>I have 2 <code>WebSecurityConfigurerAdapter</code> below</p>
  
  <p>SecurityConfiguration.java</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @Order(1)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      private final AccountDetailsService accountDetailsService;
  
      private static final String[] IGNORED_RESOURCE_LIST = new String[]{
              "/resources/**",
              "/static/**",
              "/webjars/**",
              "/plugins/**",
              "/imgs/**",
              "/fonts/**",
              "/vendors/**",
              "/flags/**",
              "/js/**",
              "/sso/login",
              "/css/**"};
  
      private static final String[] PERMIT_ALL_RESOURCE_LIST = new String[]{
              "/actuator/health/**",
              "/login/**",
              "/json/**",
              "/auth/**",
              "/error/**"};
  
      @Autowired
      public SecurityConfiguration(AccountDetailsService accountDetailsService) {
          this.accountDetailsService = accountDetailsService;
      }
  
      @Override
      public void configure(WebSecurity web) {
          web.ignoring().antMatchers(IGNORED_RESOURCE_LIST);
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) {
          auth.authenticationProvider(authenticationProvider());
      }
  
      @Bean
      public DaoAuthenticationProvider authenticationProvider() {
          DaoAuthenticationProvider authProvider
                  = new DaoAuthenticationProvider();
          authProvider.setUserDetailsService(accountDetailsService);
          authProvider.setPasswordEncoder(encoder());
          return authProvider;
      }
  
      @Bean
      public PasswordEncoder encoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Bean
      public SessionRegistry sessionRegistry() {
          return new SessionRegistryImpl();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();
  
          http.authorizeRequests()
                  .antMatchers(PERMIT_ALL_RESOURCE_LIST).permitAll()
                  .anyRequest().authenticated()
                  .and().formLogin().loginPage("/auth/login").failureUrl("/auth/login?message=error").permitAll()
                  .and().logout().permitAll();
  
          http.sessionManagement().maximumSessions(1).sessionRegistry(sessionRegistry()).expiredUrl("/auth/login");
      }
  }
  </code></pre>
  
  <p>and KeycloakSecurityConfig.java</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
  @Order(2)
  public class KeycloakSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
  
      @Autowired
      public void configureGlobal(
              AuthenticationManagerBuilder auth) throws Exception {
  
          KeycloakAuthenticationProvider keycloakAuthenticationProvider
                  = keycloakAuthenticationProvider();
          keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(
                  new SimpleAuthorityMapper());
          auth.authenticationProvider(keycloakAuthenticationProvider);
      }
  
      @Bean
      public KeycloakSpringBootConfigResolver KeycloakConfigResolver() {
          return new KeycloakSpringBootConfigResolver();
      }
  
      @Bean
      @Override
      protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
          return new RegisterSessionAuthenticationStrategy(
                  new SessionRegistryImpl());
      }
  
      @Bean
      public SessionRegistry sessionRegistry() {
          return new SessionRegistryImpl();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          super.configure(http);
          http.authorizeRequests().anyRequest().authenticated();
      }
  }
  </code></pre>
  
  <p>And from login page I had a button Login with Keycloak. It redirects to Keycloak login page using url <code>/sso/login</code> but after logged in I was redirected back to application login page.</p>
  
  <p>Can anybody enlight me this case. How can I implement both form login and SSO login in my application?</p>
  
  <p>Thanks in advance. Any help would be appreciated.</p>