Keycloak has support for spengo/kerberos, but at first glance it's only for browser/http challenge flows. It seems like using it in a direct flow is not possible out of the box: https://issues.jboss.org/browse/KEYCLOAK-1751

Note that even if just kerberos password authentication were supported that would allow for secure logins without ssl, which can be useful for our pg transport.