Super roughly, but you might be able to implement an Authentication SPI[0] and wire that into an Authorization Code flow.

[0] - https://www.keycloak.org/docs/latest/server_development/#_au...