Authenticating WFS from GeoServer with Keycloak in QGIS

I managed to get it working with these settings:

Under Settings --> Authentication create a new authentication configuration of type OAuth2 authentication, then enter:

• Token URL: enter keycloak's token endpoint. You can get this URL by clicking on the OpenID Endpoint Configuration link in your keycloak's realm settings and searching for token_endpoint.
• Client ID: name of your client.
• Client secret: you can get it on the client configuration's Credentials tab.
• Username and Password
• Scope: openid

There is also an alternative method - enable basic authentication. For me, all I had to do was to set Browser Flow to http challenge in the client configuration's Settings tab:

According to this thread, your must also configure Access Type: confidential and Direct Access Grants: Enabled on your client for this to work.

With this configuration even GeoServer is now asking for creadentials using basic authentication instead of redirecting to KeyCloak's login page, which I find more user-friendly.