What it does here
The Golonex Portal is the one piece of the stack that was written for this lab rather than downloaded. Every other tool is a real product; the Portal exists to be the ordinary business application they all protect — the place where identity, entitlements and policy finally meet a user.
It is deliberately thin. It stores no passwords and makes no access decisions of its own:
- for identity it redirects to Keycloak and trusts the OIDC token that comes back;
- for authorization it asks OPA before every action;
- for HR data it edits the same CSV feed midPoint imports.
In policy terms it is the policy enforcement point — it asks, then enforces.
How it is deployed
Container portal, built from a small Flask application. It holds the OIDC client secret, the internal Keycloak and OPA addresses, and a mount of the HR feed — see Installation §4.5.
The pages, and what each one is for
Sign-in
There is no login form. Choosing Sign in hands you to Keycloak; you return authenticated. The home page then shows your identity as the token describes it — username, e-mail, department and the groups claim. That list of groups is what OPA will judge you by.
Finance
Create supplier invoices and approve payments. This is where least privilege, the 50,000 threshold and segregation of duties become concrete. Denials appear with OPA's reason attached.
HRIS
The authoritative HR feed, presented as a table. Adding a joiner, changing a department or setting a status to terminated writes the CSV that midPoint imports on its next run.
This is the origin of the whole lifecycle. Every provisioning event you watch downstream starts with an edit on this page.
IT Admin
Restricted to it-admins. It carries no privileged capability itself — it links out to Teleport and Guacamole, because Golonex policy is that administrative access happens through PAM, recorded, and never from inside a web app.
Try this
- Open the same page as two different users —
erin.evansandbob.builder— and watch one application behave differently for each. Same code, different entitlements. - Add a joiner on the HRIS page, then follow them through midPoint into the directory and back to a working login. That round trip is the lab in miniature.