Comment by rawfan

Just use oauth2-proxy with keycloak to put SSO in front of any self-hosted app.