Audit trails need correlation

Centralizing identity through Keycloak improves control, but only if audit records can answer practical questions: who logged in, which application accepted the login, what permissions were granted, whether mail access was attempted, and which administrator changed access. Logs that cannot be correlated are expensive during investigations.

Audit model

Use stable user identifiers across Keycloak, Django, and email systems. Capture authentication events, token errors, role changes, Django permission changes, mailbox authentication outcomes, and service account activity. Protect logs from tampering and define retention based on risk and regulation.

Operating benefits

  • Faster incident investigation.
  • Cleaner access reviews.
  • Evidence for compliance and customer assurance.
  • Better detection of misconfiguration and abuse.

Good audit design makes identity governance visible after the fact.