Aside from ordinary file sharing I have two applications on my DS: gitea (git server) and nextcloud (and mariadb with phpadmin to support both - I use nextcloud as it provides a way more better CardDav and CalDav service than Synology does). All of those applications (aside from phadmin) have their own users and credentials. which i do not like.

gitea supports OpenID Connect, which again is supported by Keycloak, is that supported by the Synology DS OAuth service? Probably not.

With NextCloud as OAuth2/OpenID Client it seems even more complicated. The community version is able to act as an OAuth server but I did not find anything to make Nextcloud using an OAuth or OpenID-Service aside from some promising documentation for Nextcloud Enterprise.

DSM itself s well seems a not be able to use an OAuth Service for access control. Or does it? As only then may keycloak be an option.

Is there a way to connect the Synology DSM user idm to keycloak? DSM supports an LDAP server as an IDM service, which may be shared with Keycloak. Did you look into that?

Did you look whether Synology OAuth provides the service inquiry endpoint?