private static String REALM = "MY_TEST_REALM";

@Override
protected void configure(HttpSecurity http) throws Exception {

    JwtWebSecurityConfigurer
            .forRS256(apiAudience, issuer)
            .configure(http)
            .authorizeRequests()
            .antMatchers(HttpMethod.GET, "/es/status").permitAll()
            .antMatchers(HttpMethod.GET, "/login").permitAll()
            .antMatchers("/users/all").hasRole(Role.ADMIN.getValue())
            // .antMatchers("/users/all").hasRole("ADMIN") this also donot
             work
            .antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources", "/configuration/security",
                    "/swagger-ui.html", "/webjars/**", "/swagger-resources/configuration/ui", "/swagger-ui.html")
            .permitAll()
            .anyRequest().authenticated();
}

{
"timestamp": "2018-07-23T06:07:25.962+0000",
"status": 403,
"error": "Forbidden",
"message": "Forbidden",
"path": "/users/all"
}