Enterprise IAM Lab: Hybrid Identity for a Regulated Bank

The scenario

Biira Bank is a fictional state-chartered commercial bank: FDIC-insured, SEC-reporting, with the regulatory obligations that implies. Its identity architecture is not designed to a checklist of features but to the drivers a real bank would be examined against: GLBA safeguards, SOX separation of duties, PCI-DSS unique IDs and MFA for administrators, and the FFIEC’s 2021 authentication guidance on risk-based access. Every phase of the build names the regulation it answers.

The identity estate runs on the network documented in the sibling Enterprise Security Homelab; this project is the workload on top of it.

Architecture

Active Directory (corp.biirabank.com, on DC01, Windows Server 2025, VLAN 50) is the source of record for employee identity. The forest was rebuilt under that name in September 2026; the paragraph on version two below explains why, and what is still being restored on top of it. Okta Workforce Identity is the primary identity provider that applications federate to, reached through the Okta AD Agent over outbound HTTPS only, so nothing on the internet can initiate a connection to the domain controller. Microsoft Entra ID is the second cloud directory, planned for hybrid synchronisation and Microsoft 365 in Phase 6.

Authentication is evaluated in two layers. First the request is classified by network zone: an IP zone for the corporate network, a dynamic geographic zone for allowed countries, and a threat zone that recognises Tor exit nodes. Then the authentication policies apply in priority order, and the first match decides the assurance required:

1. Restricted countries: deny.
2. Public network: hardware-protected MFA.
3. Corporate network: standard MFA.

What is built

• Directory structure for a bank. Twenty organisational units, 27 employee accounts across six departments, 15 security groups, and a Microsoft-style tiered admin model (Tier 0 / 1 / 2) with seven hardened administrative accounts and the built-in Administrator disabled.
• AD to Okta synchronisation with attribute mapping, OU-scoped user and group sync, a dedicated service account, and administrative accounts deliberately excluded from the cloud directory.
• Application federation across protocol families. Dropbox Business over SAML 2.0 with automated provisioning and attribute mapping; Box over SWA with password vaulting; group-based assignment so access follows role, not individuals.
• Dynamic groups with Okta Expression Language, driven by the AD country attribute, so a change in the directory changes application access without a ticket.
• Network-based conditional access (Phase 5.1): three zones, three policy rules, tested with pilot users from both sides of the corporate boundary, with the flows recorded on video.
• Regulatory traceability. Each phase guide names the driver it satisfies, from FFIEC IT examination requirements in Phase 1 to BSA/AML geographic controls in Phase 5.

Decisions worth explaining

Okta is primary, not Entra. A bank of this profile typically federates to a best-of-breed IdP and keeps Microsoft as one of several relying parties. Making Okta primary also forces the harder integration work (agent, attribute mapping, protocol variety) rather than the path of least resistance.

Admin accounts do not sync to the cloud. Tier 0 identity stays on the domain. If the cloud IdP is compromised, the blast radius stops short of the directory that everything else depends on.

Where you are changes what you must prove. Graduated MFA by network zone is more honest than a blanket policy: it pushes hardware-backed factors to the risky context (public networks) without punishing every corporate login, and it makes a deny-by-geography rule a first-class control rather than an afterthought.

Version two: a new forest, and a decision record first

The estate described above was built on ad.biira.online. That domain is being retired, and the public brand moved to biirabank.com, which left the directory named after something the bank no longer owns. Two other things happened at the same time. The Okta org was deleted for inactivity, which is what the free integrator tier does and is nobody’s fault but mine. And the first build had grown by accretion, without a written record of why any name was chosen.

So version two starts from a decision record, ADR-001, written before anything was touched.

The internal forest is corp.biirabank.com, not biirabank.com. A domain controller becomes the authoritative DNS server for its own domain name. Naming the forest after the public domain would have made the controller authoritative for the public zone, so the bank’s own website would have stopped resolving from inside the lab. The corp. prefix keeps the two namespaces apart, and a sign-in suffix means users still type name@biirabank.com and never see the internal name.

A rebuild, not a rename. Renaming a forest is supported and reboots every machine twice with no clean rollback, and that cost is the same whether the directory holds thirty-five accounts or thirty-five thousand. Exporting the directory, demoting the controller and promoting it into a new forest was the better trade at this size. The export was taken first, because the demotion is the one irreversible moment.

What this cost, honestly: every member machine lost its domain membership and has to rejoin, and the Okta directory agent points at a domain that no longer exists. What it bought: a directory rebuilt to a scripted baseline, a namespace that does not collide with the public site, and a written reason for both.

What is next

• Rebuild the Okta org, configured with Terraform this time, so the tenant is a file in the repository rather than a sequence of clicks that cannot be replayed. Repoint the directory agent at the new forest.
• Phase 5.2 to 5.5: adaptive, risk-based MFA; device trust and posture; privileged access management; behavioural analytics.
• Phase 6: Entra ID hybrid synchronisation, seamless SSO and Microsoft 365, with federation decisions between Okta and Entra documented as a decision record.
• Grow the endpoint estate on the homelab side so the identity policies have realistic workstations to protect. The first member workstation, WKS01, is joined and inside policy scope.