3 · Integration & use cases — Genbay CIAM Lab Guide

The whole lab is one story: a new employee — Alice Anderson — is hired, given access, moved, and eventually off-boarded, while the security team watches. This chapter first shows the map and the wiring, then presents each stage of Alice's story as a flowchart followed immediately by the hands-on steps. Read each flowchart left to right (1 → 2 → 3), then do the steps beneath it.

Architecture map: HR feed to midPoint to OpenLDAP to Keycloak to the Portal, with OPA beside the Portal, a privileged-access lane of Teleport/Guacamole to servers, and Wazuh SIEM collecting login, authorization and session events. Caddy is the single HTTPS front door. — Figure 1 — The map: where every tool sits and who talks to whom.

3.1 The integration points — the wiring

Individually the tools are useful; the power is in how they connect. These are the exact joints:

Connection	How	Why it matters
HR feed → midPoint	CSV connector; the file is the authoritative source	Joiners/movers/leavers originate in one place
midPoint → OpenLDAP	LDAP connector; midPoint is the only writer	Governance drives the directory — not hand-editing
Keycloak → OpenLDAP	LDAP user federation (read-only bind)	The accounts that exist are exactly the accounts that can log in
Portal → Keycloak	OIDC client (`golonex-portal`)	The app never handles passwords; SSO + MFA are centralised
Portal → OPA	Decision API call per action	Authorization is externalised as policy-as-code
Keycloak & Portal → Wazuh	Event forwarder + shared JSON log → Wazuh localfile + rules	Security events become alerts
Teleport / Guacamole → servers	JIT SSH / brokered session, both recording	Privileged access is accountable
Everything → Caddy	Reverse proxy per subdomain over HTTPS	One front door; nothing else exposed

The one idea to remember midPoint writes the directory; Keycloak reads it. That single shared source of truth is why a change in governance (a disable, a role removal) instantly changes what a person can authenticate to and do.

The cast (for the walk-throughs) Seeded users, all with password Welcome2026!: bob.builder (IT), carol.chen (Finance manager / approver), dave.dixon (HR), erin.evans (AP clerk). Mallory Mills exists only in the directory (no HR record). Alice Anderson does not exist yet — you create her and follow her through.

Use case A · CRD 3, 5

Joiner — onboard Alice from the HR feed

Joiner flow: HR adds Alice as a CSV row; midPoint imports and assigns her role; OpenLDAP gets an account and group; Keycloak now sees her; she logs into the Portal. — Read the flow, then perform the steps below.

In the Portal as dave.dixon (HR), open HRIS and add a joiner: Alice Anderson, Finance, "Accounts Payable Clerk".
In midPoint, run the HR feed import task ("Run now"). Open Alice — she is enabled, in Finance, with the Employee birthright role.
On her Projections tab, confirm midPoint created her OpenLDAP account and put her in app-users — the baseline access every employee gets.
In the Portal, sign in as alice.anderson / Welcome2026! — she can log in. Identity flowed HR → IGA → directory → IdP → app with no manual account creation.

Use case B · CRD 6

Login & authorization — proven once, checked every action

Login flow: user opens the Portal; redirected to Keycloak to log in with MFA; the Portal receives a token and groups; it asks OPA to check policy; OPA returns allow or deny with a reason. — Read the flow, then perform the steps below.

As erin.evans (AP clerk) in the Portal, open the IT Admin page — you are denied, with OPA's reason ("missing entitlement"). Least privilege.
As bob.builder (IT), the same page opens. Same app, different entitlements, decided by OPA per request.
As an AP approver, try approving a payment above 50,000 without the manager group — OPA denies it and explains a manager is required. That is ABAC: the decision depends on the amount, not just the role.

Use case C · CRD 4, 5

Access request, approval & segregation of duties

Two flows. Normal path: request AP Clerk; midPoint checks and routes; a line manager approves; the group is provisioned. Conflict: request AP Approver too; midPoint's SoD rule fires; the request is blocked because a clerk cannot also be an approver. — Read the flow, then perform the steps below.

In midPoint, request Finance AP Clerk for Alice. It does not apply immediately — it raises an approval routed to a line manager (an Access Approver).
Approve it; midPoint provisions the entitlement (the finance-ap-clerk group). Confirm in the Portal that Alice can now create invoices.
Now request Finance AP Approver for Alice, who already holds AP Clerk. midPoint blocks it — the two roles are segregated. She is not granted the conflicting role.

Defence in depth Even if a conflicting grant slipped through, the Portal's OPA denies every finance action to anyone holding both roles — the rule is enforced in the IGA tool and at the application.

Use case D · CRD 6, 7

Privileged access — just-in-time, and recorded

Privileged access flow: an IT administrator connects with browser and MFA; through Teleport or Guacamole gets a just-in-time recorded session; opens a session on a server; the session is captured as a replayable recording. — Read the flow, then perform the steps below.

Open Teleport, complete first-time setup for golonex-admin (password + an authenticator app for MFA), and open a browser SSH session to golonex-app-01. Run a few commands.
End the session and play it back under Session Recordings — every keystroke captured.
Open Guacamole, launch golonex-db-01 (SSH, recorded), run commands, close it, and replay the recording. A second, independent recorded path to privileged systems.

Use case E · CRD 3, 6, 7, 9

Mover, reconciliation, leaver & the SOC capstone

Two flows. Off-board: HR terminates Alice; midPoint disables her; the directory and IdP show her disabled and hidden; login is blocked everywhere at once. Detect: an ex-employee tries an old login; Keycloak records a login error; the forwarder sends the event to the SIEM; Wazuh raises a level-12 alert. — Read the flow, then perform the steps below.

Mover: in HRIS, change Alice's department to IT and re-run the import. Her Finance-scoped finance-ap-clerk entitlement is automatically removed — access follows the person.
Reconciliation: run midPoint's Directory reconciliation. mallory.mills surfaces as unmatched — a directory account with no owning identity (an orphan). That is CRD 9 in action.
Leaver: open the Wazuh dashboard in one tab. In HRIS, set Alice's status to terminated and re-run the import. She is disabled in midPoint, disabled in the directory, and hidden from Keycloak.
Confirm off-boarding: try to sign in as Alice in the Portal — it fails. Her access is gone everywhere at once.
Simulate misuse: attempt her old credentials a few more times. Within seconds, Wazuh raises a high-severity alert (level 12) — "login attempt for non-existent/disabled account — possible post-termination access attempt" — with the username, source IP and time.

✓ You have run the whole story Joiner → authorize → request & approve → SoD → privileged access → mover → reconciliation → leaver → SOC alert. That is the full loop: govern, enforce, monitor.