Indeed, it's excellent. I'm using it with an ldap back end for my companys internal infra. Unfortunately it doesn't support u2f as a 2nd factor yet, just totp codes. That's the only thing I can think of as critique for keycloak, so it's pretty damn good.