Keycloak: Can not authenticate user using Spring Security Adapter
<p>I will appreciate your help on the issue below.
I try to configure Spring Security Adapter (version 2.3.0.Final):
<a href="https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/java/spring-security-adapter.html" rel="nofollow noreferrer">https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/java/spring-security-adapter.html</a></p>

<p>I suppose that Keycloak uses the static client registration since when I tries to connect without the client configuration in Keycloak I get the following:</p>

<pre><code>16:15:43,174 WARN  [org.keycloak.events] (default task-3) type=LOGIN_ERROR, realmId=master, clientId=st_1, userId=null, ipAddress=192.168.111.33, error=client_not_found
</code></pre>

<p>Please note that I do success to work with mod-auth-openidc and mitreid clients. </p>

<p>I am not sure what is “Valid Redirect URIs” and I have configured the following value in IDP:
<a href="http://192.168.110.2:8081/app/sso/login" rel="nofollow noreferrer">http://192.168.110.2:8081/app/sso/login</a></p>

<p>Now the client redirects to Keycloak IDP using this URL
<a href="http://192.168.110.2:8080/auth/realms/master/protocol/openid-connect/auth?response_type=code&amp;client_id=testclient&amp;redirect_uri=http%3A%2F%2F192.168.110.2%3A8081%2Fapp%2Fsso%2Flogin&amp;state=10%2Fc0079a4b-e896-4400-9357-77fdacde9a56&amp;login=true&amp;scope=openid" rel="nofollow noreferrer">http://192.168.110.2:8080/auth/realms/master/protocol/openid-connect/auth?response_type=code&amp;client_id=testclient&amp;redirect_uri=http%3A%2F%2F192.168.110.2%3A8081%2Fapp%2Fsso%2Flogin&amp;state=10%2Fc0079a4b-e896-4400-9357-77fdacde9a56&amp;login=true&amp;scope=openid</a></p>

<p>I authenticate the user and IDP returns URL back to the client using this URL:
<a href="http://192.168.110.2:8081/app/sso/login?state=14%2F9a4376fa-06e2-4188-a616-a182363dab3a&amp;code=JzKXHOm7jRp5pkfT6GT6rRPZ5HOcZyGEB5uA-fjrk1I.7d91a145-76a5-4bc4-960f-f4a67f242fba" rel="nofollow noreferrer">http://192.168.110.2:8081/app/sso/login?state=14%2F9a4376fa-06e2-4188-a616-a182363dab3a&amp;code=JzKXHOm7jRp5pkfT6GT6rRPZ5HOcZyGEB5uA-fjrk1I.7d91a145-76a5-4bc4-960f-f4a67f242fba</a></p>

<p>Unfortunately then I have the endless loop.
While I debug KeycloakAuthenticationProcessingFilter I see that AuthOutcome get value NOT_ATTEMPTED and it cause additional redirect to IDP.
What I have missed?
keycloak.json</p>

<pre><code>{
  "realm" : "master",
  "resource" : "st_1",
  "auth-server-url" : "http://192.168.110.2:8080/auth",
  "ssl-required" : "none",
  "use-resource-role-mappings" : false,
  "enable-cors" : true,
  "cors-max-age" : 1000,
  "cors-allowed-methods" : "POST, PUT, DELETE, GET",
  "bearer-only" : false,
  "enable-basic-auth" : false,
  "expose-token" : true,
  "credentials" : {
    "secret" : "bc644880-5544-4110-8e05-5bbd2a95b3e2"
  },

  "connection-pool-size" : 20,
  "disable-trust-manager": true,
  "allow-any-hostname" : true,
  "token-minimum-time-to-live" : 10

}
</code></pre>

<p>spring-security.xml</p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;

&lt;!--
  - Sample namespace-based configuration
  -
  --&gt;


&lt;beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
                        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"&gt;




    &lt;sec:global-method-security pre-post-annotations="enabled"&gt;
        &lt;!-- AspectJ pointcut expression that locates our "post" method and applies security that way
        &lt;protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/&gt;
        --&gt;
    &lt;/sec:global-method-security&gt;

    &lt;context:component-scan base-package="org.keycloak.adapters.springsecurity" /&gt;





    &lt;sec:http use-expressions="true" disable-url-rewriting="false" entry-point-ref="keycloakAuthenticationEntryPoint"&gt;
        &lt;sec:intercept-url pattern="/**" access="isAuthenticated()"/&gt;
        &lt;sec:csrf disabled="true"/&gt;
        &lt;sec:headers disabled="true"/&gt;
        &lt;sec:custom-filter ref="keycloakPreAuthActionsFilter" before="LOGOUT_FILTER" /&gt;
        &lt;sec:custom-filter ref="keycloakAuthenticationProcessingFilter" before="FORM_LOGIN_FILTER" /&gt;
        &lt;sec:custom-filter ref="logoutFilter" position="LOGOUT_FILTER" /&gt;

    &lt;/sec:http&gt;


    &lt;sec:authentication-manager alias="authenticationManager"&gt;
        &lt;sec:authentication-provider ref="keycloakAuthenticationProvider" /&gt;
    &lt;/sec:authentication-manager&gt;

    &lt;bean id="adapterDeploymentContext" class="org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean"&gt;
        &lt;constructor-arg value="/WEB-INF/keycloak/keycloak.json" /&gt;
    &lt;/bean&gt;

    &lt;bean id="keycloakAuthenticationEntryPoint" class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationEntryPoint" /&gt;
    &lt;bean id="keycloakAuthenticationProvider" class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider" /&gt;
    &lt;bean id="keycloakPreAuthActionsFilter" class="org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter" /&gt;
    &lt;bean id="keycloakAuthenticationProcessingFilter" class="org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter"&gt;
        &lt;constructor-arg name="authenticationManager" ref="authenticationManager" /&gt;
    &lt;/bean&gt;

    &lt;bean id="keycloakLogoutHandler" class="org.keycloak.adapters.springsecurity.authentication.KeycloakLogoutHandler"&gt;
        &lt;constructor-arg ref="adapterDeploymentContext" /&gt;
    &lt;/bean&gt;

    &lt;bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
        &lt;constructor-arg name="logoutSuccessUrl" value="/" /&gt;
        &lt;constructor-arg name="handlers"&gt;
            &lt;list&gt;
                &lt;ref bean="keycloakLogoutHandler" /&gt;
                &lt;bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" /&gt;
            &lt;/list&gt;
        &lt;/constructor-arg&gt;
        &lt;property name="logoutRequestMatcher"&gt;
            &lt;bean class="org.springframework.security.web.util.matcher.AntPathRequestMatcher"&gt;
                &lt;constructor-arg name="pattern" value="/sso/logout**" /&gt;
                &lt;constructor-arg name="httpMethod" value="GET" /&gt;
            &lt;/bean&gt;
        &lt;/property&gt;
    &lt;/bean&gt;




&lt;/beans&gt;
</code></pre>