Keycloak with Spring Boot - Security Filter Not Being Applied

Viewed 405

I am attempting to secure a Spring Boot (with Spring Security) app using Keycloak. I am following these guides:

  1. https://www.keycloak.org/docs/16.1/securing_apps/index.html#_spring_boot_adapter
  2. https://www.baeldung.com/spring-boot-keycloak

However, the authentication is simply not working; e.g., I can view web pages without being redirected to Keycloak/authenticating. I do not see any errors, however, I notice the following in the console: o.s.s.web.DefaultSecurityFilterChain : Will not secure any request

I am not sure if the above is the root problem or if that is expected because Keycloak overides the chain or something?

My KeycloakWebSecurityConfigurerAdapter

@KeycloakConfiguration
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

        KeycloakAuthenticationProvider keycloakAuthenticationProvider =
                keycloakAuthenticationProvider();
        keycloakAuthenticationProvider
                .setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests().anyRequest().authenticated();
    }
}

Relevant application properties:


keycloak.realm = myrealm
keycloak.auth-server-url = https://example.com/auth
keycloak.ssl-required = external
keycloak.resource = client-id
keycloak.credentials.secret = pass

I configured a @Bean as follows:

    @Bean
    public KeycloakSpringBootConfigResolver keycloakConfigResolver() {
        return new KeycloakSpringBootConfigResolver();
    }

Relevant dependencies:

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-jdbc'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.keycloak:keycloak-spring-boot-starter:16.1.0'
    implementation 'org.mybatis.spring.boot:mybatis-spring-boot-starter:2.2.2'
    implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5'


    runtimeOnly 'org.postgresql:postgresql'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
    testImplementation 'org.springframework.security:spring-security-test'
}

0 Answers
Related