JBoss EAP 7.1 RH-SSO 7.2 Rest Service Keycloak Bearer Only AuthenticatedActionsValve.invoke Policy enforcement is disabled 403 Forbidden - rest

Question

My configuration is:
JBoss EAP 7.1.4
RH-SSO 7.2.4
JDK 1.8.0u172
We have built a Rest/JSON web service based on the jboss-eap-quickstarts-7.1\contacts-jquerymobile example, without any of the JavaScript GUI components, which works fine.
We then attempted to secure this Rest/JSON web service using the redhat-sso-quickstarts-7.2.x\service-jee-jaxrs example for guidance, after getting the service-jee-jaxrs example running locally.
The Rest/JSON web service is secured using keycloak, and access is bearer only.
Here is the web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" blah blah blah >
<module-name>OurRestService</module-name>
<security-constraint>
<web-resource-collection>
<web-resource-name>All</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>mobilerole</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>KEYCLOAK</auth-method>
</login-config>
<security-role>
<role-name>mobilerole</role-name>
</security-role>
</web-app>
Here is the keycloak.json
{
"realm": "mobilerealm",
"bearer-only": true,
"auth-server-url": "blah blah localhost:8180/auth",
"ssl-required": "external",
"resource": "OurRestService",
"confidential-port": 0
}
Below is the JBoss server log output from an attempted GET using PostMan. As you can see the bearer only token is successfully authenticated by SSO, but the web service never fires, and PostMan gets a 403 Forbidden.
Please note the last 2 lines of the server log:
2018-08-30 13:13:19,851 DEBUG [org.keycloak.adapters.AuthenticatedActionsHandler] (default task-4) AuthenticatedActionsValve.invoke http://localhost:8080/OurRestService/rest/contacts/
2018-08-30 13:13:19,851 DEBUG [org.keycloak.adapters.AuthenticatedActionsHandler] (default task-4) Policy enforcement is disabled.
What am I missing?
2018-08-30 13:13:19,737 DEBUG [io.undertow.request] (default I/O-5) Matched prefix path /OurRestService for path /OurRestService/rest/contacts/
2018-08-30 13:13:19,738 DEBUG [org.keycloak.adapters.PreAuthActionsHandler] (default task-4) adminRequest ourUrlToGetPastStackOverflow10URLlimit/contacts/
2018-08-30 13:13:19,738 DEBUG [io.undertow.request.security] (default task-4) Security constraints for request /OurRestService/rest/contacts/ are [SingleConstraintMatch{emptyRoleSemantic=PERMIT, requiredRoles=[therole]}]
