insufficient_scope error while using Keycloak with Spring Boot

Question

I use keycloak with Spring Boot api rest, but I get this error:

Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

I believe this token is valid.

Code:

    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        
        System.out.println("Entro a seguridad");
        http.authorizeHttpRequests()
            .requestMatchers("/all/**")
            .hasAnyRole("user_roles")
            .anyRequest()
            .permitAll();
        http.oauth2Login()
            .and()
            .logout()
            .addLogoutHandler((LogoutHandler) keycloakLogoutHandler)
            .logoutSuccessUrl("/");
        http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
        return http.build();

jwt

I expect the token works. How do I fix this error?

Answer 1

Apparently, you have not configured an authentication converter, which means the spring authorities are mapped from the scope claim with SCOPE_ prefix (and not Keycloak private claims with ROLE_ prefix which is required by hasRole).

What you need is change your resource-server configuration to http.oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> jwt.jwtAuthenticationConverter(...)) and provide an authentication converter mapping authorities from realm_access.roles (adding ROLE_ prefix), and then build a JwtAuthenticationToken from it. Samples in this answer and those tutorials I wrote (and my bet is you should read the introduction README).