I had the same issue.
I missed the spring security initializer and so springSecurityFilterChain was not registered.

I added this class in my app, and then all security worked just fine

public class SecurityWebApplicationInitializer
        extends AbstractSecurityWebApplicationInitializer {
}

And by the way, no web.xml required at all if you use annotation config.

_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user