Development of a modular and reusable authorization plugin for the central orchestration and validation of user permissions within a distributed service landscape. Implementation is based on the role-based access control (RBAC) pattern.
Supplement
The service is operated within a dedicated, customer-owned cloud infrastructure. Integration into the communication flow is achieved via a central API gateway, which acts as a policy enforcement point (PEP). This ensures secure encapsulation of internal resources and guarantees that all incoming requests are checked against the authorization logic in a standardized manner before they reach the target services.
Subject description
As part of the project, a highly decoupled authorization plugin was designed and implemented that can be integrated as a universal component into a wide variety of microservices. The primary goal is to centralize access control logic in order to avoid inconsistent distribution of authorization checks (logic sprawl). The plugin performs a fine-grained check to determine whether a user has the necessary privileges to access specific resources or functionalities of a service. The generic approach ensures uniform governance across multiple domains, which significantly reduces maintenance effort and increases security compliance. The implementation was carried out using Kotlin and the Ktor framework. This choice enables lightweight, high-performance, and asynchronous processing of requests. Thanks to its flexible architecture, the plugin can be seamlessly embedded into existing service structures.