Heimdall — Authentication and Access Control System

What it is

Heimdall is the company's in-house authentication and access control system, integrated with Asgard (the client-facing dashboard): Asgard sends authentication and authorization requests to Heimdall, which validates and responds to them. It already existed when I joined the project; my role was ongoing maintenance and improvement.

My role

• Maintained and evolved the authentication flow, including two-factor verification (2FA) via email.
• Worked with JWT tokens for authentication and session control.
• Maintained the "forgot password" recovery flow.
• Managed access permissions to specific areas of the system, tied to each client's contracted plan — blocking access to features outside the contract's scope.
• Implemented multi-tenant isolation: each client company only has access to its own dashboard, with no possibility of accessing data or areas belonging to other companies on the platform.
• Supported the administrator account, with privileged access across all clients' dashboards on the platform.
• Persisted user data in a SQLite database.
• Routed requests between Asgard and Heimdall through Nginx.

Tech Stack

• Python
• JWT
• Two-factor authentication (email)
• Password recovery
• SQLite
• Nginx
• Multi-tenant access control with an administrator role

Technical Highlights

• Use of JWT tokens for authentication and session control
• Two-factor authentication via email
• Password recovery flow
• Permission model tied to contracted plans, enabling granular access control by feature/area
• Multi-tenant isolation ensuring one company can never access another's data or screens
• Administrator role with a consolidated view across all clients, alongside the standard isolation between companies
• User persistence in SQLite
• Nginx as the routing layer between Asgard (frontend) and Heimdall (authentication service)
• Direct integration with Asgard as the authentication and authorization layer