[keycloak-user] disable kerberos SSO when needed