Keycloak is pretty good in the average case, but when you get to esoteric use-cases like multi-thousand group/role setups it breaks down, performance-wise. Stuff like that isn’t common practice though.