On: Vendors that treat single sign-on as a luxury feature

[rawfan]

Just use oauth2-proxy with keycloak to put SSO in front of any self-hosted app.

[NewJazz → rawfan]

Works if everyone has the same permissions in the app but you might still need a shared login as well. I've done this for e.g. metabase before but it is not the same as a native oidc integration.