[keycloak-user] Best Practices and Recommendations

Greetings! I am involved in a client engagement event upcoming on-site performing a Best Practices analysis of their environment for Red Hat SSO which Keycloak is a component of. I have been in the process of reviewing all available information related to Keycloak as well as setting up my own instances to get a better feel for the platform. However, one area I am having little success in is finding a collection of best practices and recommendations for deploying and securing Keycloak. I am also having difficulty finding best practices and recommendations for SAML SSO that would relate to Keycloak. Does such material exist or is this an instance where we will have to take the current literature as it exists and adapt it to meet our client's needs? I'd rather not re-invent the wheel and instead draw from the wisdom of the crowd for this effort. Thanks in advance! V/R - Hugh