[keycloak-user] AccessToken authorization is always null using Jetty adapter

Hello, I'm attempting to set up resource permission enforcement on a simple Dropwizard application (Jersey->Jetty). I believe the PolicyEnforcer is set up correctly, because I see debugging info along these lines: DEBUG [19:04:23.574] [dw-41] o.k.a.PreAuthActionsHandler - adminRequest http://localhost:9090/v1/XXXX DEBUG [19:04:23.601] [dw-41] o.k.a.j.c.JettyRequestAuthenticator - Completing bearer authentication. Bearer roles: [uma_authorization] DEBUG [19:04:23.601] [dw-41] o.k.a.RequestAuthenticator - User 'c9e8208e-56f5-42e0-9efb-f8d05600f5de' invoking ' http://localhost:9090/v1/XXXX' on client 'XXXX-api' DEBUG [19:04:23.601] [dw-41] o.k.a.RequestAuthenticator - Bearer AUTHENTICATED DEBUG [19:04:27.781] [dw-41] o.k.a.AuthenticatedActionsHandler - AuthenticatedActionsValve.invoke http://localhost:9090/v1/XXXX DEBUG [19:04:30.341] [dw-41] o.k.a.a.PolicyEnforcer - Policy enforcement is enable. Enforcing policy decisions for path [ http://localhost:9090/v1/XXXX]. DEBUG [19:05:22.741] [dw-41] o.k.a.a.AbstractPolicyEnforcer - Checking permissions for path [http://localhost:9090/v1/XXXX] with config [PathConfig{name='XXXX Resources', type='uma:XXXXXX', path='/v1/XXXX/*', scopes=[], id='43bd3cdf-c15b-487a-a259-79e8de00d764', enforcerMode='ENFORCING'}]. DEBUG [19:11:56.719] [dw-41] o.k.a.a.PolicyEnforcer - Policy enforcement result for path [http://localhost:9090/v1/XXXX] is : DENIED DEBUG [19:11:56.719] [dw-41] o.k.a.a.PolicyEnforcer - Returning authorization context with permissions: 127.0.0.1 - c9e8208e-56f5-42e0-9efb-f8d05600f5de [24/Mar/2017:23:11:56 +0000] "GET /v1/XXXX HTTP/1.1" 401 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" 453164 Specifically, the error occurs when Keycloak attempts to retrieve an "Authorization" object from the AccessToken. This authorization object is always null and the permissions cannot be loaded. Without permissions, the request is marked as Unauthorized. Is there something that I'm missing here? As far as I know everything is configured correctly, I can evaluate policies on the Keycloak admin console, and the client is set up as access type "confidential". I can see the resource definitions from Keycloak being loaded when the app launches. Any help greatly appreciated. -- *Gabriel Trisca, Software Developer* Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA