Identity should not be rebuilt in every app

Django has a strong authentication framework, but enterprise environments often need centralized identity, single sign-on, multifactor authentication, lifecycle controls, and audit trails. Keycloak provides an identity provider layer that Django can trust through OpenID Connect while retaining application-specific authorization inside Django.

Target architecture

Keycloak owns user authentication, federation, identity brokering, MFA, password policy, and token issuance. Django validates the identity assertion, maps users to local profiles or groups, and enforces application permissions. This separation keeps identity controls consistent while preserving application flexibility.

Implementation priorities

  • Use Authorization Code flow with PKCE for browser applications.
  • Keep client secrets out of templates and source control.
  • Map Keycloak roles or groups into Django permissions deliberately.
  • Define logout and session timeout behavior across systems.

The value is not simply SSO. The value is consistent identity governance across applications.