Look here, lines 197-200 and you'll find your answer:

Most of the arguments for the constructor of the authenticateBearerToken method are injected each time the IdentityBrokerService is instantiated, line 225 here:

https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/services/resources/RealmsResource.java
--