I've implemented a Protocol Mapper in Keycloak that successfully uses the IDP to perform a login against a registry/docker client.  Is this something that the team is interested in building into the product?  If so, I'd be happy to push back upstream.