1 - Do I need to use a Keycloak client library that will check if its logged in, this in all my microservices?
For example, the Spring Keycloak library, or the Keycloak-js library for Node?
That is, my microservices will know my IAM, which in this case is Keycloak, and in addition, they will use a library to manage this.
2 - Or is it possible to protect Kong routes that point to microservices and report to redirect to the Keycloak route if the call is not yet authenticated?
That is, my microservices will know nothing about the authentication process.