2018-08-30 13:13:19,738 DEBUG [io.undertow.request.security] (default task-4) Authenticating required for request HttpServerExchange{ GET /OurRestService/rest/contacts/ request {Postman-Token=[ba346ce6-995e-4c1c-859f-9d92c449b8c9], Accept=[*/*], cache-control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.2.0], Connection=[keep-alive], Authorization=[Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxSzJKWjUyVjFmU0pKRG82M0hmZHlJbjYyWERlX2hhSWhFMGV5ZXZkQlowIn0.eyJqdGkiOiI5YWM3MWUxMC1kMTYxLTRiYjYtYmE0OC1iMTRlZmJiZjRkZDEiLCJleHAiOjE1MzU2NDk0OTMsIm5iZiI6MCwiaWF0IjoxNTM1NjQ5MTkzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvbW9iaWxlcmVhbG0iLCJhdWQiOiJhZG1pbi1jbGkiLCJzdWIiOiIyMThlYTcwNC0zYTdhLTQ3NjYtYTI1MS02OWQ5YWE4ZTc1ZmYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJjNjk4MzMxMi1mZTM1LTQwODQtYWQxMC1kZTQwOGY3NzQ1YzgiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwibmFtZSI6Ik1vYmlsZSBVc2VyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibW9iaWxldXNlciIsImdpdmVuX25hbWUiOiJNb2JpbGUiLCJmYW1pbHlfbmFtZSI6IlVzZXIiLCJlbWFpbCI6InNoYXduLmZpcnRoQGdtYWlsLmNvbSJ9.HFCYIdW7Xyd0eKjXOouujVCUH5zjnxNDbOBLQOnjfOzEj4Ff4pHd6q6Ukl3unmWpvM9tU2FtzoPtsxQ-BqIu1ITBuq5_U-fk0OebTCOWtF566vW6BjJb3czRO8f3pB1hd5O7-xCT2KXSv-oEIi0s0ZweiLH0A1PeYy7wur_eCuhONgiu7wI6uR-gimcZVe7o3yhKsDnukrdR-N8xrp1T9PugQe5MZq20ER2Hvc-TW_npnTxRyCHa4tg59_p7-JBGA-BT03mFvOdd4vALeW8xkK3vtaVQevMSa8u3WZrpNGsAvoKpT6QTzm6W0TxAb3t_ptOjusxoLqqRacmP-C9OUg], Content-Type=[application/json], cookie=[JSESSIONID=E7uZRSGcR1FaiNDFCYmJcF7YnJaQof0yP3LxstT5.sfirth], Host=[localhost:8080]} response {X-Powered-By=[Undertow/1], Server=[JBoss-EAP/7]}}
2018-08-30 13:13:19,738 DEBUG [io.undertow.request.security] (default task-4) Setting authentication required for exchange HttpServerExchange{ GET /OurRestService/rest/contacts/ request {Postman-Token=[ba346ce6-995e-4c1c-859f-9d92c449b8c9], Accept=[*/*], cache-control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.2.0], Connection=[keep-alive], Authorization=[Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxSzJKWjUyVjFmU0pKRG82M0hmZHlJbjYyWERlX2hhSWhFMGV5ZXZkQlowIn0.eyJqdGkiOiI5YWM3MWUxMC1kMTYxLTRiYjYtYmE0OC1iMTRlZmJiZjRkZDEiLCJleHAiOjE1MzU2NDk0OTMsIm5iZiI6MCwiaWF0IjoxNTM1NjQ5MTkzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvbW9iaWxlcmVhbG0iLCJhdWQiOiJhZG1pbi1jbGkiLCJzdWIiOiIyMThlYTcwNC0zYTdhLTQ3NjYtYTI1MS02OWQ5YWE4ZTc1ZmYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJjNjk4MzMxMi1mZTM1LTQwODQtYWQxMC1kZTQwOGY3NzQ1YzgiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwibmFtZSI6Ik1vYmlsZSBVc2VyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibW9iaWxldXNlciIsImdpdmVuX25hbWUiOiJNb2JpbGUiLCJmYW1pbHlfbmFtZSI6IlVzZXIiLCJlbWFpbCI6InNoYXduLmZpcnRoQGdtYWlsLmNvbSJ9.HFCYIdW7Xyd0eKjXOouujVCUH5zjnxNDbOBLQOnjfOzEj4Ff4pHd6q6Ukl3unmWpvM9tU2FtzoPtsxQ-BqIu1ITBuq5_U-fk0OebTCOWtF566vW6BjJb3czRO8f3pB1hd5O7-xCT2KXSv-oEIi0s0ZweiLH0A1PeYy7wur_eCuhONgiu7wI6uR-gimcZVe7o3yhKsDnukrdR-N8xrp1T9PugQe5MZq20ER2Hvc-TW_npnTxRyCHa4tg59_p7-JBGA-BT03mFvOdd4vALeW8xkK3vtaVQevMSa8u3WZrpNGsAvoKpT6QTzm6W0TxAb3t_ptOjusxoLqqRacmP-C9OUg], Content-Type=[application/json], cookie=[JSESSIONID=E7uZRSGcR1FaiNDFCYmJcF7YnJaQof0yP3LxstT5.sfirth], Host=[localhost:8080]} response {X-Powered-By=[Undertow/1], Server=[JBoss-EAP/7]}}
