AI/ML Systems

Enterprise SSO Platform: Multi-App Identity & Access

Central identity portal with single sign-on for all platform applications. Admin console for user management, roles, permissions, audit logs. 6-layer security architecture with Cloud Armor, IAP, JWT, 2FA, and administrator tier checks.

Production identity platform serving multiple applications with centralized authentication, authorization, and admin controls. Three-in-one system: SSO portal, admin console, and application launcher hub.

Three Core Responsibilities

1. SSO Portal (Authentication):

Centralized login for all platform applications

Google OAuth and email/password authentication

Enforced 2FA (two-factor authentication)

Host-only session cookies for security

Redirect-based authentication flow for downstream apps

2. Admin Console (User Management):

User lifecycle: create, edit, disable, delete

Business role assignment and per-app permissions

Session management: view active sessions, force logout

Audit log: full trail of all identity operations

Permission catalog: define and assign app-level access

3. Tools Hub Launcher (Application Portal):

Categorized tile grid for all platform applications

Favorites, ratings, and click tracking

Lifecycle badges: LIVE, COMING_SOON, EXPERIMENT

Signed-in landing page for all users

6-Layer Security Architecture

1Cloud Armor WAF: OWASP rules, rate limiting (10/min on /login, 5/min on /verify-2fa)

2INTERNAL_LB Ingress: Cloud Run services not publicly exposed

3IAP (Identity-Aware Proxy): Google Workspace group gating for admin console

4JWT Verification: App-layer token validation

5Better-Auth Session + 2FA: Enforced multi-factor authentication

6Administrator Tier Check: Database-level role verification for admin actions

Technical Architecture

Monorepo split into two Cloud Run services:

• Portal service: public-facing SSO and launcher

• Admin service: IAP-gated admin console

Shared infrastructure:

• Cloud SQL (PostgreSQL) for user data, sessions, permissions

• Redis (Memorystore) for session caching and rate limiting

• Secret Manager for credentials (with Data Access audit logging)

• VPC with Serverless Connector (private IP only for DB/Redis)

Runtime Security Model

Per-service Service Accounts: separate runtime identities for portal and admin

Per-service Deployer SAs: least-privilege deployment (no project-wide run.admin)

Private VPC networking: Cloud SQL and Redis not internet-accessible

IAP group-based access: only workspace members can reach admin console

Audit logging: all identity operations logged to Cloud Logging

What It Demonstrates

Platform architecture: multi-app SSO, centralized identity, shared infrastructure

View all projects