This project focused on designing and implementing a modern Identity and Access Management architecture that enforces centralized authentication, consistent policy enforcement, and controlled authorization across web applications. The environment was built around a reverse proxy driven access model, where all inbound traffic is evaluated before reaching application logic.
The solution integrates NGINX, oauth2 proxy, Redis, Keycloak, and a Flask backend to demonstrate how authentication, session management, authorization, and privilege governance can be cleanly separated while remaining tightly coordinated. In addition to the access flow, the project introduced an automated privilege access review mechanism to address long lived elevated permissions within the identity platform.
Modern applications often fail not because authentication is absent, but because it is implemented inconsistently across services. Common issues include direct access to backend services, duplicated authentication logic in applications, weak session handling, and privileged roles persisting long after they are needed.
The challenge was to design an architecture that enforces authentication before application access, centralizes identity decisions, supports single sign on and multi factor authentication, and introduces governance controls to reduce privilege sprawl. The system needed to ensure that backend applications remain focused on business logic while identity enforcement and session security are handled upstream.
The solution adopted a gateway first identity enforcement model. NGINX was positioned as the single entry point, responsible for routing, rate limiting, and blocking unauthenticated traffic before it reaches any application. Authentication was delegated to oauth2 proxy, which abstracts OAuth and OpenID Connect complexity away from backend services and maintains secure user sessions.
Keycloak was used as the centralized identity provider, issuing tokens, enforcing authentication policies, and supporting enterprise grade capabilities such as MFA and SSO. Redis was introduced as a shared session store to ensure oauth2 proxy sessions remain consistent, resilient, and scalable across restarts or multiple instances.
The Flask application was intentionally kept lean. It relied on trusted identity headers and token claims for authorization decisions, ensuring that authentication logic was not duplicated at the application layer.
To address identity governance, a custom privilege access review script was developed. The script evaluates users with elevated roles within a Keycloak realm, checks their last activity timestamp, and removes privileged access when inactivity exceeds a defined threshold. This introduced a practical control for reducing standing privileges and enforcing least privilege over time.