Federation is about ownership

Keycloak can store users locally, federate from LDAP or Active Directory, or broker external identity providers. For Django applications, the choice should reflect who owns identity lifecycle and how access should be removed when a user changes role or leaves.

Decision factors

Use federation when an enterprise directory already owns workforce identity. Use brokering when partners or customers authenticate through their own providers. Use local users only when there is a clear lifecycle process and no enterprise source of truth. Django should not need to know the source; it should receive reliable claims.

Governance outputs

  • Identity source of truth documented.
  • Claim contract agreed for Django apps.
  • Role and group synchronization defined.
  • Deprovisioning path tested.

Federation should reduce account sprawl rather than hide it behind SSO.