Just use oauth2-proxy with keycloak to put SSO in front of any self-hosted app.

Works if everyone has the same permissions in the app but you might still need a shared login as well. I've done this for e.g. metabase before but it is not the same as a native oidc integration.