[Help Wanted] Question with OAuth2 authentication

[Saintyang]

I'm testing the gravitino recntly. Follow the https://gravitino.apache.org/docs/0.6.1-incubating/security/how-to-authenticate ,I succeed to login with user test. But when I want to add another user test1 , I got some trouble.
I add sql into oauth2-registered-client-schema.sql which in sample-auth-server and then re-launch the container
INSERT INTO oauth2_registered_client (id,client_id,client_secret,client_name, client_authentication_methods, authorization_grant_types, redirect_uris, scopes, client_settings, token_settings) VALUES ('2','test1','{noop}test1','test','client_secret_post', 'client_credentials', 'www.baidu.com', 'test', '{"@class":"java.util.Collections$UnmodifiableMap","settings.client.require-proof-key":false,"settings.client.require-authorization-consent":false}', '{"@class":"java.util.Collections$UnmodifiableMap","settings.token.reuse-refresh-tokens":true,"settings.token.id-token-signature-algorithm":["org.springframework.security.oauth2.jose.jws.SignatureAlgorithm","RS256"],"settings.token.access-token-time-to-live":["java.time.Duration",300.000000000],"settings.token.access-token-format":{"@class":"org.springframework.security.oauth2.server.authorization.settings.OAuth2TokenFormat","value":"self-contained"},"settings.token.refresh-token-time-to-live":["java.time.Duration",3600.000000000],"settings.token.authorization-code-time-to-live":["java.time.Duration",300.000000000]}');
It's ok to request curl --location --request POST 'http://127.0.0.1:8177/oauth2/token?grant_type=client_credentials&client_id=test1&client_secret=test1&scope=test'
and got 401 Unauthorized to request http://localhost:8090/api/version.
After reading the code, I think configuration gravitino.authenticator.oauth.serviceAudience = test stops user test1 from passing the authentication.

I need multiple users to login gravitino by their own account, and I don't know what went wrong , Look forward to your favourable reply,

[roryqi]

Field audience is aligned to the field scope in the request. The client_id of the request represents the user .

[Saintyang]

I don't get the point. My new user test1 have same scope test with user test , and I decode the return info from /oauth/token , get value test1 in Field aud。It's different from my setting value for Field scope test

[roryqi]

I don't get the point. My new user test1 have same scope test with user test , and I decode the return info from /oauth/token , get value test1 in Field aud。It's different from my setting value for Field scope test

Did you use the demo OAuth2 server in our document? The OAuth server has only one user now. It's also used for demo, too.