Do not blur two access models

Django applications often send email through SMTP while users authenticate through an identity provider. When introducing Keycloak, it is tempting to treat all mail-related authentication as one topic. In practice, application send authority and user mailbox access require separate controls.

Design pattern

Use Keycloak for user login and mailbox identity governance. Use dedicated service credentials or token-enabled relay rules for Django application sending. Avoid using personal user passwords for application SMTP. If the custom mail server supports external auth, connect it to Keycloak or a directory behind Keycloak.

Controls

  • Separate service sender identity from human mailbox identity.
  • Rotate service credentials and store them outside source control.
  • Restrict sender domains and envelope permissions.
  • Audit send volume and authentication failures.

Clean boundaries make mail integration safer and easier to operate.