title: Spring Security OAuth2 with Keycloak - Accessing User Information
body: <p>I have a <code>Spring Security OAuth2</code> with <code>Keycloak</code> setup.</p>
  <p>On <code>Client</code> application side the artifacts look like this:</p>
  <p>application.yml</p>
  <pre><code>server.port: 8182
  
  spring:
      security:
          oauth2:
              client:
                  registration:
                      keycloak:
                          client-id: myclient-ac
                          client-secret: 81e3fd9f-52ce-4549-8ea9-ae53e754da89
                          authorization-grant-type: authorization_code
                          redirect-uri: http://localhost:8182/login/oauth2/code/myclient-ac
                          scope: openid
                  provider:
                      keycloak:
                          issuer-uri: http://localhost:8180/auth/realms/myrealm
                          #authorization-uri: http://localhost:8180/auth/realms/myrealm/protocol/openid-connect/auth
                          #token-uri: http://localhost:8180/auth/realms/myrealm/protocol/openid-connect/token
                          #user-info-uri: http://localhost:8180/auth/realms/myrealm/protocol/openid-connect/userinfo
                          #jwk-set-uri: http://localhost:8180/auth/realms/myrealm/protocol/openid-connect/certs
                          #user-name-attribute: preferred_username
  </code></pre>
  <p>SecurityConfig.java</p>
  <pre><code>@EnableWebSecurity
  public class SecurityConfig {
      @Bean
      SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
          http
              .authorizeRequests().anyRequest().permitAll()
              .and()
              .oauth2Login().disable()
              .oauth2Client();
              
          return http.build();
      }
  }
  </code></pre>
  <p>WebClientConfig.java</p>
  <pre><code>@Configuration
  public class WebClientConfig {
      @Bean
      WebClient webClient(OAuth2AuthorizedClientManager authorizedClientManager) {
          ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2Client = 
              new ServletOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
          
          return WebClient.builder()
              .apply(oauth2Client.oauth2Configuration())
              .build();
      }    
  
      @Bean
      public OAuth2AuthorizedClientManager authorizedClientManager(
          ClientRegistrationRepository clientRegistrationRepository,
          OAuth2AuthorizedClientRepository authorizedClientRepository) {
  
          OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
              .authorizationCode()
              .refreshToken()
              .build();
  
          DefaultOAuth2AuthorizedClientManager authorizedClientManager = 
              new DefaultOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientRepository);
          
          authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
  
          return authorizedClientManager;
      }
  }
  </code></pre>
  <p>MyRestControllerClient.java</p>
  <pre><code>@RestController
  public class MyRestControllerClient {
      private static final Logger LOGGER = LoggerFactory.getLogger(MyRestControllerClient.class);
      
      @Autowired
      private WebClient webClient;     
      
      @GetMapping(&quot;/helloworld&quot;)
      public String helloworld(@RegisteredOAuth2AuthorizedClient(&quot;keycloak&quot;) OAuth2AuthorizedClient authorizedClient) {
          String body = webClient
              .get()
              .uri(&quot;http://localhost:8181/helloworld&quot;)
              .attributes(oauth2AuthorizedClient(authorizedClient))
              .retrieve()
              .bodyToMono(String.class)
              .block();
          
          LOGGER.info(body);
          
          return body;
      } 
      
      @GetMapping(&quot;/oidc-principal&quot;)
      public OidcUser getOidcUserPrincipal(@AuthenticationPrincipal OidcUser principal) {
          return principal;
      }    
  }
  </code></pre>
  <p>Accessing http://localhost:8182/helloworld results in being redirected to login page at <code>Keycloak</code>. Providing <code>username</code> and <code>password</code>, I can successfully access my <code>/helloworld</code> endpoint.</p>
  <p>I want to access also the user information, according to <code>4.1. Accessing User Information</code> at <a href="https://www.baeldung.com/spring-security-openid-connect" rel="nofollow noreferrer">https://www.baeldung.com/spring-security-openid-connect</a> it can be done in the <code>REST</code> controller via</p>
  <pre><code>@GetMapping(&quot;/oidc-principal&quot;)
  public OidcUser getOidcUserPrincipal(@AuthenticationPrincipal OidcUser principal) {
      return principal;
  }
  </code></pre>
  <p>Adding this endpoint to my <code>REST</code> controller, and accessing it after the <code>/helloworld</code> endpoint, results in <code>principal</code> being <code>null</code>.</p>
  <p>How to access the user information?</p>