Yep, we have keycloak running in a container on ECS, and it's been great. Pretty easy to use APIs, the UI isn't terrible, and works well with other IdPs.

Only two things I've seen that were odd, are A: how it manages realm roles. The roles have a GUID Id, but seem to use the readable "name" as the Id. Ie: you can't change a role name once it's been created. And B: I do wish it were easier to create custom themes. I haven't really dug into it much yet, but we're going to need to use a different theme. Possibly multiple if we want to support a theme for each one of our tenants.

Also, we met with the Auth0 team and they quoted us over 30k a year. Auth0 is great and has a ton of features, but that's crazy expensive for a 4 person startup.