[keycloak-dev] Keycloak+dogtag or Keycloak+freeIPA

Hi to all, still doing some decision making...could anyone know to recommend me if for example KeyCloak (as identity and acces managment solution)+DogTag (as a PKI infrastructure) be great solution also to cover or integrate with enterprise scenarios, where possible AD is behind RADIUS server, or is it better to go with combination of Keycloak and FreeIPA (IdM)? Is Keycloak real IdM, does it have it's own LDAP base or is it dependent on external users/roles database and has just a simple internal database/storage to safe user/passs? Thank you in advance, Gorazd