Appendix · Access & credentials — Genbay CIAM Lab Guide

Start here Open iamlab.genbay.co — the lab landing page links to every console below, and each opens in its own tab.

A.1 Console links

All consoles are HTTPS with valid certificates.

Tool	What you use it for	Link
Golonex Portal	The business app — SSO login, Finance actions, the HRIS feed	app.iamlab.genbay.co
Keycloak	Identity Provider — SSO, MFA, LDAP federation, login events	keycloak.iamlab.genbay.co/admin/
midPoint	IGA — joiner/mover/leaver, roles, approvals, reconciliation	midpoint.iamlab.genbay.co
Teleport	PAM — just-in-time SSH with MFA, recorded sessions	teleport.iamlab.genbay.co
Apache Guacamole	Clientless recorded session gateway	guacamole.iamlab.genbay.co
Wazuh	SIEM — security events and the post-termination alert	wazuh.iamlab.genbay.co
Lab landing page	Index of all of the above	iamlab.genbay.co

A.2 The Golonex organisation

Everyone who exists in the lab today, plus the identities you create yourself. Reporting lines come from the HR feed — the authoritative source that drives everything downstream.

Golonex org chart. Finance: Carol Chen (Finance Manager) with Erin Evans (Accounts Payable Analyst) reporting to her, and Alice Anderson (Accounts Payable Clerk) shown dashed as an identity you create. Mallory Mills (Contractor) sits outside the reporting tree as an orphan with no HR record. IT: Bob Builder (Systems Administrator). HR: Dave Dixon (HR Business Partner). A side panel explains that anyone added through the HRIS page is provisioned automatically with a governed identity, a directory account, the app-users birthright group and an SSO login. — The Golonex org chart — live identities, the one you create, and the orphan.

Three kinds of identity — and why that matters Live identities came from the HR feed and are fully governed. Alice does not exist yet: you create her in Use case A and follow her all the way to off-boarding. Mallory is the odd one out — she has a directory account but no HR record, so no manager, no approver and no review. That is exactly what account reconciliation is designed to catch.

A.3 Golonex workforce — the identities you operate on

These are the synthetic employees in the directory. They all share one training password: Welcome2026!. Use them to sign into the Golonex Portal.

Username	Person	Department	Entitlements	Use them to…
`bob.builder`	Bob Builder	IT	app-users, it-admins, access-approvers	see the IT Admin page; approve access requests
`carol.chen`	Carol Chen	Finance	app-users, finance-ap-approver, access-approvers	approve payments; approve access requests
`dave.dixon`	Dave Dixon	HR	app-users, hr-staff	edit the HRIS feed — joiners, movers, leavers
`erin.evans`	Erin Evans	Finance	app-users, finance-ap-clerk	create invoices; test a denied action
`mallory.mills`	Mallory Mills	Finance	finance-ap-clerk (directory only)	the orphan — no HR record; found by reconciliation
`alice.anderson`	Alice Anderson	—	does not exist yet	you create her in Use case A and follow her to off-boarding

New joiners you create Anyone you add through the HRIS page is provisioned with the same initial password, Welcome2026!.

A.4 Administrator accounts

You operate the lab as the IAM administrator. These are the console sign-ins:

Console	Username	Password
Keycloak (admin console)	`admin`	`qhDEGX28XoFx5ZZIdFcU`
midPoint	`administrator`	`THVvxzLYjL0zSJoChrS7`
Apache Guacamole	`guacadmin`	`Wv67ZbdWYq32fYMZAa1!`
Wazuh dashboard	`admin`	`1qhgCv1G2um8oyARfnAa1.`
Teleport	`golonex-admin`	you set it yourself — see A.4

Keycloak realms The admin account signs into the master realm. The Golonex workforce lives in the golonex realm — switch realms using the selector at the top-left of the admin console.

A.5 Teleport — first-time sign-in

Teleport does not use a shared password. Your instructor gives you a one-time invite link (of the form https://teleport.iamlab.genbay.co/web/invite/…). Open it once and you will:

Choose your own password for golonex-admin.
Enrol a second factor — scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password…). MFA is mandatory for privileged access.
Land in the Teleport web UI, where golonex-app-01 is waiting under Resources.

Invite links expire If yours has lapsed, ask your instructor to reissue it — tctl users reset golonex-admin takes them a moment.

A.6 The servers you connect to

Server	Reached through	Login on the server
`golonex-app-01`	Teleport (just-in-time SSH)	`golonex-ops` — granted automatically by your Teleport role
`golonex-db-01`	Guacamole → connection "golonex-db-01 (SSH, recorded)"	`golonex-ops` — already saved in the connection

You never type a server password: Teleport issues short-lived certificates, and Guacamole holds the credential inside the saved connection. That is the point of PAM — no standing secrets.

A.7 Directory reference

Useful when reading midPoint or Keycloak screens:

Item	Value
Directory base DN	`dc=golonex,dc=local`
People	`ou=people,dc=golonex,dc=local`
Groups (entitlements)	`ou=groups,dc=golonex,dc=local`
Directory admin bind DN	`cn=admin,dc=golonex,dc=local`
Directory read-only bind DN	`cn=readonly,dc=golonex,dc=local` (the account Keycloak federates with)
Keycloak realm	`golonex`
Portal OIDC client	`golonex-portal`
HR feed (the authoritative source)	the HRIS page in the Golonex Portal

LDAP is not exposed publicly OpenLDAP has no console and no public port — by design. You inspect the directory through midPoint (Projections) and Keycloak (Users), which is exactly how a real IAM administrator works.

A.8 Entitlements (directory groups)

Group	Grants	Note
`app-users`	Baseline Portal access	birthright — every employee gets it automatically
`finance-ap-clerk`	Create supplier invoices	SoD pair — never together with the approver role
`finance-ap-approver`	Approve payments (≤ 50,000 alone)	SoD pair — never together with the clerk role
`access-approvers`	Approve others' access requests; approve payments > 50,000	line-manager role
`hr-staff`	View and edit the HRIS feed	scoped to the HR department
`it-admins`	The IT Admin page	scoped to the IT department

A.9 If the lab gets messy

Ask your instructor to reset it to the clean starting state. That removes any practice identities you created (including Alice), restores the four-row HR feed, clears pending approvals, and leaves the midPoint tasks ready to run. The seeded workforce above comes back exactly as listed.

Availability The lab is provided for the duration of your engagement. All data is synthetic — Golonex is a fictional company — so you can experiment freely.