2018-08-30 13:13:19,738 DEBUG [io.undertow.request.security] (default task-4) Attempting to authenticate HttpServerExchange{ GET /OurRestService/rest/contacts/ request {Postman-Token=[ba346ce6-995e-4c1c-859f-9d92c449b8c9], Accept=[*/*], cache-control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.2.0], Connection=[keep-alive], Authorization=[Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxSzJKWjUyVjFmU0pKRG82M0hmZHlJbjYyWERlX2hhSWhFMGV5ZXZkQlowIn0.eyJqdGkiOiI5YWM3MWUxMC1kMTYxLTRiYjYtYmE0OC1iMTRlZmJiZjRkZDEiLCJleHAiOjE1MzU2NDk0OTMsIm5iZiI6MCwiaWF0IjoxNTM1NjQ5MTkzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvbW9iaWxlcmVhbG0iLCJhdWQiOiJhZG1pbi1jbGkiLCJzdWIiOiIyMThlYTcwNC0zYTdhLTQ3NjYtYTI1MS02OWQ5YWE4ZTc1ZmYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJjNjk4MzMxMi1mZTM1LTQwODQtYWQxMC1kZTQwOGY3NzQ1YzgiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwibmFtZSI6Ik1vYmlsZSBVc2VyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibW9iaWxldXNlciIsImdpdmVuX25hbWUiOiJNb2JpbGUiLCJmYW1pbHlfbmFtZSI6IlVzZXIiLCJlbWFpbCI6InNoYXduLmZpcnRoQGdtYWlsLmNvbSJ9.HFCYIdW7Xyd0eKjXOouujVCUH5zjnxNDbOBLQOnjfOzEj4Ff4pHd6q6Ukl3unmWpvM9tU2FtzoPtsxQ-BqIu1ITBuq5_U-fk0OebTCOWtF566vW6BjJb3czRO8f3pB1hd5O7-xCT2KXSv-oEIi0s0ZweiLH0A1PeYy7wur_eCuhONgiu7wI6uR-gimcZVe7o3yhKsDnukrdR-N8xrp1T9PugQe5MZq20ER2Hvc-TW_npnTxRyCHa4tg59_p7-JBGA-BT03mFvOdd4vALeW8xkK3vtaVQevMSa8u3WZrpNGsAvoKpT6QTzm6W0TxAb3t_ptOjusxoLqqRacmP-C9OUg], Content-Type=[application/json], cookie=[JSESSIONID=E7uZRSGcR1FaiNDFCYmJcF7YnJaQof0yP3LxstT5.sfirth], Host=[localhost:8080]} response {Expires=[0], Cache-Control=[no-cache, no-store, must-revalidate], X-Powered-By=[Undertow/1], Server=[JBoss-EAP/7], Pragma=[no-cache]}}, authentication required: true
2018-08-30 13:13:19,738 DEBUG [io.undertow.request.security] (default task-4) Authentication outcome was NOT_ATTEMPTED with method io.undertow.security.impl.CachedAuthenticatedSessionMechanism#6715ee5d for HttpServerExchange{ GET /OurRestService/rest/contacts/ request {Postman-Token=[ba346ce6-995e-4c1c-859f-9d92c449b8c9], Accept=[*/*], cache-control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.2.0], Connection=[keep-alive], Authorization=[Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxSzJKWjUyVjFmU0pKRG82M0hmZHlJbjYyWERlX2hhSWhFMGV5ZXZkQlowIn0.eyJqdGkiOiI5YWM3MWUxMC1kMTYxLTRiYjYtYmE0OC1iMTRlZmJiZjRkZDEiLCJleHAiOjE1MzU2NDk0OTMsIm5iZiI6MCwiaWF0IjoxNTM1NjQ5MTkzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvbW9iaWxlcmVhbG0iLCJhdWQiOiJhZG1pbi1jbGkiLCJzdWIiOiIyMThlYTcwNC0zYTdhLTQ3NjYtYTI1MS02OWQ5YWE4ZTc1ZmYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJjNjk4MzMxMi1mZTM1LTQwODQtYWQxMC1kZTQwOGY3NzQ1YzgiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwibmFtZSI6Ik1vYmlsZSBVc2VyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibW9iaWxldXNlciIsImdpdmVuX25hbWUiOiJNb2JpbGUiLCJmYW1pbHlfbmFtZSI6IlVzZXIiLCJlbWFpbCI6InNoYXduLmZpcnRoQGdtYWlsLmNvbSJ9.HFCYIdW7Xyd0eKjXOouujVCUH5zjnxNDbOBLQOnjfOzEj4Ff4pHd6q6Ukl3unmWpvM9tU2FtzoPtsxQ-BqIu1ITBuq5_U-fk0OebTCOWtF566vW6BjJb3czRO8f3pB1hd5O7-xCT2KXSv-oEIi0s0ZweiLH0A1PeYy7wur_eCuhONgiu7wI6uR-gimcZVe7o3yhKsDnukrdR-N8xrp1T9PugQe5MZq20ER2Hvc-TW_npnTxRyCHa4tg59_p7-JBGA-BT03mFvOdd4vALeW8xkK3vtaVQevMSa8u3WZrpNGsAvoKpT6QTzm6W0TxAb3t_ptOjusxoLqqRacmP-C9OUg], Content-Type=[application/json], cookie=[JSESSIONID=E7uZRSGcR1FaiNDFCYmJcF7YnJaQof0yP3LxstT5.sfirth], Host=[localhost:8080]} response {Expires=[0], Cache-Control=[no-cache, no-store, must-revalidate], X-Powered-By=[Undertow/1], Server=[JBoss-EAP/7], Pragma=[no-cache]}}
2018-08-30 13:13:19,739 DEBUG [org.keycloak.adapters.BearerTokenRequestAuthenticator] (default task-4) Verifying access_token
2018-08-30 13:13:19,801 DEBUG [org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager] (default task-4) Get connection: {}->localhost:8180, timeout = 0
2018-08-30 13:13:19,802 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) [{}->localhost:8180] total kept alive: 0, total issued: 0, total allocated: 0 out of 20
2018-08-30 13:13:19,802 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) No free connections [{}->localhost:8180][null]
2018-08-30 13:13:19,802 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) Available capacity: 20 out of 20 [{}->localhost:8180][null]
2018-08-30 13:13:19,802 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) Creating new connection [{}->localhost:8180]
2018-08-30 13:13:19,809 DEBUG [org.apache.http.impl.conn.DefaultClientConnectionOperator] (default task-4) Connecting to localhost:8180
2018-08-30 13:13:19,820 DEBUG [org.apache.http.client.protocol.RequestAddCookies] (default task-4) CookieSpec selected: compatibility
2018-08-30 13:13:19,820 DEBUG [org.apache.http.client.protocol.RequestAuthCache] (default task-4) Auth cache not set in the context
2018-08-30 13:13:19,821 DEBUG [org.apache.http.client.protocol.RequestTargetAuthentication] (default task-4) Target auth state: UNCHALLENGED
2018-08-30 13:13:19,821 DEBUG [org.apache.http.client.protocol.RequestProxyAuthentication] (default task-4) Proxy auth state: UNCHALLENGED
2018-08-30 13:13:19,821 DEBUG [org.apache.http.impl.client.DefaultHttpClient] (default task-4) Attempt 1 to execute request
2018-08-30 13:13:19,821 DEBUG [org.apache.http.impl.conn.DefaultClientConnection] (default task-4) Sending request: GET /auth/realms/mobilerealm/protocol/openid-connect/certs HTTP/1.1
2018-08-30 13:13:19,821 DEBUG [org.apache.http.wire] (default task-4) >> "GET /auth/realms/mobilerealm/protocol/openid-connect/certs HTTP/1.1[\r][\n]"
2018-08-30 13:13:19,822 DEBUG [org.apache.http.wire] (default task-4) >> "Host: localhost:8180[\r][\n]"
