I have an Angular PWA that enables users to login to Keycloak using Authorization Code Flow with PKCE. It works with Keycloak (native) users and with Federated users.
As per the Keycloak docs: “The built-in LDAP and ActiveDirectory support is an implementation of this (User Storage) SPI in action.”
See: