The idea is to move the SPIs outside of Keycloak so as not to have to touch the core of Keycloak (this will also make it more reliable and robust).

All this by implementing a list of SPI types that can be instantiated via remote configuration (GRPC or REST, basically URL, user/password, or MTLS). A bit like Envoy's XDS.

This makes plugin management more dynamic and its operation more robust.

Plus, plugins can be multilingual...

With GRPC, we can stream exchanges (more efficient).

Ideally, the SPI loading would be dynamic.

https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol