[keycloak-user] direct access grant + kerberos