Lion Cipher Lab
Automate the joiner-mover-leaver identity lifecycle (and understand what SCIM is really doing)
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every organisation has a system that hires people and a process that lets them go, and almost none of them are connected properly. The gap between the two is where orphaned accounts live: the contractor whose VPN login still works six months after the contract ended, the analyst who moved from finance to engineering and quietly kept both sets of permissions. Auditors ask about this in every single engagement, breach reports blame it constantly, and it is one of the few security problems a small script genuinely fixes. Learn the lifecycle on a real identity server you control, and you will…
What you'll learn
- joiner-mover-leaver (JML) lifecycle
- user provisioning and deprovisioning
- Keycloak Admin REST API
- detecting privilege creep in role mappings
- safe deprovisioning order
- SCIM 2.0 (RFC 7643 / RFC 7644)
- bash + curl + jq automation
Steps in this lab
- The problem, from zero: the gap between hiring and leaving
- Stand up Keycloak locally with one command
- Get an admin token — and understand what you are holding
- Build the structure a joiner will land in: realm, groups, roles
- JOINER: provision a real account through the API
- MOVER: move her team — and watch privilege creep appear
- LEAVER: deprovision in the right order, then decide delete vs retain
- Wrap all three flows in one script: jml.sh
- The standard you just reimplemented: SCIM 2.0
- When, why and better: what to automate and what to leave alone
- Clean up — and what is left on your machine (nothing)