Keycloak was the correct answer. I picked Auth0 anyway.
OAuth in front of a self-hosted MCP gateway for Claude.ai, with the fewest moving parts I could get away with. The IdP shortlist, the three defaults that broke, and the conditions under which I'd reverse the call.
Read post