Keycloack with successfactors

Hello,

We have to allow SSO between successfactors and AD azure onpremise, but we want to use keycloack as initial screen to the sso. The scenario would be: successfactors-keycloack-azure. Is It possible? If It was ok, would the configuration be with BTP (SCP) and SCC or with SAP IAS?

Thanks