[keycloak-user] Is keycloak the tool I'm looking for? selective AD user sync

Hello guys, I'm really new to keycloak and I need your help to understand if this is what I'm really looking for; I am the IT administrator in a non-profit environment, managing servers and services for several non-profit organization. What I'm trying to achive is the centralization of the authentication and authorization process: every user should just have one password and one "username". The difficult part is that the environment I work in is really "fluid": there are a lot of person working or volunteering in one or more different organization. Every organization has its own active directory server (to manage desktop authentication and some CIFS share), its own gsuite (for emails) and at the same time, there are services shared by all (or some) of these organization (like a redmine ticketing system, nextcloud file server and so on). What I'm dreaming of is to manage everything from a single software (I tried gluu but it had some annual fees we cannot afford to pay): I would like to create an user (something like name.surname) and add to this user "permissions", something like "user1 should be able to access gsuite 1, gsuite2, nextcloud and active directory 1". I've uploaded a scheme in this pdf: https://mega.nz/#!z4InTCaa!ngyWks8yoN7rrW-NR6RXnPJ32tCKSz0snWB1c7lFEbg Do you think keycloak is capable of this? I played around a bit, read a lot of documentation and what I wasn't able to achive was a selective active directory user sync... Maybe my error was trying to do everything in the same realm, what do you think about it? Thank you for any hint Francesco