Secure a web resource by roles using keycloak - security

Question

I'm currently checking keycloak example: servlet-authz. And learned that it secured a web resource via web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>All Resources</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
<role-name>admin</role-name>
<role-name>user_premium</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>KEYCLOAK</auth-method>
<realm-name>servlet-authz</realm-name>
</login-config>
<security-role>
<role-name>admin</role-name>
</security-role>
<security-role>
<role-name>user</role-name>
</security-role>
<security-role>
<role-name>user_premium</role-name>
</security-role>
My question is, can it be achieved dynamically? Without using web.xml? For example I have a new role role_guest, with only access to /guest/* url. How to configure that? I checked all the examples but none does so far.

Answer 1

If you want to load all roles dynamically you have to include web.xml (unluckily) with wildcard (*) in both auth-constraint and security-role.
All roles allowed web.xml fragment:
...
<security-constraint>
<web-resource-collection>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>KEYCLOAK</auth-method>
<realm-name>servlet-authz</realm-name>
</login-config>
<security-role>
<role-name>*</role-name>
</security-role>
...
I don't know if there's a way to automatically attach to every role a url-pattern, which contains role name.
Flow tested on Wildfly 11 with Keycloak adapter version 4.4.0.Final.