Also have huge extensive experience with keycloak and highly recommend it. It’s best when used as a custom docker container (so you can add your certs) but I’ve used it to build enterprise-wide auth, department level permissions and authorization, product level auth, and even SSO to AWS console.