Skip to content

Organize rule steps in a DAG structure #2679

Description

@dadrus

Preflight checklist

Describe the background of your feature request

Heimdall currently parses rules and adds the defined mechanisms (authenticators, authorizers, contextualizers, and finalizers) to a sequential list. Conditional execution is supported for all mechanisms except authenticators, using if clauses that can reference request properties or attributes of the authenticated subject.

For small rules, this sequential execution works well. In larger rules with multiple conditional steps, evaluating conditions sequentially can become cumbersome and prevents parallel execution.

Describe your idea

Introduce a DAG-based representation for rule steps. Instead of a flat list, the mechanisms would be structured as nodes in an acyclic directed graph, with edges representing execution dependencies. This would allow:

  • Precomputing execution order based on dependencies.
  • Parallel execution of independent mechanisms, improving performance.
  • Simplified conditions: if clauses could still refer to request or subject properties but would no longer need to reference whether another mechanism has been executed.
  • Better maintainability and readability of complex rules.

Are there any workarounds or alternatives?

Leave it as it is

Version

0.17.0

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureUsed for new features

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions