Yup, Keycloak. It's certainly a batteries included solution but my experience so far has been quite positive. Apps deployed have been for small provincial govt ones with individual app user bases varying from 1 or 2 users to 30k (size of the provincial public service). Keycloak does the OAuth2/OIDC work using the govs active directory for the identity provider. Keeping my eye on Ory as a perhaps more ala carte solution. edit: added Ory comment