I had the same issue. I missed the spring security initializer and so springSecurityFilterChain was not registered. I added this class in my app, and then all security worked just fine public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer { } And by the way, no web.xml required at all if you use annotation config. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user