I did the same years ago, but with Okta. It was just as much of a pain as it is with Azure. To complicate things, since this was for Kubernetes cluster auth vi

I did the same years ago, but with Okta. It was just as much of a pain as it is with Azure. To complicate things, since this was for Kubernetes cluster auth via a local IdP, Keycloak was an intermediate IdP. This made passing claims and roles even more challenging than usual.