Why is a custom JwtAuthenticationConverter usually needed when integrating Spring Security with Keycloak?

Keycloak nests role information inside a custom claim structure (typically realm_access.roles), which doesn't automatically map to Spring Security's expected GrantedAuthority objects. Without a custom converter extracting and wrapping these roles (usually with a ROLE_ prefix) into GrantedAuthority instances, an authenticated user will have no usable authorities from Spring Security's perspective, and role-based checks will always fail.