title: keycloak (spring boot) Not authenticating REST endpoint
body: <p>I am trying to play around with open source user management service like keycloak. Building a angularJs app that will be send HTTP request to REST endpoint secured by keycloak. I am using spring boot on the backend. I am able to call the endpoint and get result which should not be possible since it should block request coming from unauthorized source. </p>
  
  <p>These are the two links that I followed</p>
  
  <ol>
  <li><a href="http://slackspace.de/articles/authentication-with-spring-boot-angularjs-and-keycloak/" rel="nofollow noreferrer">keycloak with angular and spring boot</a></li>
  </ol>
  
  <p>2.<a href="https://github.com/iuliazidaru/keycloak-spring-boot-rest-angular-demo" rel="nofollow noreferrer">Github link to keycloak example</a></p>
  
  <p>Controller which consists of REST endpoint that the user will call.</p>
  
  <pre><code>@RequestMapping(value = "/api/getSample")
  public test welcome() {
      return new test("sample");
  }
  
  @RequestMapping(value = "/check/test")
  public test welcome2() {
      return new test("test");
  }
  </code></pre>
  
  <p>Spring boot application with CORS</p>
  
  <pre><code>@SpringBootApplication
  public class Application 
  {
      public static void main( String[] args )
      {
          SpringApplication.run(Application.class, args);
      }
  
      @Bean
      public FilterRegistrationBean corsFilter() {
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          CorsConfiguration config = new CorsConfiguration();
          config.setAllowCredentials(true);
          config.addAllowedOrigin("*");
          config.addAllowedHeader("*");
          config.addAllowedMethod("*");
          source.registerCorsConfiguration("/api/*", config);
  
          FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
          bean.setOrder(0);
          return bean;
      }
  }
  </code></pre>
  
  <p>Application properties files for</p>
  
  <pre><code>server.port = 8090
  
  keycloak.realm = demo
  keycloak.auth-server-url = http://localhost:8080/auth
  keycloak.ssl-required = external
  keycloak.resource = tutorial-backend
  keycloak.bearer-only = true
  keycloak.credentials.secret = 111-1111-111-111
  keycloak.use-resource-role-mappings = true
  keycloak.cors= true
  
  keycloak.securityConstraints[0].securityCollections[0].name = spring secured api
  keycloak.securityConstraints[0].securityCollections[0].authRoles[0] = user
  keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /api
  
  keycloak.securityConstraints[0].securityCollections[1].name = insecure stuff
  keycloak.securityConstraints[0].securityCollections[1].authRoles[0] = user
  keycloak.securityConstraints[0].securityCollections[1].patterns[0] = /check
  </code></pre>
  
  <p>There are two test case</p>
  
  <ol>
  <li><p>Making REST call without logging in. In this case I am able to get the result back. This should not be the case, I get should blocked(get 401 error).</p></li>
  <li><p>Making REST call when logged in. I am able to call the api/getSample and this is the correct behavior. However when I call check/test I get <code>XMLHttpRequest cannot load http://localhost:8090/check/test. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9000' is therefore not allowed access. The response had HTTP status code 403.</code></p></li>
  </ol>