SSO Refresh
Keycloak vs Authentik
I wrote a custom LDAP server that returns the current set of users from Azure AD B2C. This works for both Authentik and Keycloak to ingest the current user base (minus passwords).
In Authentik we can run the import once, then disable user syncing and retain the users in the database. On first login Authentik does a bind towards the LDAP server to verify the password, then writes the password back to the local user, thus completing their migration.