The CIAM certification is organised around ten Critical Risk Domains (CRDs). This lab is not a separate topic — it is the curriculum made operational. Every tool you use exists to carry out one or more CRDs, and maps back to specific course chapters. Read this first so that, throughout the lab, you can always answer the exam's favourite question: "which domain does this belong to, and which category of tool owns it?"
1.1 Each tool → the domains and chapters it exercises
| Lab tool | Tool category | Critical Risk Domain(s) | Course chapter(s) |
|---|---|---|---|
| OpenLDAP | Directory service | CRD 10 (Tools — directories); the identity foundation under CRDs 3–9 | Ch 13; Ch 2 |
| midPoint | IGA — Identity Governance & Administration | CRD 3 Lifecycle · CRD 4 Access Request & Approval · CRD 5 Provisioning · CRD 8 Access Review · CRD 9 Reconciliation | Ch 6, 7, 8, 11, 12 |
| Keycloak | Access Management / Identity Provider | CRD 6 Enforcement (authentication, SSO, MFA, federation); CRD 10 (protocols: SAML, OIDC, LDAP) | Ch 9; Ch 13 |
| Open Policy Agent + Golonex Portal | Policy Decision / Enforcement Point | CRD 5 (access-control models — RBAC/ABAC) · CRD 6 Enforcement (authorization); CRD 2 (least privilege, defence-in-depth) | Ch 8; Ch 9; Ch 5 |
| Teleport | PAM — Privileged Access Management | CRD 6 Enforcement (privileged access, JIT, MFA); CRD 7 (session logging) | Ch 9; Ch 10 |
| Apache Guacamole | Clientless privileged-session gateway | CRD 6 Enforcement (privileged access); CRD 7 (session recording) | Ch 9; Ch 10 |
| Wazuh | SIEM — Security Information & Event Management | CRD 7 Auditing & Reporting; supports CRD 8 (monitoring for review) | Ch 10 |
| Caddy | Reverse proxy (supporting) | CRD 6 (TLS termination, single front door); CRD 2 (defence-in-depth) | Ch 5; Ch 9 |
1.2 Each domain → the tools that exercise it
Read the other way, the lab covers CRDs 3 through 10 hands-on (CRDs 1–2 are strategy and program-management theory the lab assumes rather than performs):
| Critical Risk Domain | What you do in the lab | Tools |
|---|---|---|
| 3 · Lifecycle & Transformation | Onboard a joiner, move them between departments, off-board a leaver — from the HR feed | HR CSV → midPoint → OpenLDAP → Keycloak |
| 4 · Access Request & Approval | Request an entitlement; it routes to a line-manager for approval before provisioning | midPoint |
| 5 · Provisioning & De-Provisioning | Roles provision/remove directory groups automatically; RBAC + ABAC decisions | midPoint, OpenLDAP, OPA |
| 6 · Enforcement | SSO with MFA; per-action authorization; least privilege; segregation of duties; privileged access | Keycloak, OPA/Portal, Teleport, Guacamole |
| 7 · Auditing & Reporting | Review authentication events; recorded privileged sessions; SIEM alerting | Keycloak, Teleport, Guacamole, Wazuh |
| 8 · Access Review & Re-Certification | Answer "who has what, and who approved it"; certification campaigns | midPoint, Wazuh |
| 9 · Account Reconciliation | Reconcile the directory against governed identities; find an orphan account | midPoint, OpenLDAP |
| 10 · Tools | Recognise the tool categories and the protocols (SAML, OIDC, SCIM-style connectors, LDAP) in the flesh | the whole stack |
Exam habit to build
Access reviews or provisioning → IGA; logging in → Access Management;
privileged accounts → PAM; monitoring and alerting → SIEM. This lab lets you
attach a real tool to each of those words.