title: spring security keycloak adapter
body: <p>I'm trying to use Keycloak with my spring boot application.</p>
  
  <p>I want to restrict access to a particular URL based on the REST method and user's role.</p>
  
  <p>In the example below, users with any of the roles <code>view-all</code> or <code>calendar</code> can perform a GET, while those with <code>manage-all</code> or <code>calendar_manage</code> can do a POST, PUT, or DELETE.</p>
  
  <p>Unfortunately, this configuration is allowing any authenticated user access to the /api/calendar URL.  What am I doing wrong?</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
  ...
      @Override
      protected void configure(HttpSecurity http) throws Exception
      {
          super.configure(http);
          http
                  .csrf().disable()
                  .antMatcher("/api/**")
                  .authorizeRequests()
                  .antMatchers(HttpMethod.GET, "/api/calendar/*").hasAnyRole("view-all", "calendar")
                  .antMatchers(HttpMethod.POST, "/api/calendar/*").hasAnyRole("manage-all", "calendar_manage")
                  .antMatchers(HttpMethod.PUT, "/api/calendar/*").hasAnyRole("manage-all", "calendar_manage")
                  .antMatchers(HttpMethod.DELETE, "/api/calendar/*").hasAnyRole("manage-all", "calendar_manage");
      }
  }
  </code></pre>