I’m no expert, but Keycloak is just doing authentication (does the user have a valid account?) for you. For authorisation (is the authenticated user allowed to access the site?) you could put Pomerium in front of your apps and authorise based on user groups for different paths.

Not sure about portainer though, that might be a bug?

I think you’ve gotten false negative wrong here: False negatives are terrorists who were not identified as such.