Backend Engineering Case Study

Go RBAC API — Reusable Authorization Service

A production-oriented RBAC and authorization service built with Go, PostgreSQL, REST, gRPC, service-to-service authentication, local sessions, audit logging, OpenAPI docs, and a reusable Go client SDK.

View on GitHubBack to Projects

01 / Overview

Centralized authorization for backend systems

Go RBAC API is a reusable authorization service designed for backend and microservice systems. Instead of implementing role and permission checks inside every service, external services can delegate authorization decisions to a centralized RBAC service through REST or gRPC.

The project includes role and permission management, user-role and role-permission assignment, service-to-service authentication, local session support, external identity sync, audit logging, Swagger/OpenAPI documentation, Postman tests, smoke tests, and an example billing microservice.

02 / Problem

Authorization becomes fragmented quickly

Authorization logic can become difficult to maintain when every backend service implements its own role checks, permission naming, audit behavior, and access rules.

Identity providers such as Keycloak are powerful, but complex RBAC customization can be difficult to configure and operate across multiple services.

The core authorization question

Can this user perform this action on this resource?

03 / Solution

One service for consistent access decisions

I built a centralized RBAC service in Go that exposes both REST and gRPC APIs. External services authenticate themselves using service credentials, then call the RBAC service to sync identities, introspect local sessions, and authorize user actions.

The service can work with local users or integrate with external identity providers like Keycloak by storing external provider subjects and syncing user identities.

04 / Key Features

REST API
gRPC API
PostgreSQL persistence
Service-to-service authentication
Local session login, refresh, and logout
External identity sync
Role and permission management
User-role assignment
Role-permission assignment
Authorization decision API
Audit logging
OpenAPI / Swagger documentation
Postman collection
Smoke test script
Reusable Go client SDK
Example billing service integration

05 / Architecture

Client / Frontend

User interaction

Billing Service

Business logic

RBAC Service

Authorization decisions

PostgreSQL

Roles, policies & audit data

External services do not access the RBAC database directly. They communicate with the RBAC service through its REST or gRPC APIs, either directly or through the reusable Go client SDK.

06 / Security Decisions

Explicit boundaries and fail-closed behavior

Service keys are hashed in the database.

Plain service keys are returned only once.

Passwords are hashed.

Sessions are opaque and hashed.

The billing service fails closed.

Missing authentication returns 401.

Permission denied returns 403.

RBAC unavailable returns 503.

Service keys are never exposed to frontend clients.

08 / Result

A reusable foundation for authorization

The final result is a reusable authorization foundation that can be integrated into multiple backend services. A service only needs to ask the RBAC API whether a user is allowed to perform an action, instead of duplicating authorization logic internally.

GitHubBack to Projects