[keycloak-user] SaaS idp brokering

Hi, This question is slightly off-topic, I hope it's allowed to ask here. We are using keycloak as an IdP, loving it. One of our sister institutes is using another (openid connect / saml2 compatible) IdP. Now a new project: Trying to achieve web SSO across both institutes, for several web applications, mostly supporting only one single IdP. We have made a PoC using keycloak's brokering function, and it worked nicely. However, our sister institute prefers a SaaS solution. I've done my googling, but terminology is confusingly different: - onelogin ("trusted IdP") - okta ("inbound federation") - gluu ("inbound identity") and obviously - keycloak ("IdP brokering") (but not saas) and I am not even sure that the above solution are really the same as keycloak's IdP brokering, and that they would solve our SSO requirement. (doing a PoC would be the next step) So I am asking for recommendations from the guru's here. What are the do's and don't for something like this? Perhaps suggestions what to look for, what to avoid, what other products to take a look at, etc, etc. Insights? Thanks very much in advance, and again: apologies for being a bit off-topic, hope not to offend anyone. MJ