You (the user) log in to say https://stackoverflow.com/ (the client) the backend of Stack Overflow then communicates with Keycloak. Keycloak itself would then check an external or internal DB: