[keycloak-user] Help on how to best set up Keycloak authorisation for SaaS