What it does here
OpenLDAP is the directory — the single store of who exists and what groups they belong to. Everything else in the lab is arranged around it: midPoint is the only component that writes to it, and Keycloak reads it to decide who may log in.
The tree is deliberately small so you can hold it in your head:
| Branch | Contains |
|---|---|
dc=golonex,dc=local | the base of the Golonex directory |
ou=people | one entry per employee (inetOrgPerson) |
ou=groups | one entry per entitlement (groupOfNames) |
ou=service | reserved for non-human accounts |
How it is deployed
Container openldap, from the image above. The structure and the seeded workforce are loaded once at first start from LDIF bootstrap files — see Installation §4.2. Two accounts matter:
| Bind DN | Used by | Rights |
|---|---|---|
cn=admin,dc=golonex,dc=local | midPoint | read + write — provisioning |
cn=readonly,dc=golonex,dc=local | Keycloak | read only — federation |
Where you actually see the directory
Through midPoint
Open a user and look at the Projections tab. That is the live LDAP entry midPoint provisioned — attributes, group membership and account status, read straight from the directory.
Through Keycloak
Users lists the accounts Keycloak has federated from ou=people, and Groups mirrors ou=groups. If an identity is missing here, it is missing in the directory.
Try this
- Create a joiner, then open their Projections tab in midPoint — you are looking at an LDAP entry that did not exist a minute ago.
- Terminate them and watch
employeeTypeflip todisabled; that single attribute is what removes their ability to log in everywhere at once.