Keycloak JWT Remote Auth Module

I need a custom Keycloak extension that lets Keycloak delegate user login to our existing REST API, which already issues JWT tokens. When someone enters their credentials on Keycloak, the module should call the remote endpoint, validate the response JWT, and then create / update the user session in Keycloak. The same response also carries role and permission data, and those must be mapped one-to-one to Keycloak roles so that realm-level and client-level access control continues to work exactly as it does today inside our product.

Here is what I expect to receive:

• Production-ready source code for the Keycloak SPI implementation (Java, Maven project, Dockerfile) that performs the remote call, parses the JWT, handles error states, and translates roles.
• A concise README explaining configuration parameters, required Keycloak version, and step-by-step deployment instructions (JAR placement, realm configuration, role synchronisation hints).
• Short hand-off call or recorded walkthrough once everything compiles and runs in my staging environment.