[tomjen3]

I mean ditch SAML. We use Keycloak as a SAML to OpenId translator, essentially, so if we could get JWT tokens from our IdPs directly, we wouldn't need Keycloak.