Unable to use Keycloak in Spring Boot 2.1 due to duplicated Bean Registration httpSessionManager

This helped me to resolve an issue, remove @KeycloakConfiguration and use this instead (from KEYCLOAK-8725):

Java:

@Configuration
@ComponentScan(
        basePackageClasses = KeycloakSecurityComponents.class,
        excludeFilters = @ComponentScan.Filter(type = FilterType.REGEX, pattern = "org.keycloak.adapters.springsecurity.management.HttpSessionManager"))
@EnableWebSecurity

Kotlin:

@Configuration
@ComponentScan(
    basePackageClasses = [KeycloakSecurityComponents::class],
    excludeFilters = [ComponentScan.Filter(type = FilterType.REGEX, pattern = ["org.keycloak.adapters.springsecurity.management.HttpSessionManager"])]
)
@EnableWebSecurity

It looks like there's a bug in Keycloak's Spring Security integration which means that an application that subclasses KeycloakWebSecurityConfigurerAdapter will try to create two beans named httpSessionManager. When two beans are defined with the same name, the second definition that is encountered will attempt to override the first. This overriding is prohibited by default in Spring Boot 2.1. I would recommend reporting this as a bug against Keycloak's Spring Security integration. While you are waiting for the bug to be resolved, you can work around the problem by setting spring.main.allow-bean-definition-overriding=true in application.properties.


I use keycloak-spring-security-adapter in version 6.0.1.The solution to remove @KeycloakConfiguration with special configuration did not work for me.

My solution was to add the following line in application.properties:

spring.main.allow-bean-definition-overriding: true