Hi all,<div>I have a question about migrating my application to keycloak.</div><div>My application is based on : </div><div>- some EJB components</div><div>- a main REST interface driving the EJB components, </div><div>- a HTML5/Angular GUI client</div><div>- some remote REST api acting as clients of the main REST api. </div><div>According to the documentation, I plane to use the adapters according to my components but I&#39;m facing a problame for the main REST interface.</div><div><br></div><div>By default, the main REST interface handles requests using a dedicated GUEST account. It&#39;s a kind of default account that is propagated to the EJB container using a classic login mechanism. This is handle in a ServletFilter that looks for HTTP Authentication headers. If headers are not found, authentication on the container is done using the default login &#39;guest&#39;.</div><div>For this special account, a dedicated login-module is used in the wildfly security domain (&lt;login-module code=&quot;Identity&quot; flag=&quot;required&quot;&gt;)</div><div><br></div><div>I&#39;m trying to migrate to keycloak using the undertow adapter but I&#39;m not able to handle a default login propagated to the EJB layer.</div><div><br></div><div>The use case is that a simpe call to the REST api without authentication token header should result as a container authenticated user guest whereas requests with token included should try to perform the token base authentication. In that way, unauthenticated usage of HTML5/JS interface should result as guest requests and login process only required when main REST api throws AccessDeniedException.</div><div><br></div><div>Is there is any way to perform this using the KEYCLOAK auth-method or do I have to write a specific Filter handling a kind of dual auth mechanism (guest and keycloak) ?</div><div><br></div><div>Best regards, Jérôme.</div>