Broken authentication with Grafana when upgrading to Keycloak 15.x

Securing applications
1

We have a working deployment using the Keycloak operator and Grafana. That works with Keycloak 12.x.

After upgrading the deployment to Keycloak 15.x, Grafana fails to start the login flow, and we se the following error in the Keycloak logs:

12:33:32,706 ERROR [org.keycloak.services] (default task-6) KC-SERVICES0093: Invalid parameter value for: scope
12:33:32,713 WARN  [org.keycloak.events] (default task-6) type=LOGIN_ERROR, realmId=26be57fb-68f4-4a50-9b2e-f94277591fef, clientId=grafana, userId=null, ipAddress=192.168.39.1, error=invalid_request, response_type=code, redirect_uri=http://grafana.192.168.39.202.nip.io/login/generic_oauth, response_mode=query
2

Ok, looks like I now need the following lines in the KeycloakClient custom resource:

    defaultClientScopes:
      - "email"
      - "profile"
      - "roles"
      - "web-origins"
    optionalClientScopes:
      - "address"
      - "microprofile-jwt"
      - "offline_access"
      - "phone"

Otherwise the Grafana server cannot request the openid profile email scopes.