Keycloak spring adapter - check that the authToken is active with every http request

Problem I want to solve:

For every call made to the service I want to check that the token is active, if it isn't active I want to redirect the user to the login page.

Current setup: Grails 3.2.9 , Keycloak 3.4.3

Ideas so far:

This article looked promising: https://www.linkedin.com/pulse/json-web-token-jwt-spring-security-real-world-example-boris-trivic

In my security config I added a token filter

@Bean
public TokenAuthenticationFilter authenticationTokenFilter() throws Exception {
    return new TokenAuthenticationFilter();
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    super.configure http
    http
        .addFilterBefore(authenticationTokenFilter(), BasicAuthenticationFilter.class)
        .logout()
            .logoutSuccessUrl("/sso/login") // Override Keycloak's default '/'
        .and()
        .authorizeRequests()
            .antMatchers("/assets/*").permitAll()
            .anyRequest().hasAnyAuthority("ROLE_ADMIN") 
            .and()
        .csrf()
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());      
}

My TokenAuthenticationFilter just prints out the request headers at the moment :

public class TokenAuthenticationFilter extends OncePerRequestFilter { 

    private String getToken( HttpServletRequest request ) {

        Enumeration headerEnumeration = request.getHeaderNames();
        while (headerEnumeration.hasMoreElements()) {
            println "${ headerEnumeration.nextElement()}"
        }

        return null;
    }


    @Override
    public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {        
        String authToken = getToken( request );
    }

}

Which returns:

• host
• user-agent
• accept
• accept-language
• accept-encoding
• cookie
• connection
• upgrade-insecure-requests
• cache-control

The code/logic I want to implement in the filter is something like:

KeycloakAuthenticationToken token = SecurityContextHolder.context?.authentication 

RefreshableKeycloakSecurityContext context = token.getCredentials()

if(!context.isActive()){
    // send the user to the login page 
}

However I'm lost as to how to get there. Any help greatly appreciated

As far as I understand, your question is about "how to check the token is active?" and not "how to redirect the user to login page?".

As I see you added the tag "spring-boot" and "keycloak" maybe you could use "Keycloak Spring Boot Adapter". Assuming you use the version 3.4 of Keycloak (v4.0 still in beta version), you can found some documentation here.

If you can't (or don't want to) use Spring Boot Adapter, here is the part of the KeycloakSecurityContextRequestFilter source code that could be interesting for your case:

KeycloakSecurityContext keycloakSecurityContext = getKeycloakPrincipal();
if (keycloakSecurityContext instanceof RefreshableKeycloakSecurityContext) {
    RefreshableKeycloakSecurityContext refreshableSecurityContext = (RefreshableKeycloakSecurityContext) keycloakSecurityContext;
    if (refreshableSecurityContext.isActive()) {
        ...
    } else {
        ...
    }
}

and here is the (Java) source code of the getKeycloakPrincipal method:

private KeycloakSecurityContext getKeycloakPrincipal() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

    if (authentication != null) {
        Object principal = authentication.getPrincipal();

        if (principal instanceof KeycloakPrincipal) {
            return KeycloakPrincipal.class.cast(principal).getKeycloakSecurityContext();
        }
    }

    return null;
}

And if you want to understand how the Authentication is set in the SecurityContextHolder, please read this piece of (Java) code from KeycloakAuthenticationProcessingFilter:

@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
    if (authResult instanceof KeycloakAuthenticationToken && ((KeycloakAuthenticationToken) authResult).isInteractive()) {
        super.successfulAuthentication(request, response, chain, authResult);
        return;
    }

    ...

    SecurityContextHolder.getContext().setAuthentication(authResult);

    ...

    try {
        chain.doFilter(request, response);
    } finally {
        SecurityContextHolder.clearContext();
    }
}

As an alternative you could also check this github repository of dynamind: https://github.com/dynamind/grails3-spring-security-keycloak-minimal

Hoping that can help.
Best regards,
Jocker.