A structured authentication and authorisation platform designed for enterprise applications and future multi-channel access.
Identity is usually bolted onto an application late, then becomes the hardest thing to change. This platform treats it as its own product from the start.
Different consumers need different things from identity — a browser wants a session, a mobile client wants a token, an internal service wants a scoped credential. One implementation had to serve all three without special cases leaking everywhere.
I designed the module structure, the domain model and the security workflows, and implemented the platform end to end.
Each layer, and the reasoning that shaped it.
Spring Modulith enforces the boundary between identity and everything else at build time. Other modules depend on a small published interface; the internals — credential storage, session handling, factor verification — are not reachable from outside.
No user interface of its own. The platform exposes documented endpoints and a reference flow, so each consuming application can present login in its own visual language.
Java with Spring Security. Login is a state machine: identify, verify, elevate, establish. Each transition is explicit, which is what makes adding a second factor a new state rather than a new branch inside an existing method.
PostgreSQL for accounts, roles and audit records. Credentials are stored with a modern password hash and never logged, and audit rows are append-only.
Redis for session storage so application instances hold no state. Deployment mirrors the platform it serves, which keeps environments consistent.
Server-held sessions with immediate revocation and no sensitive claims on the client.
Permissions are checked at the service boundary, not scattered through controllers.
The login flow is modelled as steps, so a second factor slots in without a rewrite.
Identity is a self-contained module with a published interface for the rest of the platform.
Every credential and permission change emits a structured event with actor and reason.
Redis-backed sessions so instances stay stateless and can be replaced freely.
Placeholder frames — swap for real captures once they exist.
Every architecture is a set of choices. These are the ones that mattered most, and why they went the way they did.
Treating sign-in as one method means every new requirement becomes another conditional. Modelling it as states made multi-factor readiness a matter of inserting a step, and made the flow explainable to non-engineers on a whiteboard.
Permission checks placed in controllers get missed. Enforcing them where a module's interface is called means a new caller cannot forget the check, because there is nowhere else to enter.
Security history that can be edited is not history. Audit rows are written once and never updated, which keeps the trail useful during an investigation.
Want the detail behind any of these decisions?
Start a conversation