Q:

How to use KeycloakRestTemplate

I want to implement a simple Spring Boot client app. Which should access a OAauth2 secured service. Some kind of a proxy. This "proxy-service" SHOULD not be secured.
I want to use KeycloakRestTemplate for the remote REST calls.
Following the docs: http://www.keycloak.org/docs/latest/securing_apps/index.html#_spring_boot_adapter
So far I included the following dependencies:
dependencyManagement {
  imports {
    mavenBom "org.keycloak.bom:keycloak-adapter-bom:3.4.0-FINAL"
  }
}

dependencies {
  compile('org.springframework.boot:spring-boot-starter')
  compile('org.springframework.boot:spring-boot-starter-web')
  compile('org.springframework.boot:spring-boot-starter-security')
  compile('org.keycloak:keycloak-spring-boot-starter')
  compile('org.keycloak:keycloak-spring-security-adapter')
}

I added a Config Class:
@KeycloakConfiguration
public class KeycloakWebSecurityContextConfig extends 
KeycloakWebSecurityConfigurerAdapter {

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(keycloakAuthenticationProvider());
}

/**
 * Defines the session authentication strategy.
 */
@Bean
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
    return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}

@Bean
public KeycloakConfigResolver KeycloakConfigResolver() {
    return new KeycloakSpringBootConfigResolver();
}

@Autowired
public KeycloakClientRequestFactory keycloakClientRequestFactory;

@Bean
@Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE)
public KeycloakRestTemplate keycloakRestTemplate() {
    return new KeycloakRestTemplate(keycloakClientRequestFactory);
}

@Bean
public FilterRegistrationBean keycloakAuthenticationProcessingFilterRegistrationBean(
    KeycloakAuthenticationProcessingFilter filter) {
    FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
    registrationBean.setEnabled(false);
    return registrationBean;
}

@Bean
public FilterRegistrationBean keycloakPreAuthActionsFilterRegistrationBean(
    KeycloakPreAuthActionsFilter filter) {
    FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
    registrationBean.setEnabled(false);
    return registrationBean;
}

@Override
protected void configure(HttpSecurity http) throws Exception
{
    super.configure(http);
    http
        .authorizeRequests()
        .anyRequest().permitAll();
}
}

And made a service component:
    @Autowired
private KeycloakRestTemplate template;

@Value("${person-service.url}")
private String endpoint;

@RequestMapping(value = "/person", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
public Collection<Person> getPerson(){
    ResponseEntity<Person[]> entity = template.getForEntity(endpoint, Person[].class);
    return Arrays.asList(entity.getBody());
}

BTW: "Person-service" is the secured remote service.
Calling the getPerson method gives me:
java.lang.IllegalStateException: Cannot set authorization header because Authentication is of type class org.springframework.security.authentication.AnonymousAuthenticationToken but class org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken is required
at org.keycloak.adapters.springsecurity.client.KeycloakClientRequestFactory.getKeycloakSecurityContext(KeycloakClientRequestFactory.java:75) ~[keycloak-spring-security-adapter-3.4.0.Final.jar:3.4.0.Final]

I think spring-security comes in the way and creates a AnonymousAuthenticationToken before the KeycloakAdapter has a chance to create its own SecurityContext. 
So how do I initiate and use the KeycloakRestTemplate correctly?

A:

The KeycloakRestTemplate works when your micro-service was initially called by a logged in user, then from there you can make calls to other protected micro-services.
If you want your micro-service to initiate a call to another protected micro-service you are better off using a OAuth2RestTemplate.
The RestTemplate below will automatically login to keycloak with a Keycloak Service Account and renew the bearer token when necessary:
String url = "https://keycloakserver:8888/auth/realms/testrealm/protocol/openid-connect/token";

ClientCredentialsResourceDetails resourceDetails = new ClientCredentialsResourceDetails();
resourceDetails.setGrantType(OAuth2Constants.CLIENT_CREDENTIALS);
resourceDetails.setAccessTokenUri(url);
resourceDetails.setClientId("your-micro-service-client-id");
resourceDetails.setClientSecret("p455word");

RestTemplate restTemplate = new OAuth2RestTemplate(resourceDetails);

