It will definitely work - Keycloak can provide its own user database, or it can use external one, as well as do some crazier things that go outside of the scope

It will definitely work - Keycloak can provide its own user database, or it can use external one, as well as do some crazier things that go outside of the scope you mentioned. In simplest setup (non-HA, local user database), you would create users inside Keycloak, assign them to different groups, then create applications (which handle configuration for individual applications like grafana and gitea) and create rules that specify that only users that belong to specific group can login to specific application. You can also allow linking multiple external SSOs this way to single keycloak identity, and even include login through kerberos5 or client certificates.