Realm design is an operating decision

Keycloak realms isolate users, clients, roles, policies, and identity providers. For Django applications, the wrong realm design can create duplicated users, inconsistent role naming, difficult admin delegation, and confusing token claims. The right design reflects organizational ownership and security boundaries.

Design guidance

Use a shared realm when applications serve the same user population and governance model. Use separate realms when regulatory, tenant, lifecycle, or administrative boundaries require isolation. Keep client definitions explicit and avoid using one generic client for unrelated applications.

Controls

  • Define realm ownership and backup policy.
  • Standardize role and group naming.
  • Limit admin permissions through delegated roles.
  • Document token claim contracts consumed by Django.

Identity architecture should make access predictable for users and operators.