Keep the categories straight — that is what the exam tests, and what a working IAM architecture depends on. For each tool, three questions matter: what is it, what is its most important job, and who does it talk to?
OpenLDAP
Full reference — settings, source and what to look at →
dc=golonex,dc=localMain use case: the central store of identities and groups — the enterprise "phone book" every other tool reads.
First-hand purpose: hold accounts (ou=people) and access groups / entitlements (ou=groups) as the single, authoritative directory.
Talks to: written only by midPoint (provisioning); read by Keycloak (federation). Nothing else writes to it — that discipline keeps the directory trustworthy.
midPoint
Full reference — settings, source and what to look at →
Main use case: the engine of the identity lifecycle — it decides who should have what and makes reality match.
First-hand purpose: read the authoritative HR feed and, from it, create / change / disable identities; provision entitlements through roles; run approvals, access reviews and reconciliation.
Talks to: reads the HR CSV (source), writes OpenLDAP (target). The brain; the directory is its memory.
Keycloak
Full reference — settings, source and what to look at →
Main use case: single sign-on — one login, with MFA, that every application trusts.
First-hand purpose: authenticate users and issue tokens. It federates the OpenLDAP directory, so the accounts midPoint provisions are exactly the accounts that can log in.
Talks to: reads OpenLDAP (user federation); issues OIDC tokens to the Portal; emits login events to the SIEM.
Golonex Portal + Open Policy Agent (OPA)
Golonex Portal reference → · Open Policy Agent reference →
Main use case: a real business app that enforces access on every action — where policy meets the user.
First-hand purpose: the Portal (Policy Enforcement Point) logs users in via Keycloak and, for every action, asks OPA (Policy Decision Point) "is this allowed?". OPA answers from policy-as-code: RBAC, ABAC (e.g. amount thresholds), and segregation of duties.
Talks to: Portal → Keycloak (login) and → OPA (authorize); both emit events to the SIEM.
Teleport
Full reference — settings, source and what to look at →
Main use case: safe administrator access to servers — just-in-time, MFA-protected, and recorded.
First-hand purpose: give an IT admin a browser SSH session to a server without standing credentials, and record every keystroke for accountability.
Talks to: the admin's browser (through the proxy); the target server; recordings replay in its own UI.
Apache Guacamole
Full reference — settings, source and what to look at →
Main use case: browser-based privileged sessions (SSH/RDP/VNC) with no client installed — a complementary path to privileged systems.
First-hand purpose: broker and record a session to a target server entirely inside the browser, with playback.
Talks to: the admin's browser; the target server (via the guacd daemon); recordings stored on a volume.
Wazuh
Full reference — settings, source and what to look at →
Main use case: the security operations centre's single pane of glass — collect events from everywhere and alert on the dangerous ones.
First-hand purpose: ingest authentication and authorization events and raise alerts — for example, a login attempt against a terminated account.
Talks to: receives forwarded Keycloak + Portal events; its indexer stores them; its dashboard shows them.
Caddy
Full reference — settings, source and what to look at →
Main use case: one secure front door for every console.
First-hand purpose: terminate HTTPS and route each subdomain to the right tool, so nothing else is exposed to the network.
Talks to: the internet (ports 80/443) inbound; every tool's web UI internally. The only component that publishes a host port.
2.1 How they interact — the big picture
Three enterprise categories sit on top of a directory foundation, with a policy engine at the application and a SIEM watching everything:
- IGA (midPoint) governs the lifecycle and writes the directory (OpenLDAP).
- Access Management (Keycloak) reads that directory and handles logging in — SSO and MFA.
- The application (Portal) trusts Keycloak for identity and asks OPA for every authorization decision.
- PAM (Teleport, Guacamole) governs privileged access to servers, separately and with recording.
- SIEM (Wazuh) ingests events from across the stack and alerts.
- Caddy fronts all of it over HTTPS.