Create an AD FS Application Group for confidential clients like SAF-based components (password grant flow)

Choose "Server Application" Wizard...

Use "roDPE" as Client Id and add "http://test" as Redirect URI (which is anyway ignored)...

Generate a shared secret...