I only briefly used Keycloak at my "home lab" (a SBC with traefik and few services) and felt nice: it had that feature of syncing with ldap, which I believe makes it special in that space