We achieve it like this way userId = httpRequest.getRemoteUser(); CasAuthenticationToken castoken = (CasAuthenticationToken) httpRequest.getUserPrincipal(); String castgtToken = castoken.getAssertion().getPrincipal().getAttributes().get("tgtToken").toString(); log.info("CAS Logged in User "+userId); log.info("CAS Token Attribute--> "+castoken.getAssertion().getPrincipal().getAttributes()); password = castoken.getAssertion().getPrincipal().getAttributes().get("password").toString(); tgtToken = getToken(userId,castgtToken); String urlEncodeToken = URLEncoder.encode(tgtToken, "UTF-8"); KeycloakSecurityContext securityContext = (KeycloakSecurityContext) httpRequest.getAttribute(KeycloakSecurityContext.class.getName()); System.out.println(httpRequest.getHeaderNames()); Map<String, String> map = new HashMap<String, String>(); Enumeration headerNames = httpRequest.getHeaderNames(); while (headerNames.hasMoreElements()) { String key = (String) headerNames.nextElement(); String value = httpRequest.getHeader(key); map.put(key, value); } System.out.println(map); if(map.containsKey("authorization")){ tgtToken = map.get("authorization"); } You can separate out the code ,i simply copy-paste the code. Our JSF application behind Kong/Nginx. Thanks & regards On Thu, May 17, 2018 at 2:10 PM Omri Tavor <omri.tavor(a)forcepoint.com&gt; wrote: -- Subodh Chandra Joshi subodh1_joshi82(a)yahoo.co.in http://www.trendsinnews.com