@evan ok, i'm now able to forward your request to keycloak and the login dialog is shown. but after login ap says:
127.0.0.1 - - [...] "GET /callback?state=xxxxx&session_state=xxxxxxx HTTP/1.1" 200 -
...
File "/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/parameters.py", line 451, in validate_token_parameters
raise MissingTokenError(description="Missing access token parameter.")
oauthlib.oauth2.rfc6749.errors.MissingTokenError: (missing_token) Missing access token parameter.