the docs list the characters that are allowed but it is not checked or enforced by the program. Please check the user input. It prevents user from connecting via GUI but login to webinterface works.
Password is wrongly saved in IDB and in Keycloak it is correct.
Support told me to make that "feature request" because that behavior is not seen as bug.