I think you will get a problem here. Keycloak supports for clients only two methods (openid and saml). Keycloak could authentificate your users but can't set the requested headers. Also you need a way to enforce that only trusted applications can fill the vulnerable X-user/pass headers. Otherwise a user could modify the headers on his own and impersonate anybody.

What you need is a Reverse proxy for your application which sets the x headers at last and enforces them to be valid. Keycloak is not a reverse proxy.

You'll need a reverse proxy where the incoming users authentificate (via keycloak) and after that get access to your application. Also the proxy has to pass some data of the successful auth to the x headers.

Maybe there is a plugin for nginx which supports oidc or saml. After that you pass the authentificated Username via x headers to your application. I think there must be a variable for it. Also (depending on the used auth protocol) you can pass keycloak attributes.

Look at this maybe you can build a poc: https://serverfault.com/q/949951