2018-08-30 13:13:19,822 DEBUG [org.apache.http.wire] (default task-4) >> "Connection: Keep-Alive[\r][\n]"
2018-08-30 13:13:19,822 DEBUG [org.apache.http.wire] (default task-4) >> "[\r][\n]"
2018-08-30 13:13:19,822 DEBUG [org.apache.http.headers] (default task-4) >> GET /auth/realms/mobilerealm/protocol/openid-connect/certs HTTP/1.1
2018-08-30 13:13:19,822 DEBUG [org.apache.http.headers] (default task-4) >> Host: localhost:8180
2018-08-30 13:13:19,822 DEBUG [org.apache.http.headers] (default task-4) >> Connection: Keep-Alive
2018-08-30 13:13:19,825 DEBUG [org.apache.http.wire] (default task-4) << "HTTP/1.1 200 OK[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.wire] (default task-4) << "Connection: keep-alive[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.wire] (default task-4) << "Cache-Control: no-cache[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.wire] (default task-4) << "Content-Type: application/json[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.wire] (default task-4) << "Content-Length: 462[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.wire] (default task-4) << "Date: Thu, 30 Aug 2018 17:13:19 GMT[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.wire] (default task-4) << "[\r][\n]"
2018-08-30 13:13:19,826 DEBUG [org.apache.http.impl.conn.DefaultClientConnection] (default task-4) Receiving response: HTTP/1.1 200 OK
2018-08-30 13:13:19,826 DEBUG [org.apache.http.headers] (default task-4) << HTTP/1.1 200 OK
2018-08-30 13:13:19,826 DEBUG [org.apache.http.headers] (default task-4) << Connection: keep-alive
2018-08-30 13:13:19,826 DEBUG [org.apache.http.headers] (default task-4) << Cache-Control: no-cache
2018-08-30 13:13:19,826 DEBUG [org.apache.http.headers] (default task-4) << Content-Type: application/json
2018-08-30 13:13:19,826 DEBUG [org.apache.http.headers] (default task-4) << Content-Length: 462
2018-08-30 13:13:19,826 DEBUG [org.apache.http.headers] (default task-4) << Date: Thu, 30 Aug 2018 17:13:19 GMT
2018-08-30 13:13:19,829 DEBUG [org.apache.http.impl.client.DefaultHttpClient] (default task-4) Connection can be kept alive indefinitely
2018-08-30 13:13:19,833 DEBUG [org.apache.http.wire] (default task-4) << "{"keys":[{"kid":"qK2JZ52V1fSJJDo63HfdyIn62XDe_haIhE0eyevdBZ0","kty":"RSA","alg":"RS256","use":"sig","n":"5dKNlsMOu2W6WB0X1G27PcqUoBLPzPUDtfQmA7uf0BaPSkYu7CnbUPdShrs09RGQM6tWWL_6_qiacFi9jBgyEAhT9MhQ-rgkPe0YpdyQtVqznZH5CHkaAq9fTxwmEUXUZvRWuP4cAF7Pi5RfVgOIRflI-AgGyiH-ygdinRQx10nr-m7Us2seCM8QB5zjsKz3YLNdnk_bmvc6axhPpZAAlUCaAMM-j0Edc9CR7NDw09aUIKGED8wWdmxxdteqfPVjKiIlFjg1-QiroEH2PnNOqFTn2UKX6imOJmEc9XlJCsthlEHz-1Pqz23imiLkk-n2S3CJVyvnnI-OvUYaaOF6_w","e":"AQAB"}]}"
2018-08-30 13:13:19,836 DEBUG [org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager] (default task-4) Released connection is reusable.
