What is the best practice to save user informations like firstname,lastname, address...? Directly in the Keycloak db or in the application database and the identifier from the keycloak user will also saved in the application database?

If the best practice it to save it directly in keycloak, would the application access it via REST?

1 Answer 1


The short answer is "it depends". For simple attributes, like first and last name, most IM providers offer an idea of customer attributes (Keycloak definitely has this) and storing them there makes sense. Obviously, the more you store directly on the database the more could go wrong later. Moreover, your general point of data retrieval would be the OAuth token and putting too much on that has the potential to bog down the whole system (for example, a multi-MB token would probably drag down a lot of your service calls).

There is a balance to be reached and there will always be judgment calls on what that balance is. If I were to posit a rule of thumb, it is that if all (or an overwhelming majority) of applications need the data, include it on the token. If it is more niche, then default to having a separate place for it.

Another consideration is querying patterns. If you have a lot of queries for the data outside of strict identity uses, I would place it outside the IM tool to keep from bogging down a critical path.

  • let's asume i dont't want to save informations redundant (seems like an anti pattern to me). What if the spring boot application or other users need informations about userXYZ, I can't access these because I don't saved it in my app db, would there be a REST call better or should i save the informations redundant?
    – djkobi97
    Aug 12, 2020 at 17:49
  • Most IM providers have an extension mechanism you can use. For example, you can write an SPI (keycloak.org/docs/latest/server_development/…) in Keycloak that will add claims to a token. Because this is just Java code, you could have it call your own REST service to build the token. Here is an example that is similar on StackOverflow: stackoverflow.com/questions/53089776/…
    – Michael
    Aug 12, 2020 at 20:08
  • Isn't simpler to use a Keycloak Admin REST Client: keycloak.org/docs-api/7.0/javadocs/org/keycloak/admin/client/…
    – djkobi97
    Aug 12, 2020 at 22:49
  • Depends on what you're trying to do, really. If you want to access Keycloak's data, then the REST APIs will expose that. If you're wanting Keycloak to instead access some other data source, you'll need to write an implementation of an SPI.
    – Michael
    Aug 13, 2020 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.