🔐🏢🎫📋🔷🛠️

PAMlab
Studio

Build, Test & Ship PAM Workflows — Without Touching Production

Press → to start

The Problem Everyone Knows

Step 1: Write provisioning script ✅ Done

Step 2: Ask for dev access to Fudo / AD / ServiceNow ⏳ 3 weeks

Step 3: Test against production 💀 Good luck

Step 4: Break something 🔥 200 users locked out

7 Mock APIs. One Command. Zero Risk.

PAMlab Studio :3000

🔐 Fudo:8443 · 42 eps

🏢 Matrix42:8444 · 38 eps

👤 AD (LDAP):8445 · 28 eps

❄️ ServiceNow:8447 · 55 eps

🎫 Jira SM:8448 · 40 eps

🛠️ Remedy:8449 · 35 eps

🔷 Custom:8450 · 42 eps

docker-compose up -d
✓ All 7 services healthy in 4.2s

5 Real-World Templates — Ready to Run

👤 Employee Onboarding

8 steps

Matrix42 → AD → Fudo

⏱️ Temporary Access

4 steps

Matrix42 → AD → Fudo

🚪 Offboarding

5 steps

AD → Fudo → ServiceNow

🚨 Emergency Revocation

5 steps

Fudo → AD → ServiceNow

📁 Project Access

4 steps

AD → Fudo → Jira

Watch Your Workflow Execute

Get
Ticket

→

Validate
Request

→

Create
AD User

→

Add to
Groups

→

Create
Fudo User

→

Assign
Policy

→

Update
Ticket

→

✅
Done

Total: 0ms

PowerShell IDE with Superpowers

📝 onboarding.ps1

# Create AD user from ticket data
$ticket = Get-M42Ticket -Id $TicketId
$user = New-ADUser -Name $ticket.FullName `
  -Department $ticket.Department

# Add to security groups
foreach ($g in $ticket.Groups) {
  Add-ADGroupMember $g $user
}

# Create Fudo access
$fudo = New-FudoUser -Login $user.Sam
Set-FudoPolicy $fudo $ticket.AccessLevel

🧪 Test Results

✅ Ticket M42-7291 loaded
✅ AD user jdoe created
✅ Added to 3 groups
✅ Fudo user provisioned
✅ Policy RDP-Admins assigned
✅ Cleanup: all test data removed

Random test users → No conflicts
→ Auto-cleanup after run

From Mock to Production in 60 Seconds

🧪 Mock

$base = "https://localhost:8443"
$auth = "mock-token-123"

Invoke-RestMethod $base/api/v2/users

🏭 Production

$base = "https://fudo.corp.net"
$auth = Get-OAuth2Token `
  -ClientId $env:FUDO_ID

Invoke-RestMethod $base/api/v2/users

Same logic. Different endpoints.

🔑 API Token🔐 OAuth2📂 LDAP Bind🔒 Basic Auth

Fudo Access Policies: The Missing Link

User in group = access to all servers in the safe

👤 AD Group
GRP-RDP-Admins

→

🔐 Fudo Group
RDP-Server-Admins

→

🗄️ Safe
IT-Administration

→

🖥️ Servers
DC01, DB-PROD, FS01

POST /api/v2/access-policies
{ "user_group_id": 12, "safe_id": 5, "protocol": "rdp" }

By the Numbers

API Endpoints

Mock Services

Workflow Templates

API Calls / Onboarding

Production Systems Harmed

Try it. Break stuff. Nobody gets paged.

git clone https://github.com/BenediktSchackenberg/PAMlab.git
cd PAMlab && docker-compose up
# Open http://localhost:3000

⭐ View on GitHub

Apache 2.0 — Free forever

Built by Benedikt Schackenberg

PAMlabStudio