Keycloak is an identity provider. It's an Oauth2/OpenIDConnect authorization server. Pomerium looks to be some kind of proxy to enforce authorization (in OAuth2

Keycloak is an identity provider. It's an Oauth2/OpenIDConnect authorization server. Pomerium looks to be some kind of proxy to enforce authorization (in OAuth2 jargon, it would be a resource server). Succinctly: Keycloak issues security tokens, Pomerium (I think) accepts security tokens.