Identity management
Identity lifecycle, single sign-on, and directory assessment.
The project ↓An IAM lab at ESPRIT connecting Active Directory, identity governance, and application sign-in. The project follows identity changes through the directory and the applications that depend on it.
- The problem
- An identity change needs to reach the directory and the applications that depend on it.
- The solution
- midPoint manages the identity lifecycle, Keycloak handles application sign-in, and PingCastle assesses directory security.
- The outcome
- Validated OIDC SSO for Grafana and Nextcloud, plus account blocking from midPoint through AD to Keycloak.
How it works.
Manage the lifecycle.
Active Directory supplies the identities. midPoint imports them and manages lifecycle actions.
Connect the sign-in.
Keycloak federates with AD and provides OpenID Connect sign-in for Grafana and Nextcloud.
Review directory security.
Validate account blocking across the identity chain and use PingCastle findings to prioritize directory fixes.
Project images.
Technical notes
One directory, connected applications
Active Directory is the authoritative identity source. midPoint imports the identities and handles lifecycle actions. Keycloak federates with AD through LDAP and provides OpenID Connect SSO for Grafana and Nextcloud.
Test what happens when access changes
The team validated identity import, application sign-in, and account blocking across midPoint, Active Directory, and Keycloak. LAN and PROD services were separated by a firewall.
Assess and harden the directory
PingCastle assesses the lab’s Active Directory environment and provides findings for a prioritized remediation plan.