Keycloak, Tomcat 9, and #RolesAllowed? - security

Question

I am trying to configure my Tomcat 9-based web application to leverage Keycloak for its security provider. I've done this in the past on Wildfly with no problem using the Wildfly adapter. I'm running into issues doing this in Tomcat 9, though. Here's what I've done...
I've added the Keycloak Tomcat adapter to my project using maven:
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-tomcat8-adapter</artifactId>
<version>6.0.1</version>
</dependency>
In my context.xml file I've defined the Keycloak authenticator valve:
<Context path="/myapp">
<Valve
className="org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve" />
</Context>
In my web.xml file I've added a login-config and security-role:
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>KEYCLOAK</realm-name>
</login-config>
<security-role>
<role-name>*</role-name>
</security-role>
I've also added my keycloak.json file to my /WEB-INF directory within the WAR file. Now I'm trying to test it by adding a #RolesAllowed annotation to a test Servlet I've created:
#WebServlet(urlPatterns = { "/TestServlet" })
#RolesAllowed({ "roleA", "roleB", "roleXXX" })
public class TestServlet extends HttpServlet {
...
}
I am not authenticated at this point, so I would expect that hitting /TestServlet would cause me to receive a 403 or 401. However, Tomcat lets me in just fine. No errors or anything. As a sanity check, I changed the #RolesAllowed annotation to #DenyAll, expecting that I would be prevented from hitting the servlet in my browser. Even after this change I'm still able to get through.
Does anyone have any idea why this is not working as expected? Is #RolesAllowed not supported for Servlets? I was under the impression that it was. If not, is there something different I should be doing to integrate Keycloak and Tomcat 9?