class KeycloakServiceClient {

  public KeycloakTokenResponse getIdentityProviderToken(String oauthProvider)
      throws ForbiddenException, BadRequestException, IOException, NotFoundException,
          ServerException, UnauthorizedException {
    String url =
        UriBuilder.fromUri(keycloakSettings.get().get(AUTH_SERVER_URL_SETTING))
            .path("/realms/{realm}/broker/{provider}/token")
            .build(keycloakSettings.get().get(REALM_SETTING), oauthProvider)
            .toString();
    try {
      String response = doRequest(url, HttpMethod.GET, null);
      // Successful answer is not a json, but key=value&foo=bar format pairs
      return DtoFactory.getInstance()
          .createDtoFromJson(toJson(response), KeycloakTokenResponse.class);
    } catch (BadRequestException e) {
      if (assotiateUserPattern.matcher(e.getMessage()).matches()) {
        // If user has no link with identity provider yet,
        // we should threat this as unauthorized and send to OAuth login page.
        throw new UnauthorizedException(e.getMessage());
      }
      throw e;
    }
  }

  @Inject public  KeycloakServiceClient(KeycloakSettings keycloakSettings, JwtParser jwtParser);

}