Customize keycloak error page with spring boot

I found a way to do this to a certain degree in current spring-security-web (5.4+) versions.

/**
 * A {@link RequestRejectedHandler} for spring security web's application firewall.
 */
@Component
public class FirewallRequestRejectedHandler implements RequestRejectedHandler {

    private static final Logger LOGGER = LoggerFactory.getLogger(FirewallRequestRejectedHandler.class);

    @Override
    public void handle(
            final HttpServletRequest request,
            final HttpServletResponse response,
            final RequestRejectedException requestRejectedException) throws IOException {

        // Optionally write a warning to the logs
        LOGGER.warn("Application firewall: {}", requestRejectedException.getMessage(),
                LOGGER.isDebugEnabled() ? requestRejectedException : null);

        // Make the exception accessible to the ErrorController
        request.setAttribute(RequestDispatcher.ERROR_EXCEPTION, requestRejectedException );

        // Call error controller
        response.sendError(401, "Access denied");
    }

}

This will call the ErrorController which contains my fallback error handling logic, which results in the correct response being sent.

Hello friend！Overriding class method challengeResponse() be addressed

org.keycloak.adapters.BearerTokenRequestAuthenticator.challengeResponse( HttpFacade facade, final OIDCAuthenticationError.Reason reason, final String error, final String description )

This is how I enhanced keycloak-json-response-spring-boot-starter

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-json-response-spring-boot-starter</artifactId>
    <version>18.0.0</version>
    <name>keycloak-json-response-spring-boot-starter</name>
    <description>keycloak-json-response-spring-boot-starter</description>
    
    <!-- Omit some configuration ... -->

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.keycloak.bom</groupId>
                <artifactId>keycloak-adapter-bom</artifactId>
                <version>${keycloak.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-spring-boot-starter</artifactId>
        </dependency>
    </dependencies>

    <!-- Omit some configuration ... -->

Create the same package and class and then embed the code in the method

package org.keycloak.adapters;

@SuppressWarnings( "unused" )
public class BearerTokenRequestAuthenticator {

    protected AuthChallenge challengeResponse( HttpFacade facade, final OIDCAuthenticationError.Reason reason, final String error, final String description ) {
        StringBuilder header = new StringBuilder( "Bearer realm=\"" );
        header.append( deployment.getRealm( ) ).append( "\"" );

        // addon begin
        Map< String, String > responseBody = new LinkedHashMap<>( );
        HttpFacade.Response response = facade.getResponse( );
        // addon end

        // addon begin
        if ( reason == OIDCAuthenticationError.Reason.NO_BEARER_TOKEN ) {
            response.setStatus( 401 );
            responseBody.put( "error", "unauthorized" );
            responseBody.put( "error_description", "Not Token! To login." );
        }
        // addon end

        if ( error != null ) {
            header.append( ", error=\"" ).append( error ).append( "\"" );
            // addon begin
            responseBody.put( "error", error );
            response.setStatus( 403 );
            // addon end
        }
        if ( description != null ) {
            header.append( ", error_description=\"" ).append( description ).append( "\"" );
            // addon begin
            responseBody.put( "error_description", description );
            response.setStatus( 403 );
            // addon end
        }
        final String challenge = header.toString( );

        // addon begin
        try {
            if ( !responseBody.isEmpty( ) ) {
                response.setHeader( "Content-Type", "application/json" );
                OutputStream responseOutputStream = response.getOutputStream( );
                responseOutputStream.write( new ObjectMapper( ).writeValueAsBytes( responseBody ) );
                responseOutputStream.flush( );
            }
        } catch ( IOException e ) {
            e.printStackTrace( );
        }
        // addon end


        return new AuthChallenge( ) {
            @Override
            public int getResponseCode( ) {
                return 401;
            }

            @Override
            public boolean challenge( HttpFacade facade ) {
                if ( deployment.getPolicyEnforcer( ) != null ) {
                    deployment.getPolicyEnforcer( ).enforce( ( OIDCHttpFacade ) facade );
                    return true;
                }
                OIDCAuthenticationError error = new OIDCAuthenticationError( reason, description );
                facade.getRequest( ).setError( error );
                facade.getResponse( ).addHeader( "WWW-Authenticate", challenge );
                if ( deployment.isDelegateBearerErrorResponseSending( ) ) {
                    facade.getResponse( ).setStatus( 401 );
                } else {
                    facade.getResponse( ).sendError( 401 );
                }
                return true;
            }
        };
    }

}

Don't forget to copy the rest of the code in the class and Replace your keycloak-spring-boot-starter with keycloak-json-response-spring-boot-starter

I don't know whether something changed in recent keycloak/spring-boot versions, but now I had to configure the following in my org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter:

    @Override
    protected KeycloakAuthenticationProcessingFilter keycloakAuthenticationProcessingFilter() throws Exception {
        final KeycloakAuthenticationProcessingFilter filter = super.keycloakAuthenticationProcessingFilter();
        // Don't run for error handling
        filter.setRequiresAuthenticationRequestMatcher(new AndRequestMatcher(
                KeycloakAuthenticationProcessingFilter.DEFAULT_REQUEST_MATCHER,
                new NegatedRequestMatcher(new AntPathRequestMatcher(ERROR_HANDLING_PATH))));
        
        return filter;
    }

• spring-boot 2.6
• keycloak 16