Spring security keycloak adapter bearer configuration
<p>I have java REST application that I wish to protect by keycloak. I did some tests, application works well with keycloak servlet filter but I'm having issues with spring security adapter.</p>

<p>keycloak.json (values deleted)</p>

<pre><code>{
  "realm": "",
  "realm-public-key": "",
  "bearer-only": true,
  "auth-server-url": "",
  "ssl-required": "external",
  "resource": ""
}
</code></pre>

<p>As visible I need only bearer authorization, If request contains valid token then I expect http 200 if not http 401. I used this xml configuration:</p>

<pre><code>&lt;security:global-method-security  jsr250-annotations="enabled"/&gt;

    &lt;security:authentication-manager alias="authenticationManager"&gt;
        &lt;security:authentication-provider ref="keycloakAuthenticationProvider"/&gt;
    &lt;/security:authentication-manager&gt;


    &lt;bean id="keycloakAuthenticationEntryPoint"
                class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationEntryPoint"&gt;
            &lt;/bean&gt;
    &lt;bean id="keycloakAuthenticationProvider"
                class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider"&gt;
        &lt;property name="grantedAuthoritiesMapper"&gt;
            &lt;bean class="org.springframework.security.core.authority.mapping.SimpleAuthorityMapper"&gt;
                &lt;property name="convertToUpperCase" value="true"/&gt;
                &lt;property name="prefix" value="ROLE_"/&gt;
            &lt;/bean&gt;

        &lt;/property&gt;
    &lt;/bean&gt;

    &lt;bean id="keycloakPreAuthActionsFilter"
                class="org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter"/&gt;
    &lt;bean id="keycloakAuthenticationProcessingFilter"
                class="org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter"&gt;
        &lt;constructor-arg name="authenticationManager" ref="authenticationManager"/&gt;
    &lt;/bean&gt;

    &lt;bean id="adapterDeploymentContext" class="org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean"&gt;
        &lt;constructor-arg value="/WEB-INF/keycloak.json" /&gt;
    &lt;/bean&gt;


    &lt;security:http auto-config="false" entry-point-ref="keycloakAuthenticationEntryPoint" create-session="stateless"&gt;
        &lt;security:custom-filter ref="keycloakPreAuthActionsFilter" before="LOGOUT_FILTER" /&gt;
        &lt;security:custom-filter ref="keycloakAuthenticationProcessingFilter" before="FORM_LOGIN_FILTER"/&gt;


        &lt;security:intercept-url pattern="*" access="permitAll()" /&gt;
        &lt;security:intercept-url pattern="/services/protected/*" access="isFullyAuthenticated()" /&gt;
        &lt;security:csrf disabled="true"/&gt;
    &lt;/security:http&gt;
</code></pre>

<p>What is really happening? Request is authenticated however after success I'm redirected to '/'. Then I'm authenticated again and again. 
Logs:</p>

<pre><code>11:18:36,492 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 2 of 9 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 3 of 9 in additional filter chain; firing Filter: 'HeaderWriterFilter'
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 4 of 9 in additional filter chain; firing Filter: 'KeycloakPreAuthActionsFilter'
11:18:36,508 DEBUG [org.keycloak.adapters.PreAuthActionsHandler] (http-0.0.0.0:8080-4) adminRequest http://test.srv:8080/core2/services/protected/getAttributes
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 5 of 9 in additional filter chain; firing Filter: 'KeycloakAuthenticationProcessingFilter'
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0.0:8080-4) Trying to match using Ant [pattern='/sso/login']
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.AntPathRequestMatcher] (http-0.0.0.0:8080-4) Checking match of request : '/services/protected/getAttributes'; against '/sso/login'
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0.0:8080-4) Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=Authorization, expectedHeaderValue=null]
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0`enter code here`.0:8080-4) matched
11:18:36,508 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Request is to process authentication
11:18:36,508 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Attempting Keycloak authentication
11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.authentication.SpringSecurityRequestAuthenticator] (http-0.0.0.0:8080-4) Completing bearer authentication. Bearer roles: [uma_authorization] 
11:18:36,555 DEBUG [org.keycloak.adapters.RequestAuthenticator] (http-0.0.0.0:8080-4) User 'e9ae6919-c0f3-4dcb-96f6-82e3373932e9' invoking 'http://test.srv:8080/core2/services/protected/getAttributes' on client 'mak_test'
11:18:36,555 DEBUG [org.keycloak.adapters.RequestAuthenticator] (http-0.0.0.0:8080-4) Bearer AUTHENTICATED
11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Auth outcome: AUTHENTICATED
11:18:36,555 DEBUG [org.springframework.security.authentication.ProviderManager] (http-0.0.0.0:8080-4) Authentication attempt using org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider
11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Authentication success. Updating SecurityContextHolder to contain: org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken@65776c48: Principal: e9ae6919-c0f3-4dcb-96f6-82e3373932e9; Credentials: [PROTECTED]; Authenticated: true; Details: org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount@44667d3a; Granted Authorities: ROLE_UMA_AUTHORIZATION
11:18:36,555 DEBUG [org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler] (http-0.0.0.0:8080-4) Using default Url: /
11:18:36,555 DEBUG [org.springframework.security.web.DefaultRedirectStrategy] (http-0.0.0.0:8080-4) Redirecting to '/core2/'
11:18:36,555 DEBUG [org.springframework.security.web.header.writers.HstsHeaderWriter] (http-0.0.0.0:8080-4) Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@159e9b90
11:18:36,555 DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] (http-0.0.0.0:8080-4) SecurityContextHolder now cleared, as request processing completed
11:18:36,570 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) / at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
</code></pre>

<p>I'm testing this endpoit by Junit</p>

<pre><code>@Test
    public void protectedTest() throws IOException {
        String token = getToken();
        long time1 = System.currentTimeMillis();
        String url =  server + "/services/protected/getAttributes";
        URL obj = new URL(url);
        HttpURLConnection con = (HttpURLConnection) obj.openConnection();
        con.setRequestMethod("GET");
        con.setRequestProperty("Authorization", token);
        Assert.assertEquals(200, con.getResponseCode());
        System.out.print(String.format("Authorized time: %s ms ", (System.currentTimeMillis() - time1)));
    }
</code></pre>

<p>Endpoint code:</p>

<pre><code>@RestController
public class ProtectedService {

    @RequestMapping(value = "/services/protected/getAttributes",
            method = RequestMethod.GET,
            produces = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE})
    @ResponseBody
    @RolesAllowed("ROLE_UMA_AUTHORIZATION")
    public GetCustAttrsRes getAttributes() {
        return new GetCustAttrsRes();
    }
}
</code></pre>

<p>Keycloak server version: 2.1.0.Final</p>

<p>Keycloak related pom part:</p>

<pre><code>&lt;dependency&gt;
            &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
            &lt;artifactId&gt;keycloak-spring-security-adapter&lt;/artifactId&gt;
            &lt;version&gt;2.2.1.Final&lt;/version&gt;
        &lt;/dependency&gt;
  &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
            &lt;version&gt;4.1.3.RELEASE&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
            &lt;version&gt;4.1.3.RELEASE&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
            &lt;version&gt;4.1.3.RELEASE&lt;/version&gt;
        &lt;/dependency&gt;
</code></pre>

<p>Any suggestions welcomed.</p>