AuthBridge demos: admin token fetched from `rossoctl` realm with admin/admin fails (should be `master` realm)

[pdettori]

Summary

Following the AuthBridge demo docs (e.g. weather-agent/demo-ui.md), the "Inside the pod, get credentials and send a request" step fails: ADMIN_TOKEN and the agent TOKEN both come back null.

Root cause

The admin-token step performs a password grant against the rossoctl realm with username=admin / password=admin:

ADMIN_TOKEN=$(curl -s .../realms/rossoctl/protocol/openid-connect/token \
  -d grant_type=password -d client_id=admin-cli -d username=admin -d password=admin | jq -r .access_token)

But admin/admin is the master realm credential. The rossoctl realm's admin user has a randomly generated password (visible via show-services.sh, e.g. admin / m8-Eu8xa0-AIamHnsHYNQQ). So the grant returns 401 invalid_grant, jq yields the literal null, and the failure cascades:

Step	Result
ADMIN_TOKEN from rossoctl w/ password=admin	401 invalid_grant → null
client lookup with Bearer null	401 → CLIENT_ID/CLIENT_SECRET = null
agent TOKEN via client_credentials	fails → null

Verified against a local Kind deployment: rossoctl+admin → 401, master+admin → 200.

Fix

Fetch the admin token from the master realm (admin/admin is stable and documented; the master admin has cross-realm rights, so /admin/realms/rossoctl/clients still works). The client lookup and the agent client_credentials grant stay on the rossoctl realm.

Verified end-to-end with only the realm changed to master:

admin token len: 766
CLIENT_ID=spiffe://localtest.me/ns/team1/sa/weather-service  secret_len=32
agent token http=200  token_len=1262

Affected files (admin-token password grants targeting rossoctl)

• authbridge/demos/weather-agent/demo-ui.md
• authbridge/demos/github-issue/demo-ui.md (×2)
• authbridge/demos/github-issue/demo-manual.md (×2)
• authbridge/demos/github-issue/demo-rbac.md (×2)
• authbridge/demos/github-issue/demo-aiac.md (×2, via REALM_NAME)

Out of scope (intentional / correct): the WRONG_ISSUER_TOKEN master-realm negative test in demo-manual.md/demo-rbac.md, the client_credentials agent-token grants (correctly rossoctl), and /admin/realms/rossoctl/clients admin-API paths.

Assisted-By: Claude Code