Keycloak login page not showing, I get Spring Security login instead - spring-boot

Question

Hi I'm trying to add security to a Kotlin Spring Boot project with Java 15 I've started. I want to use Keycloak as Auth Server.
I don't have a frontend yet (REACT app), I'm building the REST API first.
My problem is when I try to hit a protected endpoint instead of having the Keycloak login page I think the Spring Security login page pops up because it says invalid credentials and the looks are a basic form instead of the style Keycloak has for login. I don't know what's missing on my config.
This is the SecurityConfig:
#Configuration
#EnableWebSecurity
#ComponentScan(basePackageClasses = [KeycloakSecurityComponents::class])
internal class SecurityConfig : KeycloakWebSecurityConfigurerAdapter() {
#Autowired
fun configureGlobal(auth: AuthenticationManagerBuilder) {
val keycloakAuthenticationProvider: KeycloakAuthenticationProvider =
keycloakAuthenticationProvider()
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(
SimpleAuthorityMapper()
)
auth.authenticationProvider(keycloakAuthenticationProvider)
}
#Bean
fun keycloakConfigResolver(): KeycloakSpringBootConfigResolver {
return KeycloakSpringBootConfigResolver()
}
#Bean
override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy {
return RegisterSessionAuthenticationStrategy(
SessionRegistryImpl()
)
}
override fun configure(http: HttpSecurity) {
super.configure(http)
http.authorizeRequests()
.antMatchers("/carts*")
.hasRole("user")
.anyRequest()
.permitAll()
}
}
Controller:
#RestController
#RequestMapping("/carts")
class CartController(private val cartService: CartService) {
#GetMapping("/{id}")
fun getCart(#PathVariable id: String): Cart? {
return cartService.findById(id)
}
}
application-yml:
keycloak:
auth-server-url: http://localhost:8081/auth
realm: TestRealm
resource: login-app
public-client: true
principal-attribute: preferred_username
build.gradle dependencies:
dependencies {
implementation("org.springframework.boot:spring-boot-starter-web")
implementation("org.springframework.boot:spring-boot-starter-data-mongodb")
implementation("org.springframework.boot:spring-boot-starter-security")
implementation("org.jetbrains.kotlin:kotlin-reflect")
implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
implementation("com.fasterxml.jackson.module:jackson-module-kotlin:2.12.+")
implementation("org.keycloak:keycloak-spring-boot-starter")
developmentOnly("org.springframework.boot:spring-boot-devtools")
annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
testImplementation("org.springframework.boot:spring-boot-starter-test")
testImplementation("org.springframework.security:spring-security-test")
testImplementation("io.mockk:mockk:1.10.6")
}
dependencyManagement {
imports {
mavenBom("org.keycloak.bom:keycloak-adapter-bom:12.0.4")
}
}
When I do a direct request I get a valid token so I'm assuming Keycloak is working (I'm running it on a docker container at port 8081).
curl --location --request POST 'http://localhost:8081/auth/realms/TestRealm/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=login-app' \
--data-urlencode 'username=user2' \
--data-urlencode 'password=user2' \
--data-urlencode 'grant_type=password'
A request to "localhost:8080/carts/605271fa9f2ad0418ca4858d" redirects to "http://localhost:8080/login" and this shows:
Instead what I'd expect to be similar to this (taken from another example):
Every guide I've seen they are redirected to the Keycloak login out of the box. I'm kind of lost here, any ideas?
Thanks!!

Answer 1

You have to disable the auto configuration for security
use this in your Main class
#EnableAutoConfiguration(exclude = { SecurityAutoConfiguration.class})

Answer 2

Lost the afternoon for not adding the package to my SecurityConfig (copied the example from somewhere else and probably overwrote the package definition) class so the component scan was skipping completely this config.
Nevertheless the way I made it work is requesting the token directly to the keycloak url and sending it with the header --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiA...'.
I guess the Keycloak login page is something I have to configure later on from the frontend directly since I'm not using Spring MVC