<html><body><div>Hi all,</div><div><br></div><div>I created today a build from the latest master branch and struggled with the following problem.</div><div>I've got some REST services which are excluded from keycloak, so I can access them without a logged in user. (see detail from web.xml)</div><div><span style="line-height: 1.5;">The request body in these post rest services were always empty. I found out that my wildfly tried to authenticate all requests.</span></div><div><span style="line-height: 1.5;">The </span>tokenStore.saveRequest() method in the OAuthRequestAuthenticator class read the inputStream and so it was empty later on.</div><div><br></div><div>I dont understand why all my requests are authenticated, even when they are excluded through the web.xml file.</div><div>So, I added the following lines in the ServletKeycloakAuthMech class in the authenticate method: (see <a href="https://github.com/gerbermichi/keycloak/commit/1eaafcd3d9ad4082429ab500a4512c87d47ed75c">https://github.com/gerbermichi/keycloak/commit/1eaafcd3d9ad4082429ab500a4512c87d47ed75c</a>)</div><div><div>if (!deployment.isConfigured() || !securityContext.isAuthenticationRequired()) {</div><div> return AuthenticationMechanismOutcome.NOT_ATTEMPTED;</div><div>}</div></div><div><br></div><div>This hack solved all my problems. Is this a bug and should i create a pull request? Or are there some problems in my project configuration?</div><div><br></div><div>Detail from my web.xml file:</div><div><div> <security-constraint></div><div> <web-resource-collection></div><div> <web-resource-name>Client WS</web-resource-name></div><div> <url-pattern>/clientws/*</url-pattern></div><div> </web-resource-collection></div><div> <web-resource-collection></div><div> <web-resource-name>Client Exchange WS</web-resource-name></div><div> <url-pattern>/services/exchange/*</url-pattern></div><div> </web-resource-collection></div><div> <user-data-constraint></div><div> <transport-guarantee>CONFIDENTIAL</transport-guarantee></div><div> </user-data-constraint></div><div> </security-constraint></div><div><br></div><div> <security-constraint></div><div> <web-resource-collection></div><div> <web-resource-name>All</web-resource-name></div><div> <url-pattern>/*</url-pattern></div><div> </web-resource-collection></div><div> <auth-constraint></div><div> <role-name>myRole</role-name></div><div> </auth-constraint></div><div> <user-data-constraint></div><div> <transport-guarantee>CONFIDENTIAL</transport-guarantee></div><div> </user-data-constraint></div><div> </security-constraint></div><div><br></div><div> <login-config></div><div> <auth-method>KEYCLOAK</auth-method></div><div> <realm-name>myRealm</realm-name></div><div> </login-config></div><div><br></div><div> <security-role></div><div> <role-name>myRole</role-name></div><div> </security-role></div></div><div><br></div><div><br></div><div><br></div></body></html>