Open source
Hexalgon IAM
Identity and authorization for multi-tenant software.
A self-built, open-source identity and access-management system. The screenshot shows its product page, while the engineering work centers on secure tenant boundaries and efficient authorization.
An open-source identity platform
The implementation brings tenant isolation, permission checks and token revocation together in a reusable identity and access-management system. The linked source code provides the implementation evidence.
My contribution
- Implemented PostgreSQL Row-Level Security to isolate data between organizations.
- Designed fine-grained authorization with JWT-embedded permission policies for constant-time local checks.
- Built Redis Streams-backed token revocation with Bloom-filter acceleration, configured for 10 million entries and a target false-positive rate of 0.0001.
- Used Redis Pub/Sub for live cross-worker propagation and Stream replay to restore revocation state after restarts.
The problem and decisions
I enforced tenant isolation at the database layer and used embedded permission claims for efficient local authorization. For token revocation, Bloom-filter checks keep the common path lightweight, while Redis Streams and Pub/Sub handle recovery and propagation across workers.