Jhipster OIDC config for authorization code

First, my English is not very well. So I'm sorry if it may make you confused with my question!

I am using jhipster 6.10.3

My application use authorization code flow with Keycloak

I see in jhipster security config

http
        .csrf()
        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
    .and()
        .addFilterBefore(corsFilter, CsrfFilter.class)
        .exceptionHandling()
            .authenticationEntryPoint(problemSupport)
            .accessDeniedHandler(problemSupport)
    .and()
        .headers()
        .contentSecurityPolicy("default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:")
    .and()
        .referrerPolicy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN)
    .and()
        .featurePolicy("geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'")
    .and()
        .frameOptions()
        .deny()
    .and()
        .authorizeRequests()
        .antMatchers("/api/auth-info").permitAll()
        .antMatchers("/api/**").authenticated()
        .antMatchers("/management/health").permitAll()
        .antMatchers("/management/info").permitAll()
        .antMatchers("/management/prometheus").permitAll()
        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
    .and()
        .oauth2Login()
    .and()
        .oauth2ResourceServer()
            .jwt()
            .jwtAuthenticationConverter(authenticationConverter())
            .and()
        .and()
            .oauth2Client();

They config authenticationEntryPoint use problemSupport by zalando

When I access a secure API. It return result:

{
  "type" : "https://www.jhipster.tech/problem/problem-with-message",
  "title" : "Unauthorized",
  "status" : 401,
  "detail" : "Full authentication is required to access this resource",
  "path" : "/api/users",
  "message" : "error.http.401"
}

Then if I remove this config: authenticationEntryPoint(problemSupport)

It will redirect to keycloak login.

My question is:

What should I config for my application?

1. Config at keycloak two client. One with access type Public for Frontend App. One with access type Confidential for Backend App. -> My FE Application will redirect to keycloak when unauthorize

2. Config at keycloak one client with access type Confidential. And remove this config: authenticationEntryPoint(problemSupport). -> My BE Application will redirect to keycloak when unauthorize

Should I config any request not secure will redirect to keycloak?