[keycloak-user] Only permit social login for existing, linked accounts

How can I allow identity providers like Google to only be used to login with an existing account? I'm sure this has been asked (I see the questions <http://lists.jboss.org/pipermail/keycloak-dev/2015-March/004031.html>) and answered (this I can't find) and must have something to do with custom authentication flows. I've made a copy of the First Broker Login flow and messed around with priorities and requirements, but I can't get it right. Thanks, Geoff