My first thoughts for fixing it are:
1) Changing admin_api rule from
"admin_api": "is_admin:True" to "admin_api": "rule:service_or_admin"
2) Changing the charm to grant admin to the service users on the service project in the service domain.
My first thoughts for fixing it are:
1) Changing admin_api rule from
"admin_api": "is_admin:True" or_admin"
to
"admin_api": "rule:service_
2) Changing the charm to grant admin to the service users on the service project in the service domain.