Hey, sorry if this is off-topic, but how have you been finding Keycloak? This is the first time I've seen it mentioned on here, and it looks like a great auth solution at first glance.
- Very complete OpenID Connect implementation.
- Back-channel logout.
- Short-lived tokens and lots of tooling to handle refreshing them. This solves many of the issues associated with JWT expiration.
- Documentation is very complete.
- Their data model allows for very fine-grained access control - you can issue sub-tokens with limited scopes, limit scopes per client and so on.
- Easy to deploy in OpenShift/k8s.
Only pain points are the build process (Java has got nothing on NodeJS as far as number of dependencies go!), data migrations and the fact that it's written in Java (start up time in CI).