* create a new confidential client in the keycloak realm export
* configure cpabe-server to use this client
* reconfigure all other services to use the public client