Just to add, the keycloak has a log message of
08:06:20,217 WARN [org.keycloak.events] (default task-1)
type=LOGIN_ERROR, realmId=master, clientId=bikes-app, userId=null,
ipAddress=192.168.0.5, error=invalid_client_credentials,
grant_type=password
Not sure why userid is null when the curl command uses "username" (which does
work from the server)