The Challenge
Every Baalvion property had grown its own authentication: different login screens, different role models, and inconsistent token schemes — some using shared-secret signing that any service could forge. There was no single way to reason about who could access what, and tenant boundaries were enforced inconsistently across services.
The Solution
We built one canonical identity service for the entire group. It issues RS256-signed access tokens — services verify them with a public key and can never mint their own. A unified organisation-and-role model defines access centrally, and every tenant's data is isolated at the database layer with row-level security. This is the multi-tenancy discipline we describe in building multi-tenant SaaS.
- One login across every property.
- RS256 tokens so services verify without holding signing secrets.
- Central RBAC with an organisation and role model.
- Row-level security enforcing tenant isolation at the data layer.
Architecture
A central auth service authenticates users and issues asymmetric-signed tokens carrying organisation and role claims. The API gateway validates tokens and forwards a tenant context that every downstream service uses to scope queries. At the database, row-level security policies fail closed — a query without the correct tenant context returns nothing. We verified isolation with adversarial cross-tenant probes, a practice covered in secure software development.
Technology Stack
RS256 JWTs, a role-based access model, row-level security for tenancy, an API gateway, and a shared organisation model — delivered through our enterprise software and technology consulting practices.
Results
Many login systems collapsed into one. The token scheme is now RS256-only, eliminating forgeable shared secrets. And adversarial testing confirmed zero cross-tenant data leakage across the platform.
Lessons Learned
Asymmetric signing was the key decision — services verify tokens without ever being able to forge them. Centralising authorization stopped each app reinventing access control inconsistently. And isolation is only real once you've tried to break it: adversarial cross-tenant tests turned an assumption into a guarantee.