title: Keycloak & Spring Boot authorization
body: <p>I'm trying to implement the correct flow for authorization using Keycloak and Spring Boot.</p>
  <p>I'd like to take advantage of the Authorization Policy Enforcing on Keycloak to reduce to the minimum the authorization code on Spring Application.
  Right now following several examples and official Keycloak documentation this is my configuration:</p>
  <p>In the application.properties:</p>
  <pre><code>keycloak.realm=TestRealm
  keycloak.resource=server-resources
  keycloak.auth-server-url=http://localhost:8080/auth
  keycloak.public-client=false
  keycloak.credentials.secret=xxxxxxxxxxxxxxxxxxxxx
  keycloak.principal-attribute=preferred_username
  keycloak.use-resource-role-mappings=true
  keycloak.ssl-required=external
  keycloak.verify-token-audience=true
  keycloak.confidential-port=0
  #keycloak.policy-enforcer-config.enforcement-mode=ENFORCING
  </code></pre>
  <p>Spring security configuration:</p>
  <pre><code>package com.keycloak.demo.config;
  
  import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
  import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
  import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Bean;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
  import org.springframework.security.core.session.SessionRegistryImpl;
  import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
  import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
  
  @KeycloakConfiguration
  public class SecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter {
  
      @Bean
      @Override
      protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
          return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) {
          SimpleAuthorityMapper grantedAuthorityMapper = new SimpleAuthorityMapper();
          grantedAuthorityMapper.setPrefix(&quot;&quot;);
  
          KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
          keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(grantedAuthorityMapper);
          auth.authenticationProvider(keycloakAuthenticationProvider);
      }
      
      
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          super.configure(http);
          http.authorizeRequests()
              .antMatchers(&quot;/&quot;).permitAll().anyRequest().authenticated();
      }
  }
  </code></pre>
  <p>With the above configuration I'm redirected to my Keycloak installation login page but the authorization part is not used.</p>
  <p>When I enable the property:</p>
  <pre><code>  keycloak.policy-enforcer-config.enforcement-mode=ENFORCING
  </code></pre>
  <p>I'm no longer redirected to Keycloak login but to an /sso/login path, which i do not have implemented.
  I'm quite new to Keycloak and I'm probably missing something on how to properly setup the adapter. I'm trying to understand if I need to put all the configuration I have in keycloak for the resources :</p>
  <pre><code>{
    &quot;allowRemoteResourceManagement&quot;: true,
    &quot;policyEnforcementMode&quot;: &quot;ENFORCING&quot;,
    &quot;resources&quot;: [
      {
        &quot;name&quot;: &quot;archivio-1&quot;,
        &quot;type&quot;: &quot;archivio:one&quot;,
        &quot;ownerManagedAccess&quot;: false,
        &quot;displayName&quot;: &quot;archivio-1&quot;,
        &quot;attributes&quot;: {},
        &quot;_id&quot;: &quot;afb90d93-91a2-430e-9c10-36f22167d1fb&quot;,
        &quot;uris&quot;: [
          &quot;/archives/1&quot;
        ],
        &quot;scopes&quot;: [....
  </code></pre>
  <p>For now I'd like to understand why the login redirection has changed just after setting</p>
  <blockquote>
  <p>keycloak.policy-enforcer-config.enforcement-mode=ENFORCING</p>
  </blockquote>
  <p>POM:</p>
  <pre><code>&lt;project xmlns=&quot;http://maven.apache.org/POM/4.0.0&quot;
      xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot;
      xsi:schemaLocation=&quot;http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd&quot;&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
      &lt;parent&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
          &lt;version&gt;2.6.4&lt;/version&gt;
          &lt;relativePath /&gt; &lt;!-- lookup parent from repository --&gt;
      &lt;/parent&gt;
      &lt;groupId&gt;com.keycloak&lt;/groupId&gt;
      &lt;artifactId&gt;DemoKeycloak&lt;/artifactId&gt;
      &lt;version&gt;0.0.1-SNAPSHOT&lt;/version&gt;
      &lt;name&gt;DemoKeycloak&lt;/name&gt;
      &lt;description&gt;Demo project for Spring Boot&lt;/description&gt;
      &lt;properties&gt;
          &lt;java.version&gt;17&lt;/java.version&gt;
      &lt;/properties&gt;
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-thymeleaf&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.keycloak&lt;/groupId&gt;
              &lt;artifactId&gt;keycloak-spring-boot-starter&lt;/artifactId&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
      &lt;dependencyManagement&gt;
          &lt;dependencies&gt;
              &lt;dependency&gt;
                  &lt;groupId&gt;org.keycloak.bom&lt;/groupId&gt;
                  &lt;artifactId&gt;keycloak-adapter-bom&lt;/artifactId&gt;
                  &lt;version&gt;13.0.1&lt;/version&gt;
                  &lt;type&gt;pom&lt;/type&gt;
                  &lt;scope&gt;import&lt;/scope&gt;
              &lt;/dependency&gt;
          &lt;/dependencies&gt;
      &lt;/dependencyManagement&gt;
  
  &lt;/project&gt;
  </code></pre>
  <p>Keycloak version installed:</p>
  <blockquote>
  <p>keycloak-17.0.0-wildfly</p>
  </blockquote>