diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/controller/LoginController.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/controller/LoginController.java
index bc5405967..ac08928d6 100644
--- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/controller/LoginController.java
+++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/controller/LoginController.java
@@ -1,5 +1,8 @@
 package ru.spcex.clearing.backendapi.controller;
 
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -10,6 +13,7 @@ import org.springframework.stereotype.Controller;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.client.RestTemplate;
 import ru.spcex.clearing.backendapi.security.TokenRequest;
 
@@ -17,17 +21,24 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.util.Map;
 
+/**
+ * при bearer only false
+ * клиент сюда не попадает
+ * срабатывает KeycloakAuthenticationProvider с редиректом на логин keycloak
+ */
 @Controller
-@RequestMapping("/backend-api-login")
+@RequestMapping("/sso")
 public class LoginController {
     private final RestTemplate restTemplate;
+    private final ObjectMapper json;
 
     @Autowired
     public LoginController(@Qualifier("clearing-rest") RestTemplate restTemplate) {
         this.restTemplate = restTemplate;
+        this.json = new ObjectMapper();
     }
 
-    @RequestMapping(value = "/perform-login", method = RequestMethod.POST)
+    @RequestMapping(value = "/login", method = RequestMethod.POST)
     public ResponseEntity<Map<String, Object>> refreshToken(HttpServletRequest httpServletRequest,
                                                             HttpServletResponse httpServletResponse) {
         RefreshableKeycloakSecurityContext session = (RefreshableKeycloakSecurityContext) httpServletRequest.getSession().getAttribute(KeycloakSecurityContext.class.getName());
@@ -42,7 +53,44 @@ public class LoginController {
                 "http://10.200.200.147:8080/realms/master/protocol/openid-connect/token",
                 request, String.class);
         return null;
+    }
 
+    @RequestMapping(value = "/login", method = RequestMethod.GET)
+    @ResponseBody
+    public KeycloakAuthResponse getExample(HttpServletRequest httpServletRequest,
+                                                            HttpServletResponse httpServletResponse) throws JsonProcessingException {
+        RefreshableKeycloakSecurityContext session = (RefreshableKeycloakSecurityContext) httpServletRequest.getSession().getAttribute(KeycloakSecurityContext.class.getName());
+        String login = httpServletRequest.getHeader("clearing-login");
+        String password = httpServletRequest.getHeader("clearing-password");
+        HttpEntity<MultiValueMap<String, String>> request =
+                new TokenRequest.Builder()
+                        .username(login)
+                        .password(password)
+                        .build();
+        ResponseEntity<String> response = restTemplate.postForEntity(
+                "http://10.200.200.147:8080/realms/master/protocol/openid-connect/token",
+                request, String.class);
+        KeycloakAuthResponse authInfo = json.readValue(response.getBody(), KeycloakAuthResponse.class);
+        return authInfo;
+    }
+
+    private static class KeycloakAuthResponse {
+        @JsonProperty("access_token")
+        private String access_token;
+        @JsonProperty("expires_in")
+        private String expires_in;
+        @JsonProperty("refresh_expires_in")
+        private String refresh_expires_in;
+        @JsonProperty("refresh_token")
+        private String refresh_token;
+        @JsonProperty("token_type")
+        private String token_type;
+        @JsonProperty("not-before-policy")
+        private String not_before_policy;
+        @JsonProperty("session_state")
+        private String session_state;
+        @JsonProperty("scope")
+        private String scope;
     }
 
 }
diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java
index bd84f2db7..eeff2b438 100644
--- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java
+++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java
@@ -40,6 +40,6 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
                 .antMatchers("/sso/login").permitAll()
                 .antMatchers("/error").permitAll()
                 .antMatchers("/backend-api-login/**").permitAll()
-                .anyRequest().hasAnyRole("admin");
+                .anyRequest().hasAnyRole("admin", "default-roles-master");
     }
 }
diff --git a/clearing-parent/backend-api/src/main/resources/keycloak.json b/clearing-parent/backend-api/src/main/resources/keycloak.json
index d9ba176b0..4c07b528d 100644
--- a/clearing-parent/backend-api/src/main/resources/keycloak.json
+++ b/clearing-parent/backend-api/src/main/resources/keycloak.json
@@ -8,7 +8,7 @@
   "cors-max-age" : 1000,
   "cors-allowed-methods" : "POST, PUT, DELETE, GET",
   "cors-exposed-headers" : "WWW-Authenticate",
-  "bearer-only" : true,
+  "bearer-only" : false,
   "enable-basic-auth" : false,
   "expose-token" : false,
   "verify-token-audience" : true,