I do not have working example for KeyCloak for now, but if it supports OIDC, it should be working with the new external authz feature.
You could also try to use the oauth2-proxy that has built-in support for general OIDC protocol (https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider#openid-connect-provider), see External Authorization with OAuth_Proxy2 GET 404 for some examples of using oauth2-proxy in Istio.