title: HttpSecurity configuration does not work with Keycloak Adapter on Spring
body: <p>Complete code: <a href="https://github.com/czetsuya/Spring-Keycloak-with-REST-API" rel="nofollow noreferrer">https://github.com/czetsuya/Spring-Keycloak-with-REST-API</a></p>
  
  <p>I'm trying to implement a REST API in Spring secured by Keycloak (4.8.1) with a bearer-only client.</p>
  
  <p>Problem: configure(HttpSecurity http) is not respected and as long as the user is authenticated the REST endpoints are accessible.</p>
  
  <p>For example with .antMatchers("/admin*").hasRole("ADMIN"), /admin should only be accessible by a user with an ADMIN role, but I was able to access using a USER role.</p>
  
  <p>I also tried setting the security-constraints in application.yml (but didn't help):</p>
  
  <pre><code>  security-constraints:
    - auth-roles:
      - ADMIN
    - security-collections:
      - name: admin
      - patterns:
        - /admin*
  </code></pre>
  
  <p>Using @EnableGlobalMethodSecurity in combination with @PreAuthorize("hasRole('ADMIN')") can do the trick, but is there really no other way around?</p>
  
  <p>Here's the application.xml.</p>
  
  <pre><code>keycloak:
    enabled: true
    realm: dev
    auth-server-url: http://localhost:8083/auth
    ssl-required: external
    resource: dev-api
    bearer-only: true
    confidential-port: 0
    use-resource-role-mappings: false
    principal-attribute: preferred_username
  </code></pre>
  
  <p>Here are the dependencies on pom:</p>
  
  <pre><code>&lt;dependencies&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
          &lt;artifactId&gt;keycloak-spring-boot-starter&lt;/artifactId&gt;
      &lt;/dependency&gt;
      .....
  </code></pre>
  
  <p>And part of the SecurityConfig class:</p>
  
  <pre><code>@KeycloakConfiguration
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) {
          KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
          SimpleAuthorityMapper simpleAuthorityMapper = new SimpleAuthorityMapper();
          simpleAuthorityMapper.setConvertToUpperCase(true);
          keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(simpleAuthorityMapper);
          auth.authenticationProvider(keycloakAuthenticationProvider);
      }
  
      @Bean
      @Override
      protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
          return new NullAuthenticatedSessionStrategy();
      }
  
      @Bean
      public KeycloakConfigResolver keycloakConfigResolver() {
          return new KeycloakSpringBootConfigResolver();
      }
  
      @Autowired
      public KeycloakClientRequestFactory keycloakClientRequestFactory;
  
      @Bean
      @Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE)
      public KeycloakRestTemplate keycloakRestTemplate() {
          return new KeycloakRestTemplate(keycloakClientRequestFactory);
      }
  
      /**
       * Secure appropriate endpoints
       */
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          super.configure(http);
          http.authorizeRequests() //
                  .antMatchers("/users*").hasRole("USER") //
                  .antMatchers("/admin*").hasRole("ADMIN") //
                  .anyRequest().authenticated() //
                  .and().csrf().disable() //
          ;
      }
  </code></pre>
  
  <p>After enabling a verbose log. I found out that the security-constraints defined in application.yml are being applied, but not the constraints defined in the java class. </p>
  
  <p>Question now is how to use the java constraints instead of the application.yml defined.</p>