Operational Walkthrough — "A Day at GolemSec"

A hands-on exercise: operate the company as its own users, each persona using only their own AD account (no admin bypass), to see whether real business workflows actually work end-to-end — and where they break.

Method: authenticate as a real employee, attempt their job within their permissions, and "raise a hand" wherever a real user would be blocked. Where a role didn't exist, hire it.

The cast (all real AD employees, pw G0lemSecUser#2026)

Persona	Who	Role
Sales	Patricia Williams (patricia.williams)	Account Executive
IT	Mary Biton (mary.biton)	DevOps Engineer
Dev	Noa Miller (noa.miller)	Senior Engineer
Security/CISO	Yael Bar-On (yael.baron)	CISO — hired during the exercise (none existed)
CEO	David Cohen (david.cohen)	CEO

Morning — the workflows

🧑‍💼 Sales — close 2 insurance policies

Patricia closes two life policies on the phone, then tries to record them:

• CRM (SuiteCRM): company login bounces (302) — not federated to AD.
• ERPNext: company login works ✅, but creating the client → 403 No permission for Customer.
• Policy system: none exists (/insurance → 404).

➡️ The sale is real; there is nowhere she's allowed to put it. Raises a hand to IT.

🛠️ IT — support the org

• Jenkins ✅ (GG-IT group recognized). All login surfaces reachable.
• Tries to grant Patricia a role in ERPNext → 403. Even IT can't administer the business apps — no delegated admin; only break-glass Administrator could.
• No CISO exists, so IT runs onboarding and hires Yael Bar-On as CISO ✅.

👩‍💻 Dev — ship code

Smoothest department. Jenkins ✅ (GG-RnD), GitLab SSO ✅ (browser). Caveat: Jenkins authorization is "any authenticated user = full control" — over-permissioned.

🛡️ CISO — first hour on the job

• SIEM (Wazuh): company login rejected (401) — the security team can't reach their primary tool with company identity.
• Crown-jewel PII DB (golemsec_corp) is reachable across network tiers (10.50.30.12:5432 open from a general server host).
• Until this morning, nobody owned security.

👔 CEO — see the business

ERPNext ✅ login; could read Company (200) but not Customers (403); no business-KPI dashboards (Grafana shows infrastructure, not revenue). A fragmented view.

The blockers (as found)

1. Authentication solved; authorization never wired. SSO logged everyone in, but no AD-group → app-role mapping existed, so users (and even IT) landed with zero business permissions. The single gap behind the broken sales, IT-support, and CEO workflows.
2. Four apps not federated: SuiteCRM (CRM), Wazuh (SIEM), OrangeHRM (HR), Akaunting (accounting).
3. No line-of-business insurance system.
4. Zabbix authenticates via LDAP but can't auto-provision (v6.0) — only pre-created users get in.
5. Jenkins over-permissioned (any authenticated user = admin).
6. PII database network-exposed across tiers.

Afternoon — fixing blocker #1 (authorization)

Wired AD group → ERPNext role mapping (Frappe LDAP Group Mappings), so permissions follow group membership automatically at login:

AD group	ERPNext roles
GG-Sales	Sales User, Sales Manager
GG-IT	System Manager
GG-Finance	Accounts User
GG-Executive	Accounts Manager, Sales Manager
GG-HR	HR User

Also removed the over-broad default_role = System Manager (every employee was silently a sysadmin) → least-privilege by default.

Verified after the fix (same users, same logins):

• Patricia → roles Sales User, Sales Manager; recorded both policyholders (Avi Shapiro, Dana Levi) — HTTP 200. ✅
• Mary (IT) → System Manager; can administer ERPNext. ✅
• David (CEO) → Accounts Manager, Sales Manager; reading Customers now 200 (was 403 in the morning). ✅

Still to do (the pattern, applied everywhere)

• Apply the same group → role mapping to the OIDC apps via Keycloak (group/role mappers → Grafana/GitLab/Nextcloud roles) and to GLPI (LDAP group → profile) and Zabbix (user-group mapping).
• Federate the remaining four apps (CRM, SIEM, HR, accounting) or document their local-auth exception.
• Tighten Jenkins to role-based authorization.
• Lock down the PII database to the app tier; add monitoring.
• Stand up a policy-administration capability for the insurance line of business.

