Lion Cipher Lab
Run an access recertification campaign over your own directory — and catch the access nobody will vouch for
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every framework that anyone audits you against — access reviews in NIST SP 800-53 (AC-2, AC-6), the least-privilege pillar of a zero-trust program — eventually asks the same question: for every person who can do something sensitive, does someone still say they should? That periodic yes/no is a recertification (or access-review) campaign, and in most organizations it is a spreadsheet emailed to managers who click "approve all". Doing it once, properly, on a directory you own shows you the mechanics the SaaS governance tools hide: how entitlements are really stored, how a reviewer gets…
What you'll learn
- running an access recertification (access-review) campaign end to end
- modelling entitlements as directory group memberships
- assigning reviewers by the manager attribute and routing the exceptions
- querying and modifying LDAP from Python with ldap3
- revoking membership with an LDAP modify (MODIFY_DELETE) and handling the last-member rule
- detecting orphaned and dangling-owner accounts
- producing a tamper-evident audit trail an auditor will accept
Steps in this lab
- What a recertification campaign is, and when you actually run one
- The thing you'll certify: entitlements, owners, and the three ways it goes wrong
- Get the pieces in place: directory up, venv, ldap3, admin password exported
- Seed a realistic org into your directory — traps included
- Connect from Python and read one entry
- Take the campaign snapshot (and hash it)
- Build the reviewer worksheets and route the exceptions
- What a good review decision actually asks
- Record the reviewers' decisions
- Enforce the revocations — and meet the last-member rule
- Remediate the access nobody would vouch for
- The evidence an auditor will actually accept
- Close the campaign: re-check and prove the change
- Run it on a cadence — and where it sits next to JML and role mining
- Where campaigns quietly fail
- What you just did — and why it matters