Keycloak & Spring Boot authorization - spring-boot

Question

I'm trying to implement the correct flow for authorization using Keycloak and Spring Boot.
I'd like to take advantage of the Authorization Policy Enforcing on Keycloak to reduce to the minimum the authorization code on Spring Application.
Right now following several examples and official Keycloak documentation this is my configuration:
In the application.properties:
keycloak.realm=TestRealm
keycloak.resource=server-resources
keycloak.auth-server-url=http://localhost:8080/auth
keycloak.public-client=false
keycloak.credentials.secret=xxxxxxxxxxxxxxxxxxxxx
keycloak.principal-attribute=preferred_username
keycloak.use-resource-role-mappings=true
keycloak.ssl-required=external
keycloak.verify-token-audience=true
keycloak.confidential-port=0
#keycloak.policy-enforcer-config.enforcement-mode=ENFORCING
Spring security configuration:
package com.keycloak.demo.config;
import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
#KeycloakConfiguration
public class SecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter {
#Bean
#Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) {
SimpleAuthorityMapper grantedAuthorityMapper = new SimpleAuthorityMapper();
grantedAuthorityMapper.setPrefix("");
KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(grantedAuthorityMapper);
auth.authenticationProvider(keycloakAuthenticationProvider);
}
#Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
http.authorizeRequests()
.antMatchers("/").permitAll().anyRequest().authenticated();
}
}
With the above configuration I'm redirected to my Keycloak installation login page but the authorization part is not used.
When I enable the property:
keycloak.policy-enforcer-config.enforcement-mode=ENFORCING
I'm no longer redirected to Keycloak login but to an /sso/login path, which i do not have implemented.
I'm quite new to Keycloak and I'm probably missing something on how to properly setup the adapter. I'm trying to understand if I need to put all the configuration I have in keycloak for the resources :
{
"allowRemoteResourceManagement": true,
"policyEnforcementMode": "ENFORCING",
"resources": [
{
"name": "archivio-1",
"type": "archivio:one",
"ownerManagedAccess": false,
"displayName": "archivio-1",
"attributes": {},
"_id": "afb90d93-91a2-430e-9c10-36f22167d1fb",
"uris": [
"/archives/1"
],
"scopes": [....
For now I'd like to understand why the login redirection has changed just after setting
keycloak.policy-enforcer-config.enforcement-mode=ENFORCING
POM:
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.6.4</version>
<relativePath /> <!-- lookup parent from repository -->
</parent>
<groupId>com.keycloak</groupId>
<artifactId>DemoKeycloak</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>DemoKeycloak</name>
<description>Demo project for Spring Boot</description>
<properties>
<java.version>17</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-boot-starter</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.keycloak.bom</groupId>
<artifactId>keycloak-adapter-bom</artifactId>
<version>13.0.1</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>
Keycloak version installed:
keycloak-17.0.0-wildfly