Keycloak supports this via direct access grants:
http://docs.jboss.org/keycloak/docs/1.0.4.Final/userguide/html/direct-access-grants.html

So, that needs to be done on the KC UI in order to have that enabled for UPS.

IMO that's good enough, for now. Should we close the ticket ?