title: Securing Spring Boot service with keycloak - JWT token
body: <p>So, I'm using keycloak to secure my services. Client app gets access token from keycloak server and uses it to secure access to Spring boot app. I've configured my Spring Boot application with keycloak properties using bearer-only access type:</p>
  
  <pre><code>keycloak.realm = master
  keycloak.realmKey = ...
  keycloak.auth-server-url = http://localhost:8080/auth
  keycloak.ssl-required = external
  keycloak.resource = boot-app
  keycloak.bearer-only = true
  keycloak.cors = true
  </code></pre>
  
  <p>Spring boot keycloak starter:</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
      &lt;artifactId&gt;keycloak-spring-boot-starter&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>And configuring KeycloakWebSecurityConfigurerAdapter:</p>
  
  <pre><code>@Configuration
  @ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
  public class KeycloakSecurityConfig extends KeycloakWebSecurityConfigurerAdapter
  {
    /**
     * Registers the KeycloakAuthenticationProvider with the authentication manager.
     */
    @Autowired
    public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception
    {
      final KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
      keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
      auth.authenticationProvider(keycloakAuthenticationProvider);
    }
  
    @Bean
    public KeycloakConfigResolver keycloakConfigResolver()
    {
      return new KeycloakSpringBootConfigResolver();
    }
  
    /**
     * Defines the session authentication strategy.
     */
    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy()
    {
      return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }
  
    @Override
    protected void configure(final HttpSecurity http) throws Exception
    {
      super.configure(http);
      http
          .authorizeRequests()
          .antMatchers(
              "/v2/api-docs",
              "/configuration/ui",
              "/swagger-resources",
              "/configuration/security",
              "/swagger-ui.html",
              "/webjars/**",
              "/swagger-resources/configuration/ui",
              "/swagge‌​r-ui.html",
              "/swagger-resources/configuration/security").permitAll()
          .antMatchers("/*").hasRole("user")
          .anyRequest().authenticated();
    }
  }
  </code></pre>
  
  <p>Now, everything works fine. My question is: Bearer token is JWT token, all you need to decode it (and verify access) is public key, which is </p>
  
  <pre><code>keycloak.realmKey
  </code></pre>
  
  <p>Why would you need other settings, specificaly:</p>
  
  <pre><code>keycloak.auth-server-url
  </code></pre>
  
  <p>Isn't public key everything you need?</p>
  
  <p>Thanks in advance</p>