Initial Keycloak work

* as stated in (updated) README: requires a pre-configured KEYCLOAK
* as discussed on IRC: merging now; continue a closer/better integration on a new branch

Done for https://issues.jboss.org/browse/AGPUSH-569