Keycloak will work just fine and can be somewhat quick to setup - it will link with LDAP, can be even made to provide password change option with write access, can import groups, attributes (including custom ones), etc.

It will also provide you with SAML and OIDC web authentication, and can support WebAuthN, U2F, certificate auth, and so on for your apps, as well as integrate Google Authenticator compatible MFA (out of the box) or link with privacyIdea for more complex authentication setup. It can even link kerberos with HTTP, if you need it :)

Pretty much everything that supports custom OIDC (or SAML) will work with Keycloak out of the box.