Is this something that a future keycloak version helps with ? If so, I'd say -> move to 1.0.1 or 1.0.2 of the UPS