Scenario 14: After correctly setting up Keycloak with realm roles assigned to a test user, every API call still returns 403 Forbidden in the Spring Boot resource server.

Keycloak nests roles inside a realm_access.roles claim that doesn't automatically map to Spring Security's expected GrantedAuthority objects — without a custom JwtAuthenticationConverter extracting and wrapping these into authorities (typically with a ROLE_ prefix), the authenticated user has zero usable authorities from Spring Security's point of view, so every hasRole()/@PreAuthorize check fails regardless of what's configured in Keycloak's admin console.