2FA with SSO (keycloak) login?

We have Discourse deployed and connected to keycloak for SSO sign-in but can I activate Two-Factor Authentication? I appear to be able to navigate to the option via my Account → Preferences but it prompts me for a password - which fails. As it’s externally authenticated how do I (can I) use 2FA?

If you are using SSO, then authentication has been delegated outside Discourse – the 2FA would need to happen upstream of Discourse.