[keycloak-user] implicitly pick the IdP for brokering