I don't know what special things we need for keycloak. The current implementation of KC (beta4) and of AG (1.4.0) can be configured to work correctly.