Make Auth Broker authoritative for managed passwords

2026-09-18 16:46:56 -06:00
parent 8290e347f5
commit 7d78a1f515
8 changed files with 154 additions and 1 deletions
@@ -18,6 +18,9 @@ the same source list. RDP uses a separate allowlist. See
  `Marshal.ZeroFreeGlobalAllocUnicode`; managed references are released as soon
  as each request completes.
 - The broker uses the exact received value for both NTLM and AD `SetPassword`.
+- Managed `Usuarios-SGU` accounts deny the SELF and Everyone `Change Password`
+  extended right. Only an administrator or the broker through the separate
+  `Reset Password` right can replace the AD password.
 - There is no HMAC password, pepper, local password cache, Supabase password, or
  other derived credential in this Windows path.
 - Neither application logs request bodies or passwords. Deployment configuration