[keycloak-user] kc_idp_hint for Kerberos