API Platform Keycloak Security

security.yaml

# config/packages/security.yaml
security:
    enable_authenticator_manager: true
    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
    firewalls:
        main:
            pattern: ^/
            oauth:
                resource_owners:
                    keycloak: "/login/check"
                login_path:   /login
                use_forward:  false
                failure_path: /login
                oauth_user_provider:
                    service: hwi_oauth.user.provider
                provider: hwi_oauth.user.provider
    access_control:
        - { path: ^/login, roles: PUBLIC_ACCESS }
        - { path: ^/, roles: ROLE_USER } // force login