I've integrated keycloak for SSO in our apps, we have a one-to-one mapping between keycloak realms and the tenants in our apps, works great and it can glue together many disparate IdP/auth solutions: onelogin, LDAP/AD, etc. At one moment we needed to implement a custom OTP method, so we developed a plugin by implementing a simple SPI (the auth flow is configurable). It is a very stable piece of software, we have a combination of Terraform+ansible scripts to deploy it, and once it is done we forget about it until we need to upgrade the version using the same scripts. The biggest drawback IMHO is the documentation quality ...