we have a Keycloak broker and 2 external identity providers. An administrator should be able to invite new users. Whereby he already defines his future role there. After clicking on the invitation email, a user should be able to select their IdP account. This should then be securely linked to the broker account to enable login to the invited service.