Ok I found the answer by reading the question just above mine: "Obtaining the username from the security context".  I did not realize that session.getToken() contained the information I need.  I was checking in session.getIdToken().  

On Thu, Dec 18, 2014 at 1:59 PM, Dean Peterson <peterson.dean@gmail.com> wrote:

I am able to use a bearer token to call a java REST service from a pure javascript client.  Unfortunately the KeycloakSecurityContext is essentially empty on the back end.  I need to filter and update data by subject (idToken.subject)  Initially I setup my back end REST application as a bearer token only application; thinking that was the problem, I switched to a confidential back end application but the KeycloakSecurityContext is still not populated.  In order to communicate with the service in a cross domain way, I still need to send a bearer token, regardless of the type of application.  I can get the subject in javascript and add it to the list of request parameters, however, it seems that leaves me open to anyone with a valid token being able to request another user's data.  What is the best way to handle this kind of situation using Keycloak?