Keycloak authenticate users with no role

Question

I would like to be able to authenticate requests where the user has no role assigned.

I'm using keycloak core and tomcat adapter to authenticate. Keycloak constraints are specified in the web.xml like:

  <security-role>
    <role-name>L1</role-name>
</security-role>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>applicant-login-required</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>L1</role-name>
    </auth-constraint>
</security-constraint>

I have tried a number of things like removing auth-constraint and security-role or changing to

<auth-constraint>
  <role-name>*</role-name>
</auth-constraint>

but this is not authenticating anyone any more

Answer 1

Although I could not find documentation to confirm this, I think it's impossible to authenticate users with no role. All users should be assigned a role.