Keycloak

What is configured for the golonex realm:

Setting	Value here	Why
Display name	Golonex	what users see on the login page
Require SSL	external	HTTPS enforced for outside requests
User registration	off	identities come from HR, never self-service
Brute force detection	on	locks an account after repeated failures
User + admin events	on	the audit trail the SIEM consumes

Events are worth a visit in their own right: Realm settings › Sessions / Security defenses hold the lockout policy, and the recorded events appear under Realm settings › Events.

The most important screen in Keycloak for this lab. It defines how Keycloak reads the directory:

Field	Value here	What it means
Connection URL	ldap://openldap:389	the directory, on the internal network
Bind DN	cn=readonly,dc=golonex,dc=local	a read-only account — Keycloak never writes
Users DN	ou=people,dc=golonex,dc=local	where to look for accounts
Username LDAP attribute	uid	what becomes the Keycloak username
Edit mode	READ_ONLY	governance belongs to midPoint, not here
Custom user LDAP filter	(!(employeeType=disabled))	disabled accounts disappear — this is what makes off-boarding instant
Periodic full sync	every 300 s	keeps the imported copy fresh

Scroll to Mappers on the same provider to see how directory attributes become token claims — first name, title, employeeNumber, and the group mapper that turns ou=groups membership into the groups claim.

The exam point: that one filter line is the whole leaver story. Disable in IGA → the attribute changes in the directory → Keycloak stops seeing the user → every application that trusts Keycloak refuses them.

The Portal is registered here as a confidential OIDC client. Look at:

• Valid redirect URIs — https://app.iamlab.genbay.co/*. Keycloak will only return a token to an address on this list; that is what stops a look-alike site from harvesting logins.
• Web origins — the browser origins allowed to call it.
• Credentials tab — the client secret the Portal uses to prove it is really the Portal.
• Client scopes › dedicated › Mappers — the groups mapper that puts entitlements in the token OPA later reads.

Users shows the federated workforce (they appear after a sync, or on first login). Open one and its Groups tab reflects directory membership — read-only, because midPoint owns it.

Sessions lets you see and revoke live logins — the blunt instrument when you need someone out now, before the next governance cycle.