Adoption should be staged

Replacing application-local authentication with Keycloak is valuable, but doing everything at once can create risk. A staged roadmap helps teams validate assumptions, reduce user disruption, and build operational confidence.

Suggested roadmap

Start with a non-critical Django application and implement OpenID Connect login. Add role mapping and group governance. Protect Django admin with stricter Keycloak policies. Integrate the custom email server authentication path only after user identity and lifecycle rules are stable. Finally, harden monitoring, backup, rotation, and audit.

Success measures

  • Users authenticate through Keycloak with predictable sessions.
  • Access removal works through identity lifecycle controls.
  • Django permissions map cleanly from approved roles.
  • Email authentication follows the same identity governance model.

The goal is not to install Keycloak. The goal is to simplify identity operations across the estate.