Verify access all the time and everywhere with Heimdall

Adopt Zero Trust architecture by authenticating, enriching and authorizing incoming HTTP requests at any level. No need to learn new protocols, authentication and authorization frameworks. Just how to glue them with heimdall.

Learn about heimdall’s pipelines

Define rules reflecting your requirements

Use declarative techniques you are already familiar with

apiVersion: heimdall.dadrus.github.com/v1alpha4
kind: RuleSet
metadata:
  name: My awesome service
spec:
  rules:
    - id: my_api_rule
      match:
        routes:
          - path: /api/**
        scheme: http
        hosts:
          - type: exact
            value: 127.0.0.1:9090
      execute:
        - authenticator: keycloak
        - authorizer: opa

Create rules for each upstream and path you want to secure, respectively, which deviates from your defaults, loading them from a variety of sources such as Kubernetes custom resources, S3 buckets, any HTTPs endpoints or regular files.

Learn more about rules

The value you get

Reduce the cognitive load of your team

By outsourcing authentication and authorization decisions to heimdall you can reduce the complexity of your code base, free resources and reduce the cognitive load of your team substantially.

Secure defaults for your services

Define logic to be executed if no rule matches

Define mechanisms once, reuse many times

Use rules to compose reusable steps into the logic you need individually for your services

Add context information to requests

Dynamically enrich requests with information like e.g. user data to help you make authorization decisions and reduce dependencies in your code

Common Expression Language

Use Common Expression Language to implement complex pipeline execution logic and simple authorization within a pipeline

Authorization systems freedom

Use existing authorization systems, like OpenFGA, Ory Keto, Open Policy Agent and alike and combine them if required to get the best out of different worlds

OpenID Connect & OAuth2

Use existing authentication systems supporting OpenID Connect or OAuth2

Authentication systems freedom

Combine existing authentication systems to protect different areas of your system with different authentication systems. E.g. you can use one system to protect customer facing functionality and yet another for managing access to your backoffice specific functionality