title: keycloak Spring Security : Unable to login with Bearer token as null
body: <p>I have integrated the Keylock with Spring boot using @KeycloakConfiguration in SecurityConfig Class,</p>
  <pre><code>@KeycloakConfiguration
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
  public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
  
  
      // configureGlobal() tasks the SimpleAuthorityMapper to make sure roles are not
      // prefixed with ROLE_.
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
          keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
          auth.authenticationProvider(keycloakAuthenticationProvider);
      }
  
      // keycloakConfigResolver defines that we want to use the Spring Boot properties
      // file support instead of the default keycloak.json.
      @Bean
      public KeycloakSpringBootConfigResolver KeycloakConfigResolver() {
          return new KeycloakSpringBootConfigResolver();
      }
  
      @Bean
      @Override
      protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
          return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
      }
  
      // we are permitting all here but we are gonna have method level
      // pre-authorization
      
        @Override protected void configure(HttpSecurity http) throws Exception {
        super.configure(http); http.cors().and().csrf().disable()
        .authorizeRequests().antMatchers(&quot;/admin**&quot;).hasAnyRole(&quot;admin&quot;)
        .anyRequest().permitAll();
        
        }
       
      
      // we configure to accepts CORS requests from all and any domains
          @Bean
          public WebMvcConfigurer corsConfigurer() {
              return new WebMvcConfigurer() {
                  @Override
                  public void addCorsMappings(CorsRegistry registry) {
                      registry.addMapping(&quot;/**&quot;).allowedOrigins(&quot;*&quot;).allowedMethods(&quot;GET&quot;, &quot;POST&quot;, &quot;PUT&quot;, &quot;DELETE&quot;);
                  }
              };
          }
          
      
  
  
  
  
  @PostMapping(&quot;/login&quot;)
      public @ResponseBody  AuthToken login(@RequestBody LoginForm form) {
          
            Collection&lt;SimpleGrantedAuthority&gt; authorities =
            (Collection&lt;SimpleGrantedAuthority&gt;) SecurityContextHolder
            .getContext().getAuthentication().getAuthorities();       
            
            AuthToken authToken = authService.login(form);
            authToken.setAuthorities(authorities);
            return authToken;
           
  
      }
  </code></pre>
  <p>and I am able to log in without a Bearer token and with an empty Bearer token.
  <a href="https://i.stack.imgur.com/QTzml.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QTzml.png" alt="enter image description here" /></a>
  I have created a login page in angular,
  and from that, I am passing the bearer token is null.
  <a href="https://i.stack.imgur.com/PY2lI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PY2lI.png" alt="enter image description here" /></a></p>
  <p>I am getting</p>
  <p>status&quot;: 401,
  “error”: “Unauthorized”</p>
  <p>and there are no security logs on eclipse.</p>
  <p><a href="https://i.stack.imgur.com/wH0y9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wH0y9.png" alt="enter image description here" /></a></p>
  <p>Thanks and Regards</p>