Authorization needs a contract

Keycloak roles and groups are useful, but Django applications need a clear contract for how those claims become permissions. Without a mapping layer, every token claim change becomes an application risk. With a mapping layer, identity and application authorization can evolve independently.

Mapping approach

Define which Keycloak roles are application roles, which are platform roles, and which are only identity metadata. Map accepted claims into Django groups or custom permissions during login or scheduled synchronization. Keep privileged access small and auditable.

Governance practices

  • Document claim names and allowed values.
  • Fail closed when expected claims are missing.
  • Audit admin role assignments regularly.
  • Use Django permissions for business actions, not only page access.

Good role mapping turns SSO into governed application access.