I ditched Keycloak for a single-container SSO, and the integration headaches explained everything
I stopped avoiding SSO. I started reading the fine print.
We haven't written up this one. XDA Developers has the full story — the link below goes straight to it.