# Keycloak + Multi-tenancy + Spring Security configuration

**URL:** <https://forum.keycloak.org/t/keycloak-multi-tenancy-spring-security-configuration/2571>\
**Category:** Securing applications\
**Created:** [May 7, 2020, 11:29am UTC](https://forum.keycloak.org/t/keycloak-multi-tenancy-spring-security-configuration/2571 "2020-05-07T11:29:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshdcollins](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/joshdcollins/32/438_2.png) [@joshdcollins](https://forum.keycloak.org/u/joshdcollins)\
**Post date:** [May 7, 2020, 11:29am UTC](https://forum.keycloak.org/t/keycloak-multi-tenancy-spring-security-configuration/2571/1 "2020-05-07T11:29:42Z")

</div>

Hi all,

I’m attempting to use Keycloak to support multi-tenancy within a SpringBoot 2 application using Spring Security.

I’m using  
  
org.keycloak  
keycloak-spring-boot-starter  
9.0.0  
  
  
org.springframework.boot  
spring-boot-starter-security  
2.2.5.RELEASE

To enable multitenancy I have a `MultitenantConfigResolver` class which extends `KeycloakSpringBootConfigResolver`. `MultitenantConfigResolver` is loaded via my `SecurityConfig` which extends `KeycloakWebSEcurityConfigurerAdapter`.

This config resolver largely works as I expect. The target tenant is inferred from the issuer of the provided JWT on the Request. Then an `AdapterConfig` is built and passed into the `KeycloakDeploymentBuilder`.build(adapterConfig);

A key point I’m unsure is correct – when an unauthenticated request is made (no Authorization header), the resolve method of the `MultitenantConfigResolver` returns null.

I have certain endpoints which I want to be publicly accessible. Those are all prefixed by /public.

In `SecurityConfig` this is my `HttpSecurity` configuration:

> ```
> @Override
> protected void configure(HttpSecurity http) throws Exception
> {
> super.configure(http);
> http
> .csrf().disable()
> .authorizeRequests()
> .antMatchers("/public/**").permitAll()
> .anyRequest().authenticated();
> }
> 
> ```

I’m finding that even when calling an endpoint starting with /public/ my `MultitenantConfigResolver` is still being called, and the endpoint is not called.

Of a lower priority, in this case instead of returning a 401, I get an empty 200, I’m not sure where to coerce the appropriate status code.

Complete code for both `MultitenantConfigResolver` and `HttpSecurity` are here: [Full Keycloak Multitenant Configuration · GitHub](https://gist.github.com/joshdcollins/8392f9dc5e147efcf7f50abaeac7c69b)

---

<div class="post-metadata">

**Author:** ![joshdcollins](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/joshdcollins/32/438_2.png) [@joshdcollins](https://forum.keycloak.org/u/joshdcollins)\
**Post date:** [May 7, 2020, 12:12pm UTC](https://forum.keycloak.org/t/keycloak-multi-tenancy-spring-security-configuration/2571/2 "2020-05-07T12:12:20Z")

</div>

Not sure if this is an appropriate fix, but I toyed with returning an empty `KeycloakDeployment` when no token was provided.

```
        if (authHeader == null) {
            logger.warn("No Auth header provided");
            return new KeycloakDeployment();
        }

```

This kept the filter chain from short circuiting but was getting a bad response in Postman. After enabling debug logging, it became clear that Keycloak was attempting to redirect to a /sso/login URL. To avoid this, I set bearerOnly = true on the empty deployment.

```
        if (authHeader == null) {
            logger.warn("No Auth header provided");
            KeycloakDeployment unConfiguredDeployment = new KeycloakDeployment();
            unConfiguredDeployment.setBearerOnly(true);
            return unConfiguredDeployment;
        }

```

This appears to meet my 3 use cases:

1. Anything in /public/\*\* should be accessible without a token
2. Anything not in /public should return a 401 without a token
3. If I have a token, I should be able to process an authenticated endpoint as expected

---

<div class="post-metadata">

**Author:** ![Prasad-Coditas](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@Prasad-Coditas](https://forum.keycloak.org/u/Prasad-Coditas)\
**Post date:** [September 2, 2020, 9:04am UTC](https://forum.keycloak.org/t/keycloak-multi-tenancy-spring-security-configuration/2571/3 "2020-09-02T09:04:36Z")

</div>

could you please share the whole code ? Please

---

<div class="post-metadata">

**Author:** ![vijayakula259](https://avatars.discourse-cdn.com/v4/letter/v/838e76/32.png) [@vijayakula259](https://forum.keycloak.org/u/vijayakula259)\
**Post date:** [May 10, 2022, 3:36am UTC](https://forum.keycloak.org/t/keycloak-multi-tenancy-spring-security-configuration/2571/4 "2022-05-10T03:36:03Z")

</div>

@joshdcollins have you implemented authorization with : Keycloak + Multi-tenancy + Spring Security configuration?

could you please share any reference? I am having issues with keycloak managed authorization.