How the company runs (end of day 1)

GolemSec moved from "built but locked out" → "everyone can log in" → (after the fix) "the people whose groups are mapped can now actually do their jobs." The identity bridge works; authorization is now wired for the core ERP, and the same pattern needs rolling out across the rest of the estate.

---

Day 2 — the whole org reports for work

The group → role mapping was extended to every department, then a representative from each function logged in with their own AD account and did a job-appropriate task.

Roles granted automatically by AD group (at login)

Department (AD group)	ERPNext roles inherited
Sales (GG-Sales)	Sales User, Sales Manager
Marketing (GG-Marketing)	Sales User
Finance (GG-Finance)	Accounts User, Accounts Manager
HR (GG-HR)	HR User, HR Manager
Operations (GG-Operations)	Stock User
Support (GG-Support)	Support Team
IT (GG-IT)	System Manager
Executive (GG-Executive) — CEO/CTO/CFO/CISO	Accounts Manager, Sales Manager
Legal (GG-Legal), R&D (GG-RnD)	(none in ERP — least-privilege; they use Nextcloud / GitLab)

Job-appropriate action, by department (verified)

Persona	Title	Task	Result
Elizabeth Brown	SEO Analyst (Marketing)	create a Lead	✅ 200
Noam Garcia	Sales Manager	create a policyholder	✅ 200
Michael Biton	Financial Analyst	read chart of accounts	✅ 200
Robert Peretz	CFO	read general ledger	✅ 200
Eden Taylor	HR Manager	read employees	✅ 200
Eitan Gabay	Operations Manager	read items / stock	✅ 200
Noa Wilson	Support Engineer	read tickets	✅ 200
Noa Peretz	Legal Counsel	read Customers	🔒 403 (correctly denied)
Noa Miller	Senior Engineer (R&D)	read ledger	🔒 403 (correctly denied)

Outcome: 15 employees across all 10 departments + leadership authenticate with company identity and receive exactly the access their role needs — nothing more. The authorization model that was missing on Day 1 now governs the entire ERP.

Department primary tools — where each function still stands

Department	Primary tool(s)	Status
Sales / Marketing	ERPNext ✅ · SuiteCRM (CRM)	CRM not federated
Finance	ERPNext ✅ · Akaunting	Akaunting local auth
HR	ERPNext ✅ · OrangeHRM	OrangeHRM not federated
IT	GLPI ✅ · Grafana ✅ · Jenkins ✅ · Zabbix (LDAP, pre-provisioned only)	mostly ✅
Operations / Support	ERPNext ✅ · GLPI ✅	✅
Legal	Nextcloud ✅	✅
R&D	GitLab ✅ · Jenkins ✅	✅
Security (CISO)	Wazuh (SIEM)	not federated
Executive	ERPNext ✅ · Grafana ✅	✅

The remaining gaps are now narrow and specific: the four local-auth apps (CRM, HR, SIEM, accounting), Zabbix auto-provisioning, and rolling the same group → role mapping into the Keycloak-OIDC apps so their roles match (not just their logins).

---

Day 3 — the organization comes to life

Each department, logged in as real employees, did real work. A gap was closed first: ERPNext's company setup had never been completed (no company, fiscal year, item groups, UOM, price list) — so GolemSec Insurance Ltd was created with its accounting defaults and an insurance product catalog.

Department	Activity generated (by real employees)	Where it lives
Sales	7 leads → 9 policyholders → 7 policy quotes (NIS 13,800 in premiums) + 2 opportunities (Patricia, Noam, Dana, Elizabeth)	ERPNext
Customer Service	7 support tickets, 1 resolved (Noa Wilson, Linda Taylor, Daniel Smith)	ERPNext Issues
Development	GitLab repo policy-portal (5 issues + commits) + Jenkins policy-portal-build (3 green CI builds) — Noa Miller, David Garcia	GitLab, Jenkins
IT	6 internal tickets (CISO onboarding, access grants, June patching, SIEM federation) + the day's admin work	ERPNext Issues

Insurance product catalog: Life (NIS 1,500), Auto (2,400), Health (3,600), Property (1,800), Travel (600).

A realistic permission nuance surfaced and was handled: System Manager ≠ Support-module access — IT couldn't file helpdesk tickets until granted a support role (their tickets properly belong in GLPI, their ITSM tool).

The organization is now live: real employees, real logins, real permissions, and real business records flowing through Sales, Service, Development, and IT.