04 / 2025 · arias tech solutions
Auth across every platform we shipped
Set up once, properly, so nobody on the team had to write another login screen.
the brief
Five products, several client organisations, different roles per organisation, and a request for single sign-on. Auth had been growing per-project, which meant five subtly different definitions of 'admin'.
what I did
Keycloak as the single source of identity and roles, one shared NestJS guard package that verifies tokens and checks roles, and realm configuration in version control so a new environment is reproducible. Front ends got one Angular interceptor and stopped caring.
what broke
We briefly mirrored roles into our own tables 'for convenience'. Within a month the two sources disagreed and someone saw a screen they shouldn't have. We deleted our copy the same week.
what I'd change
Nothing about the architecture — but I'd write the 'how to add a new role' page on day one. The system was fine; onboarding people onto it was the slow part.