[keycloak-user] How do I get external IDP attributes in custom JS auth flow during broker first login? (I bet Dmitry knows :)

Hello. I have a simple JS execution which denies access as the first step of the first broker login flow. I would like to access some of the attributes that Keycloak writes out to the log when executing this flow (see below) What objects or variables must my JS execution load in order to get the identity_provider_identity attribute listed below? 20:29:56,588 WARN [org.keycloak.events] (default task-527) type=IDENTITY_PROVIDER_FIRST_LOGIN_ERROR, realmId=re, clientId=tblic, userId=null, ipAddress=90., error=user_not_found, identity_provider=google, auth_method=openid-connect, redirect_uri=http://localhost:8222?clientid=tic, identity_provider_identity=user(a)gmail.com, code_id=b07317fdb Thanks in advance! Geoff