Create an AD FS Application Group for confidential clients like SAF-based components (password grant flow)

Choose "Server Application" Wizard...
Use "roDPE" as Client Id and add "http://test" as Redirect URI (which is anyway ignored)...
Generate a shared secret...