I’d argue that Keycloak is also Auth as a Service. Even if you may be hosting that service yourself.

If you only have a single web application (yes, that still exists) you don't need any of this. Use your backend framework's "native" auth package and you're good to go.