Spring Boot Security + Keycloak adapter 401 Response when token expires while antMatchers is permitAll() - spring-boot

Question

When i login i receive access_token and refresh_token which i send in every HTTP request as headers to the Spring boot server.
Problem that i have is when token expires i get 401 Response when i try to access routes that are accessible without authentication, so result is i can't access /v1/users/current which checks if token is valid if not take refresh token and give me a new access token.
What Im trying to do now is make /v1/users/current accessible without any type of authorization/authentication so i can receive a new access token, and I'm not sure how to achieve that using KeycloakWebSecurityConfigurerAdapter.
I've tryed to use HandlerInterceptor but preHandle request that i receive is already been trough keycloak and i recieve simmilar error like 401.
Thanks in advance!
EDIT: When i use POSTMAN and send a get request to /v1/users/current without access token(No auth) and with refresh token in header i still get access to /v1/users/current route and get the new access token i need.
#KeycloakConfiguration
class ResourceServerConfiguration extends KeycloakWebSecurityConfigurerAdapter {
#Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("*"));
configuration.setAllowedMethods(Arrays.asList("GET", "POST"));
//the below three lines will add the relevant CORS response headers
configuration.addAllowedOrigin("*");
configuration.addAllowedHeader("*");
configuration.addAllowedMethod("*");
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
#Bean
public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
return new ServletListenerRegistrationBean<>(new HttpSessionEventPublisher());
}
#Autowired
public void configureGlobal(
AuthenticationManagerBuilder auth) throws Exception {
KeycloakAuthenticationProvider keycloakAuthenticationProvider
= keycloakAuthenticationProvider();
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(
new SimpleAuthorityMapper());
auth.authenticationProvider(keycloakAuthenticationProvider);
}
#Bean
#Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}
#Bean
public KeycloakConfigResolver KeycloakConfigResolver() {
return new KeycloakSpringBootConfigResolver();
}
#Override
public void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.cors().configurationSource(corsConfigurationSource())
.and()
.authorizeRequests().antMatchers(HttpMethod.GET,"/v1/users/current").permitAll().and()
.authorizeRequests()
.antMatchers(HttpMethod.POST,"/login").permitAll()
.antMatchers(HttpMethod.POST,"/register/admin").hasRole("admin")
.antMatchers(HttpMethod.POST, "/*")
.authenticated()
.anyRequest()
.permitAll();
}
/* #Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(HttpMethod.GET,"/v1/users/current");
}*/
}

Answer 1

It seems that KeycloakAuthenticationProcessingFilter is checking each http request that has Authorization HTTP header, which means if you need to access a route without checking it you send it without Authorization headers.
I've changed my /v1/users/current to POST without header and I'm sending access_token and refresh_token in request body.