Claims become risk when they become permissions

Keycloak tokens can include subject, email, groups, roles, realm access, client access, names, and custom attributes. Django should not consume claims casually. Once a claim controls access, it becomes part of the authorization model and must be validated as a contract.

Trust model

Always validate issuer, audience, signature, expiry, and token type. Then map only approved claims into the application. Use stable identifiers like subject for identity linkage. Treat email as useful but changeable. Avoid using display names or informal attributes for authorization.

Operational checklist

  • Document required claims and fallback behavior.
  • Reject tokens missing mandatory claims.
  • Keep role mapping tests in the application suite.
  • Review custom claims before adding them to access logic.

The application should be precise about what it trusts and why.