I recently developed a Zero Trust gateway that integrates with existing web applications using Envoy, Keycloak, OPA, and a custom Java SPI that connects directly to the client's existing MySQL database, eliminating the need for migration and code changes in the protected apps. I'm curious about the additional value this setup brings to clients who already have their own login pages and user databases. Beyond just blocking unauthenticated requests, is centralized audit logging and policy enforcement on every request sufficient to justify this solution, or am I overlooking a broader use case?
1 Answer
To really showcase the benefits, having an architecture diagram and a detailed requirements document could help a lot. This way, you can align your solution with what the customers actually need, industry standards, and so on.
Could you elaborate on what elements should be included in that documentation?