2018-08-30 13:13:19,836 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) Releasing connection [{}->localhost:8180][null]
2018-08-30 13:13:19,836 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) Pooling connection [{}->localhost:8180][null]; keep alive indefinitely
2018-08-30 13:13:19,836 DEBUG [org.apache.http.impl.conn.tsccm.ConnPoolByRoute] (default task-4) Notifying no-one, there are no waiting threads
2018-08-30 13:13:19,838 DEBUG [org.keycloak.adapters.rotation.JWKPublicKeyLocator] (default task-4) Realm public keys successfully retrieved for client OurRestService. New kids: [qK2JZ52V1fSJJDo63HfdyIn62XDe_haIhE0eyevdBZ0]
2018-08-30 13:13:19,839 DEBUG [org.keycloak.adapters.BearerTokenRequestAuthenticator] (default task-4) successful authorized
2018-08-30 13:13:19,841 DEBUG [io.undertow.request.security] (default task-4) Authenticated as 218ea704-3a7a-4766-a251-69d9aa8e75ff, roles []
2018-08-30 13:13:19,849 DEBUG [org.keycloak.adapters.wildfly.WildflyRequestAuthenticator] (default task-4) propagate security context to wildfly
2018-08-30 13:13:19,849 DEBUG [org.keycloak.adapters.RequestAuthenticator] (default task-4) User '218ea704-3a7a-4766-a251-69d9aa8e75ff' invoking 'ourUrlToGetPastStackOverflow10URLlimit/contacts/' on client 'OurRestService'
2018-08-30 13:13:19,849 DEBUG [org.keycloak.adapters.RequestAuthenticator] (default task-4) Bearer AUTHENTICATED
2018-08-30 13:13:19,850 DEBUG [io.undertow.request.security] (default task-4) Authentication outcome was AUTHENTICATED with method org.keycloak.adapters.wildfly.WildflyAuthenticationMechanism#2d35f3f1 for HttpServerExchange{ GET /OurRestService/rest/contacts/ request {Postman-Token=[ba346ce6-995e-4c1c-859f-9d92c449b8c9], Accept=[*/*], cache-control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.2.0], Connection=[keep-alive], Authorization=[Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxSzJKWjUyVjFmU0pKRG82M0hmZHlJbjYyWERlX2hhSWhFMGV5ZXZkQlowIn0.eyJqdGkiOiI5YWM3MWUxMC1kMTYxLTRiYjYtYmE0OC1iMTRlZmJiZjRkZDEiLCJleHAiOjE1MzU2NDk0OTMsIm5iZiI6MCwiaWF0IjoxNTM1NjQ5MTkzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvbW9iaWxlcmVhbG0iLCJhdWQiOiJhZG1pbi1jbGkiLCJzdWIiOiIyMThlYTcwNC0zYTdhLTQ3NjYtYTI1MS02OWQ5YWE4ZTc1ZmYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJjNjk4MzMxMi1mZTM1LTQwODQtYWQxMC1kZTQwOGY3NzQ1YzgiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwibmFtZSI6Ik1vYmlsZSBVc2VyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibW9iaWxldXNlciIsImdpdmVuX25hbWUiOiJNb2JpbGUiLCJmYW1pbHlfbmFtZSI6IlVzZXIiLCJlbWFpbCI6InNoYXduLmZpcnRoQGdtYWlsLmNvbSJ9.HFCYIdW7Xyd0eKjXOouujVCUH5zjnxNDbOBLQOnjfOzEj4Ff4pHd6q6Ukl3unmWpvM9tU2FtzoPtsxQ-BqIu1ITBuq5_U-fk0OebTCOWtF566vW6BjJb3czRO8f3pB1hd5O7-xCT2KXSv-oEIi0s0ZweiLH0A1PeYy7wur_eCuhONgiu7wI6uR-gimcZVe7o3yhKsDnukrdR-N8xrp1T9PugQe5MZq20ER2Hvc-TW_npnTxRyCHa4tg59_p7-JBGA-BT03mFvOdd4vALeW8xkK3vtaVQevMSa8u3WZrpNGsAvoKpT6QTzm6W0TxAb3t_ptOjusxoLqqRacmP-C9OUg], Content-Type=[application/json], cookie=[JSESSIONID=E7uZRSGcR1FaiNDFCYmJcF7YnJaQof0yP3LxstT5.sfirth], Host=[localhost:8080]} response {Expires=[0], Cache-Control=[no-cache, no-store, must-revalidate], X-Powered-By=[Undertow/1], Server=[JBoss-EAP/7], Pragma=[no-cache]}}
