- python-keycloak based service with initiate_login/handle_callback
- Supports multi-site via state param for organization_id
- Frontend callback flow (no backend redirect exposed to user)
- prompt=login forces re-authentication for account switching
- Uses org keycloak_default_role for new user role assignment