I'm actually using helix-authentication-service.
Swarm "works with it" in theory, but in practice I had to patch the loginWithSSO function to shell out to the p4 process to handle auth, because P4PHP doesn't expose ClientSSO at all and it's required for a clean login with keycloak.
EntraID is a different flow that they've probably nailed, from what I hear from other studios.
As I said in my last reply - none of that surprises me. Our provider worked out of the box, fwiw.