[keycloak-user] What should the endpoint be for a Keycloak IDP initiated SSO?