Heimdall

A cloud native Identity Aware Proxy and Access Control Decision service.

Heimdall is a general-purpose Policy Enforcement Point (PEP) for HTTP services, designed for Zero Trust architectures as described in NIST SP 800-207. It combines authentication and authorization in a configurable pipeline, keeps access control close to the protected resource, and can provide services with trusted context derived from the authenticated subject and authorization process — without coupling them to concrete authentication protocols, identity providers, or authorization systems.

Heimdall can either:

• expose its access control decisions to an existing proxy, ingress controller, API gateway, or service mesh; or
• enforce them directly by proxying requests to the protected service, commonly as a sidecar or in front of a small group of services.

How it works

Incoming requests are matched against declarative rules and processed by a configurable pipeline. A successful processing path typically looks like this:

flowchart LR
    Request[Request] --> Match[Rule matching]
    Match --> AuthN[Authentication]
    AuthN --> Context[Contextualization]
    Context --> AuthZ[Authorization]
    AuthZ --> Final[Finalization]
    Final --> Service[Protected Service]

Loading

Reusable mechanisms implement the individual steps.

This allows Heimdall to:

• authenticate requests using different identity providers and protocols;
• enrich authenticated subjects with additional context;
• authorize requests locally or through external authorization systems;
• provide protected services with trusted context generated by finalizers;
• let each protected service define its own access requirements through service-specific rules;
• establish secure defaults that service-specific rules inherit and that apply when no specific rule matches.

Learn more about pipelines, rules, and mechanisms.

Deployment

Heimdall is built for cloud-native environments, supporting both standalone and Kubernetes-native deployments, with declarative configuration, dynamic policy updates, and built-in observability.

Integrate with your existing proxy or gateway

Heimdall's Access Control Decision service is designed to integrate with existing proxies, ingress controllers, API gateways, and service meshes.

The surrounding infrastructure handles traffic management and routing, while Heimdall evaluates the applicable policy enforcement pipeline and returns the decision together with trusted context for the protected service.

sequenceDiagram
    participant C as Client
    participant P as Proxy / Gateway
    participant H as Heimdall
    participant S as Protected Service

    C->>P: Request
    P->>H: Authorization request

    alt allowed
        H-->>P: Allow + trusted context
        P->>S: Request + trusted context
    else denied
        H-->>P: Deny
        P-->>C: Reject request
    end

Loading

Integration guides and examples are available for Caddy, Contour, Emissary Ingress, Envoy, Envoy Gateway, HAProxy, Istio, KGateway, NGINX, and Traefik.

See all proxy and gateway integration guides and examples.

Run Heimdall as a proxy

Heimdall can alternatively proxy the final hop to the protected service:

flowchart LR
    Client[Client] --> Proxy[Proxy / Gateway]
    Proxy --> Heimdall[Heimdall]
    Heimdall --> Service[Protected Service]

Loading

This is particularly useful for sidecar deployments or when one Heimdall instance protects a small group of services.

See Operating Modes for details.

Design principles

Heimdall is developed with four main goals:

• Security — preserve explicit trust boundaries and fail-closed behavior.
• Performance — minimize work and allocations on request-processing paths.
• Clear abstractions — keep authentication, authorization, contextualization, and finalization independent and replaceable.
• Simplicity — prefer straightforward solutions over unnecessary frameworks and abstractions.

Getting started

New to Heimdall?

1. Discover Heimdall
2. Protect an Application
3. Install Heimdall
4. Explore the Guides

The documentation contains the authoritative reference for configuration, mechanisms, rules, APIs, operations, and integrations.

Project status

Heimdall is production-ready, actively developed, and used in production.

Check the releases and upgrade and migration documentation when upgrading.

If you ...

• ... like the project — please give it a ⭐
• ... miss something or found a bug, file a ticket. You are also very welcome to contribute 😉
• ... would like to financially support the development and maintenance of Heimdall, consider becoming a sponsor via GitHub Sponsors or Open Collective
• ... would like to support the project in another way, reach out to me via Discord
• ... need help, head over to Discord as well

License

Heimdall is licensed under the Apache License 2.0.