title: @RolesAllowed annotation always throw 403 error with Keycloak
body: <p>I'm a new one in Spring boot and have maybe a stupid question.
  I have a simple spring boot rest api application with spring security and oauth2. Outh2 broker is Keycloak
  So my security filter looks like this</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityAdditionalConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.cors()
                  .and()
                  .authorizeRequests()
                  .antMatchers(&quot;/api/**&quot;)
                  .authenticated()
                  .and()
                  .oauth2ResourceServer().jwt();
          http.csrf().disable().sessionManagement().sessionCreationPolicy(
                  SessionCreationPolicy.STATELESS);
      }
  
  }
  </code></pre>
  <p>Also I enable global method security</p>
  <pre><code>
  @Configuration
  @EnableGlobalMethodSecurity(jsr250Enabled = true, securedEnabled = true, prePostEnabled = true)
  public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
  }
  </code></pre>
  <p>But when I try to add @RolesAllowed('admin') to my controller method I always get 403 forbidden error
  Without annotations all works fine, without token I get 401 and if token expired 403.
  This is example of my jwt</p>
  <pre><code>{
    
    &quot;realm_access&quot;: {
      &quot;roles&quot;: [
        &quot;admin&quot;
      ]
    },
    &quot;resource_access&quot;: {
      &quot;edge_client&quot;: {
        &quot;roles&quot;: [
          &quot;cli_admin&quot;
        ]
      }
    },
    &quot;scope&quot;: &quot;profile web-origins email&quot;,
    &quot;email_verified&quot;: false,
    &quot;name&quot;: &quot;John Spartan&quot;,
    &quot;groups&quot;: [
      &quot;admin&quot;
    ],
    &quot;preferred_username&quot;: &quot;test_admin&quot;,
    &quot;given_name&quot;: &quot;John&quot;,
    &quot;family_name&quot;: &quot;Spartan&quot;
  }
  </code></pre>