How to check REST requests for JWT token issued by Keycloak in JAX-RS application - jax-rs

Question

I'm aware that this question might not be explicitly about "programming" but I have some trouble
understanding the concept. Maybe you're able to help.
Basically, I'm deploying a WAR offering several REST endpoints based on JAX-RS to a WildFly 20 server.
Here is the baseline:
Endpoints must be secured.
A frontend client (based on React) shall be able to access this API.
Keycloak is being used to authenticate users of the React app.
This is what I have so far:
React client
The app integrates the keycloak-js adapter. Any login is routed through Keycloak which issues a JWT token which is used for all further requests by the app, i.e. they contain an Authorization: Bearer <token> header. Check.
JAX-RS application in WildFly
web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>api</web-resource-name>
<url-pattern>/users/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>KEYCLOAK</auth-method>
<realm-name>this is ignored currently</realm-name>
</login-config>
<security-role>
<role-name>*</role-name>
</security-role>
keycloak.json
{
"realm": "my-realm",
"auth-server-url": "${keycloak.url}/auth",
"ssl-required": "none",
"resource": "my-client",
"public-client": true,
"confidential-port": 0,
"principal-attribute" : "preferred_username",
"enable-cors": true
}
The (showcase) problem
The initial request to http://localhost:8090/api/users redirects the user the Keycloak login. After a successful login, the same URL is accessible without sending the authentication header. That's the point where I'm stuck. My understanding is that I need to tell my server application "Hey, check any incoming request to this URL if it contains the valid JWT token issued by Keycloak".
I assume that there are ways so that WildFly can handle exactly this. Or do I have to implement some JWT validation service my own?

Answer 1

If you don't want to gets redirected to login page at all and the /users path is not used to serve any web contents (e.g. jsp, html, etc.), then it's safe to tell the Keycloak that /users is only accessible via "Bearer" tokens. Then in cases that such a token doesn't exist in the request, it just returns proper HTTP status code and doesn't do anything. You can do this by setting bearer-only property to true in the keycloak.json file. So your file should look like this:
{
"realm": "my-realm",
"auth-server-url": "${keycloak.url}/auth",
"ssl-required": "none",
"resource": "my-client",
"public-client": true,
"confidential-port": 0,
"principal-attribute" : "preferred_username",
"enable-cors": true,
"bearer-only": true
}