Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
What is the best practice to save user informations like firstname,lastname, address...? Directly in the Keycloak db or in the application database and the identifier from the keycloak user will also saved in the application database?
If the best practice it to save it directly in keycloak, would the application access it via REST?
The short answer is "it depends". For simple attributes, like first and last name, most IM providers offer an idea of customer attributes (Keycloak definitely has this) and storing them there makes sense. Obviously, the more you store directly on the database the more could go wrong later. Moreover, your general point of data retrieval would be the OAuth token and putting too much on that has the potential to bog down the whole system (for example, a multi-MB token would probably drag down a lot of your service calls).
There is a balance to be reached and there will always be judgment calls on what that balance is. If I were to posit a rule of thumb, it is that if all (or an overwhelming majority) of applications need the data, include it on the token. If it is more niche, then default to having a separate place for it.
Another consideration is querying patterns. If you have a lot of queries for the data outside of strict identity uses, I would place it outside the IM tool to keep from bogging down a critical path.
