I was just going through this procedure and just couldn't make it work. After discussion with developer (link to the message thread in slack) we've come to conclusion this procedure contains one wrong info and is missing one important info:

• 
  In this section, the ++ shouldn't be there as well as the .../oauth/oauth/... should be just ../oauth/...
• Another thing that needs to be ensured, when creating custom OIDC provider in RH-SSO (keycloak in upstream) is to enable "store tokens" and "store tokens readable"