Since you're evaluating Keycloak, I'd recommend checking out Ory and SuperTokens.io as well (I am the cofounder of the latter)