2018-08-30 13:13:19,850 DEBUG [io.undertow.request.security] (default task-4) Authentication result was AUTHENTICATED for HttpServerExchange{ GET /OurRestService/rest/contacts/ request {Postman-Token=[ba346ce6-995e-4c1c-859f-9d92c449b8c9], Accept=[*/*], cache-control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.2.0], Connection=[keep-alive], Authorization=[Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxSzJKWjUyVjFmU0pKRG82M0hmZHlJbjYyWERlX2hhSWhFMGV5ZXZkQlowIn0.eyJqdGkiOiI5YWM3MWUxMC1kMTYxLTRiYjYtYmE0OC1iMTRlZmJiZjRkZDEiLCJleHAiOjE1MzU2NDk0OTMsIm5iZiI6MCwiaWF0IjoxNTM1NjQ5MTkzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvbW9iaWxlcmVhbG0iLCJhdWQiOiJhZG1pbi1jbGkiLCJzdWIiOiIyMThlYTcwNC0zYTdhLTQ3NjYtYTI1MS02OWQ5YWE4ZTc1ZmYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJjNjk4MzMxMi1mZTM1LTQwODQtYWQxMC1kZTQwOGY3NzQ1YzgiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwibmFtZSI6Ik1vYmlsZSBVc2VyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibW9iaWxldXNlciIsImdpdmVuX25hbWUiOiJNb2JpbGUiLCJmYW1pbHlfbmFtZSI6IlVzZXIiLCJlbWFpbCI6InNoYXduLmZpcnRoQGdtYWlsLmNvbSJ9.HFCYIdW7Xyd0eKjXOouujVCUH5zjnxNDbOBLQOnjfOzEj4Ff4pHd6q6Ukl3unmWpvM9tU2FtzoPtsxQ-BqIu1ITBuq5_U-fk0OebTCOWtF566vW6BjJb3czRO8f3pB1hd5O7-xCT2KXSv-oEIi0s0ZweiLH0A1PeYy7wur_eCuhONgiu7wI6uR-gimcZVe7o3yhKsDnukrdR-N8xrp1T9PugQe5MZq20ER2Hvc-TW_npnTxRyCHa4tg59_p7-JBGA-BT03mFvOdd4vALeW8xkK3vtaVQevMSa8u3WZrpNGsAvoKpT6QTzm6W0TxAb3t_ptOjusxoLqqRacmP-C9OUg], Content-Type=[application/json], cookie=[JSESSIONID=E7uZRSGcR1FaiNDFCYmJcF7YnJaQof0yP3LxstT5.sfirth], Host=[localhost:8080]} response {Expires=[0], Cache-Control=[no-cache, no-store, must-revalidate], X-Powered-By=[Undertow/1], Server=[JBoss-EAP/7], Pragma=[no-cache]}}
2018-08-30 13:13:19,851 DEBUG [org.keycloak.adapters.AuthenticatedActionsHandler] (default task-4) AuthenticatedActionsValve.invoke ourUrlToGetPastStackOverflow10URLlimit/contacts/
2018-08-30 13:13:19,851 DEBUG [org.keycloak.adapters.AuthenticatedActionsHandler] (default task-4) Policy enforcement is disabled.

Answer 1

Problem Solved!
What is not obvious from the Keycloak/SSO documentation is that on RH-SSO you need a Public client paired with your bearer-only client in order to get your authenticated token. So, the solution is to create a 2nd SSO client in your realm that is "public":
* Select `Clients` from the menu
* Click `Create`
* Add the following values:
* Client ID: RestAuth
* Client Protocol: `openid-connect`
* Click `Save`
You request your token from the public client, and that will give you access to your bearer-only rest API on JBoss.