[openstack][keystone] user who mapped from openid cannot create application credentials

Hello. I have a problem that I use openid for authentication to my cloud but my users cannot create application credentials. I must add them to a group via Horizon UI to use application credentials. Is there any way to do that without adding users to a group from Horizon? Thank you. Nguyen Huu Khoi