Add SGU credential provider and authentication broker

2026-08-31 17:48:18 -06:00
parent 5e216f42a4
commit 1f43f200b4
50 changed files with 3226 additions and 236 deletions
@@ -0,0 +1,48 @@
+# Architecture
+
+## Online authentication
+
+```text
+LogonUI
+  -> SGU Credential Provider (SecureString)
+      -> HTTPS 1.1 + client certificate
+          -> SGU Auth Broker
+              -> SGU IIS NTLM endpoint (original password)
+              -> Active Directory (same original password)
+          <- domain + canonical username; never a password
+      -> Windows credential serialization (original SecureString)
+  -> LSA / Kerberos / cached domain logon
+```
+
+The broker performs the NTLM exchange and AD update before returning `200 OK`.
+It follows only HTTPS redirects whose host appears in `AllowedRedirectHosts`,
+which prevents credential forwarding to an unexpected redirect target. HTTP/1.1
+is forced because NTLM authentication is connection-bound.
+
+## Offline authentication
+
+```text
+Broker timeout, TLS failure, 429, or 5xx
+  -> provider preserves the entered username/password
+  -> Windows LSA validates against AD or its cached domain verifier
+  -> only the last AD password succeeds
+```
+
+An explicit `400` or `401` from the broker is different: the provider displays
+an error and does not serialize the rejected credential.
+
+## Account synchronization
+
+The broker normalizes the username to uppercase and accepts exactly two letters
+plus six digits. It searches `BaseDn` by `sAMAccountName`, creates the user when
+absent, moves it to the mapped OU when required, sets `userPrincipalName`, and
+passes the submitted password directly to ADSI `SetPassword`.
+
+The managed hierarchy is rooted at `OU=Usuarios-SGU`: `Docentes`, `Alumnos`,
+and `Administrativos` are direct child OUs beneath it.
+
+Per-user synchronization is serialized inside the broker to prevent concurrent
+create/reset races. Production deployments should run the broker as a gMSA with
+delegated create-user, move-user, write-property, enable-account, and reset-password
+rights limited to `Usuarios-SGU` and its three managed child OUs. The lab can run it on the domain
+controller as LocalSystem.