I am using the spring-boot adapter, everything works fine when running in an embedded Tomcat with the following security constraints taking effect perfectly from my application.properties: keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/* keycloak.securityConstraints[0].authRoles[0]=user As soon as I deploy to a WAR file in EAP7, the security constraint no longer takes effect and users are able to navigate to all pages in an unauthenticated fashion. Are any adjustments needed to the security constraints, or the WAR file itself, when deploying a spring-boot application with keycloak to JBoss/EAP7?