[keycloak-dev] can we get away with federating user/cred only?