If keycloak provides an openID connect endpoint it should be fairly trivial to extend tobab to use it.

Goth might actually have specific support for keycloak, but I'm not sure about that to be honest.