Problems with keycloak roles and authorities about spring-addons

[teuber789]

Also - could this be related to #3 ?

[ch4mpy]

Is it possible that you have different GrantedAuthoritiesMapper during tests and at runtime ? Can you double check and provide me with implementations used in both cases ?

As can be seen here, I use registered authoritiesMapper to transform provided authorities.
And as can be seen there, NullAuthoritiesMapper is used by default (no-op mapper).

Maybe do you have a SimpleAuthorityMapper at runtime (which adds ROLE_ prefix by default) and NullAuthoritiesMapper (which does nothing) wired during tests ?

What I would do in your case:

1. search for a conf wiring a SimpleAuthorityMapper at runtime
2. understand why this conf is ignored during tests (maybe conf file is not scanned, maybe GrantedAuthoritiesMapper is explicitly set to NullAuthoritiesMapper in test conf, ...)
3. fix test conf

[ch4mpy]

I got it:
You override GrantedAuthoritiesMapper with SimpleAuthoritiesMapper in KeycloakWebSecurityConfigurerAdapter but don't expose the bean. As a consequence my lib uses default one which is NullAuthoritiesMapper.

In KeycloakWebSecurityConfigurerAdapter, just replace

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

with

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(authoritiesMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }
    
	@Bean GrantedAuthoritiesMapper authoritiesMapper() {
		return new SimpleAuthorityMapper();
	}

and your second test will pass.

P.S.
please close the ticket if this answers your question.

P.S. 2
maybe your web security conf can simplified a bit. I provide with a working sample in tests: https://github.com/ch4mpy/spring-addons/blob/master/spring-security-oauth2-test-webmvc-addons/src/test/java/com/c4_soft/springaddons/samples/webmvc/keycloak/KeycloakSpringBootSampleApp.java

[teuber789]

Hey, that worked perfectly! I wasn't aware that I could needed to expose the authorities mapper bean in order to keep the role mapping between the service and the tests consistent. It's good to know now.

Many thanks!