在Sping Boot 应用程序中，我有：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled = true)
@Slf4j
public class KeycloakSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    List<String> aIPWhiteList;

    @Autowired
    List<String> bIPWhiteList;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        String aIPAddressesFilterStr = defineIPFilters(aIPWhiteList);
        String bIPAddressesPFilterStr = defineIPFiltersbIPWhiteList);

        http.authorizeRequests()
                .antMatchers("/order/a/**").access(aIPAddressesFilterStr)
                .antMatchers("/b/order").access(bIPAddressesFilterStr)
                .anyRequest().permitAll();

        http.cors().and().csrf().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    private String defineP4IPFilters(List<String> whiteList) {
        StringBuilder ipAddressesFilterStr = new StringBuilder();
        for (String ip: whiteList) {
            ipAddressesFilterStr.append("hasIpAddress('").append(ip).append("') or ");
        }
        return ipAddressesFilterStr.substring(0, ipAddressesFilterStr.length() - 4);
    }
    
}

我想知道我如何为这个“B/order”做另一个认证，基于存储在头中的API密钥。基本上只有这1个端点我想授权用户不同。其他端点是由keycloak授权，从注册用户完成。但在这里我想只通过API密钥，这是静态的。
有什么主意吗？
谢谢！