My team is in the middle of implementing keycloak. Some of the more advanced use cases have been difficult, strictly due to the patchy documentation.