<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">
	<session-config>
		<session-timeout>30</session-timeout>
		<cookie-config>
			<name>SESSIONID</name>
		</cookie-config>
	</session-config>

	<security-constraint> 
		<web-resource-collection> 
			<url-pattern>/service/*</url-pattern> 
		</web-resource-collection> 
		<auth-constraint> 
			<role-name>user</role-name> 
		</auth-constraint> 
	</security-constraint> 

	<login-config>
		<auth-method>KEYCLOAK</auth-method> 
		<realm-name>cfg-classification</realm-name> 
	</login-config>

	<security-role> 
		<role-name>user</role-name> 
	</security-role> 

</web-app>

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">
	<session-config>
		<session-timeout>30</session-timeout>
		<cookie-config>
			<name>SESSIONID</name>
		</cookie-config>
	</session-config>

	<security-constraint> 
		<web-resource-collection> 
			<url-pattern>/service/*</url-pattern> 
		</web-resource-collection> 
		<auth-constraint> 
			<role-name>user</role-name>
			<role-name>cfg-admin</role-name>
		</auth-constraint> 
	</security-constraint> 

	<login-config>
		<auth-method>KEYCLOAK</auth-method> 
		<realm-name>cfg-classification</realm-name> 
	</login-config>

	<security-role> 
		<role-name>user</role-name> 
	</security-role> 

</web-app>

Add cfg-admin to auth constraint roles
Add cfg-admin to auth constraint roles