For the OAuth configuration follow the docs at https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/generic-oauth/
With keycloak create under "client scopes" a dedicated mapper to fill the client roles into the claim roles.