You’re looking for an OAuth-compatible identity provider (personally I use Kanidm, if Keycloak does that too that works, I’ve never used it). And then set it up as the auth mechanism for Immich, and whatever else you want: immich.app/docs/administration/oauth