I am successfully using Custom Authentication on Sync Gateway 1.5 with a Keycloak identity server.
Using curl I verified that the SG session cookies grant access to Sync Gateway on the 4984 REST interface.
When I use the same session cookie in a Couchbase Lite replication, the Sync Gateway rejects the replication with this log:
2017-12-06T18:10:28.047+01:00 OIDC+: OIDCUsername: XXXXX_46f7b166-9050-4540-b3b3-b1a3a7030ca8
2017-12-06T18:10:28.048+01:00 HTTP: #215: POST /XXX-integration-test/_session (as XXXXX_46f7b166-9050-4540-b3b3-b1a3a7030ca8)
2017-12-06T18:10:28.048+01:00 WARNING: Couldn’t parse JSON in HTTP request: EOF – db.ReadJSONFromMIME() at attachment.go:224
2017-12-06T18:10:28.049+01:00 HTTP+: #215: --> 200 (2.2 ms)
2017-12-06T18:10:28.469+01:00 HTTP: #216: GET /XXX-integration-test/_blipsync
2017-12-06T18:10:28.469+01:00 HTTP: #216: --> 401 Login required (0.7 ms)