Discourse uses its own SSO protocol. If there is no Keycloak plugin that supports this yet and you don’t want to build one, you’ll have to use another authentication scheme. I’d suspect then OAuth is easiest because there already is a Discourse plugin for it 