Enrich AD users from SGU profile metadata

docs/architecture.md

@@ -8,7 +8,8 @@ LogonUI
       -> HTTPS 1.1 + client certificate
           -> SGU Auth Broker
               -> SGU IIS NTLM endpoint (original password)
-              -> Active Directory (same original password)
+              -> minimum SGU profile metadata (same authenticated response)
+              -> Active Directory (same original password + optional profile)
           <- domain + canonical username; never a password
       -> Windows credential serialization (original SecureString)
   -> LSA / Kerberos / cached domain logon
@@ -19,6 +20,12 @@ It follows only HTTPS redirects whose host appears in `AllowedRedirectHosts`,
 which prevents credential forwarding to an unexpected redirect target. HTTP/1.1
 is forced because NTLM authentication is connection-bound.
 
+The logical GET is sent directly to the administrative incident overview for
+`AD` identities or to the portal menu for `DO`/`AL` identities. NTLM may still
+require its normal challenge/response round trips on that connection. The
+broker keeps any transient portal cookie in an in-memory per-request container;
+it is never persisted or returned to the client.
+
 ## Offline authentication
 
 ```text
@@ -38,6 +45,13 @@ plus six digits. It searches `BaseDn` by `sAMAccountName`, creates the user when
 absent, moves it to the mapped OU when required, sets `userPrincipalName`, and
 passes the submitted password directly to ADSI `SetPassword`.
 
+When the authenticated HTML exposes recognized stable IDs, the broker also
+updates `displayName`, `mail`, `title`, `department`, `employeeType`, and
+`employeeID`. The administrative employee number must match the six numeric
+digits of the requested `AD` identity before any scraped metadata is trusted.
+Missing metadata does not clear existing AD values and never changes the
+password outcome.
+
 The managed hierarchy is rooted at `OU=Usuarios-SGU`: `Docentes`, `Alumnos`,
 and `Administrativos` are direct child OUs beneath it.
 

docs/security.md

@@ -24,6 +24,20 @@
 - Client private keys are non-exportable and reside in `LocalMachine\My`.
 - The NTLM validator rejects non-HTTPS redirects, URI user information, and hosts
   outside its explicit redirect allow-list.
+- Profile enrichment reads only allow-listed HTTPS pages and caps the response
+  body at 512 KiB by default. Portal cookies are request-scoped and held only in
+  memory.
+
+## Profile minimization
+
+- Administrative enrichment reads only employee number, display name,
+  employee type/status, email, job title, and department from known element IDs.
+- Incident details, calendars, photographs, manager names, and manager positions
+  are deliberately ignored.
+- The employee number must match the authenticated `AD` key before metadata is
+  synchronized.
+- If SGU changes its HTML, authentication and exact-password synchronization
+  continue without enrichment; existing AD metadata is not erased.
 
 Lab self-signed certificates are appropriate only for the isolated VM network.
 Use an enterprise CA with revocation checking in production.