When AMQ Broker is set up similarly to the example at https://github.com/rh-messaging/activemq-artemis/tree/7.11.0.CR2/examples/features/standard/security-keycloak to use Red Hat SSO for authentication, curl queries using a bearer token obtained from SSO fail with a 403 error, even if direct grants are enabled for the console security realm. This means automated monitoring tools cannot work with the current implementation.
I got it working only by replacing console.war with the upstream hawtio.war 2.15.0 while it doesn't work with the upstream hawtio.war 2.14.5.