title: Spring Keycloak adapter Permissions Policy Enforcer. How to set it up
body: <p>First of all I'm using </p>
  
  <ul>
  <li>keycloak-authz-client-3.3.0.Final </li>
  <li>spring boot 1.5.8.RELEASE</li>
  <li>spring-boot-starter-security</li>
  </ul>
  
  <p>I've been playing with Keycloak spring adapter exploring the examples since we want to adopt it to our project. </p>
  
  <p>I was able to make it run for Roles easily using this tutorial:
  <a href="https://dzone.com/articles/easily-secure-your-spring-boot-applications-with-k" rel="noreferrer">https://dzone.com/articles/easily-secure-your-spring-boot-applications-with-k</a></p>
  
  <p>After that I moved to permissions and that's when it gets trickier (that's also our main goal). </p>
  
  <p>I want to achieve something like described in here (9.1.2):
  <a href="http://www.keycloak.org/docs/2.4/authorization_services_guide/topics/enforcer/authorization-context.html#" rel="noreferrer">http://www.keycloak.org/docs/2.4/authorization_services_guide/topics/enforcer/authorization-context.html#</a></p>
  
  <ul>
  <li><p>To get permissions you need to setup in Keycloak Authorization, credentials, and then create Resources or Scopes and Policies to be able to create permissions (it took me a while but I got it working). Testing in the Evaluater everything seems fine.</p></li>
  <li><p>Next step was to get user permissions on the Spring side. In order to do that I had to enable:
  keycloak.policy-enforcer-config.enforcement-mode=permissive</p></li>
  </ul>
  
  <p>The moment I enable this I get everytime this exception </p>
  
  <pre><code>java.lang.RuntimeException: Could not find resource.
  at org.keycloak.authorization.client.resource.ProtectedResource.findAll(ProtectedResource.java:88)
  at org.keycloak.adapters.authorization.PolicyEnforcer.configureAllPathsForResourceServer...
  ...
  Caused by: org.keycloak.authorization.client.util.HttpResponseException: 
  Unexpected response from server: 403 / Forbidden
  </code></pre>
  
  <p>No matter what address I hit in the server.</p>
  
  <ul>
  <li><p>So I started to investigate what was the root of the problem. Looking at some examples how to manually get the permissions I actually got them in postman with the following request:
  <a href="http://localhost:8080/auth/realms/" rel="noreferrer">http://localhost:8080/auth/realms/</a>${myKeycloakRealm}/authz/entitlement/${MyKeycloakClient}
  including the header Authorization : bearer ${accessToken}
  response was {"rpt": ${jwt token}} that actually contains the permissions</p></li>
  <li><p>So knowing this was working it must be something wrong with the Spring adapter. Investigating a bit further on the Keycloak exception I found that that error was occurring the moment the adapter was getting all the resources. For that it was using the following url:
  <a href="http://localhost:28080/auth/realms/license/authz/protection/resource_set" rel="noreferrer">http://localhost:28080/auth/realms/license/authz/protection/resource_set</a>
  with a different token in the headers (that I copied when debugging)
  So when I tried it in postman I also got a 403 error, but with a json body:</p></li>
  </ul>
  
  <p>{
      "error": "invalid_scope",
      "error_description": "Requires uma_protection scope."
  }</p>
  
  <p>I've enabled and disabled all uma configuration within keycloak and I can't make it work. Can please someone point me into the right direction?</p>
  
  <p><strong>Update</strong></p>
  
  <p>I've now updated Keycloak adapter to 3.4.0.final and I'm getting the following error in the UI:</p>
  
  <p>Mon Nov 20 10:09:21 GMT 2017
  There was an unexpected error (type=Internal Server Error, status=500).
  Could not find resource. Server message: {"error":"invalid_scope","error_description":"Requires uma_protection scope."}</p>
  
  <p>(Pretty much the same I was getting in the postman request)</p>
  
  <p>I've also printed all the user roles to make sure the uma_protection role is there, and it is.</p>
  
  <p>Another thing I did was to disable spring security role prefix to make sure it wasn't a mismatch on the role.</p>
  
  <p><strong>Update 2</strong></p>
  
  <p>Was able to resolve the 403 issue (you can see it in the response below).
  Still getting problems obtaining KeycloakSecurityContext from the HttpServletRequest</p>
  
  <p><strong>Update 3</strong></p>
  
  <p>Was able to get KeycloakSecurityContext like this:</p>
  
  <pre><code>    Principal principal = servletRequest.getUserPrincipal();
      KeycloakAuthenticationToken token = (KeycloakAuthenticationToken) principal;
      OidcKeycloakAccount auth = token.getAccount();
      KeycloakSecurityContext keycloakSecurityContext = auth.getKeycloakSecurityContext();
  
      AuthorizationContext authzContext = keycloakSecurityContext.getAuthorizationContext();
  </code></pre>
  
  <p>The problem now is that the <strong>AuthorizationContext</strong> is always null.</p>