Synology’s DSM has built-in MFA support, though it also has some features for external identity management. I don’t think Keycloak and so on would be compatible though.