Make Auth Broker authoritative for managed passwords

tests/AuthBrokerPasswordAuthority.Tests.ps1

@@ -0,0 +1,21 @@
+$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+$synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs'
+$deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1'
+$synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw
+$deploy = Get-Content -LiteralPath $deployPath -Raw
+
+Describe 'SGU Auth Broker password authority' {
+    It 'denies the Change Password extended right to SELF and Everyone before SetPassword' {
+        $synchronizer | Should Match 'AB721A53-1E2F-11D0-9819-00AA0040529B'
+        $synchronizer | Should Match 'WellKnownSidType\.WorldSid'
+        $synchronizer | Should Match 'WellKnownSidType\.SelfSid'
+        $synchronizer | Should Match 'AccessControlType\.Deny'
+        $synchronizer.IndexOf('EnsureCannotChangePassword(user', [StringComparison]::Ordinal) |
+            Should BeLessThan $synchronizer.IndexOf('user.Invoke("SetPassword"', [StringComparison]::Ordinal)
+    }
+
+    It 'repairs every existing account below Usuarios-SGU during broker deployment' {
+        $deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree'
+        $deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true'
+    }
+}

tests/SGU.AuthBroker.Tests/ActiveDirectorySynchronizerTests.cs

@@ -1,3 +1,6 @@
+using System.DirectoryServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using SGU.AuthBroker.Core.Profiles;
 using SGU.AuthBroker.Services;
 using Xunit;
@@ -31,4 +34,29 @@ public sealed class ActiveDirectorySynchronizerTests
 
         Assert.Null(updated);
     }
+
+    [Fact]
+    public void CannotChangePasswordRulesAreCompleteAndIdempotent()
+    {
+        ActiveDirectorySecurity security = new();
+
+        Assert.True(ActiveDirectorySynchronizer.EnsureCannotChangePassword(security));
+        Assert.False(ActiveDirectorySynchronizer.EnsureCannotChangePassword(security));
+
+        Guid changePasswordRight = new("AB721A53-1E2F-11D0-9819-00AA0040529B");
+        ActiveDirectoryAccessRule[] rules = security
+            .GetAccessRules(includeExplicit: true, includeInherited: false, typeof(SecurityIdentifier))
+            .OfType<ActiveDirectoryAccessRule>()
+            .Where(rule =>
+                rule.AccessControlType == AccessControlType.Deny &&
+                rule.ObjectType == changePasswordRight &&
+                (rule.ActiveDirectoryRights & ActiveDirectoryRights.ExtendedRight) != 0)
+            .ToArray();
+
+        Assert.Equal(2, rules.Length);
+        Assert.Contains(rules, rule => rule.IdentityReference.Equals(
+            new SecurityIdentifier(WellKnownSidType.WorldSid, null)));
+        Assert.Contains(rules, rule => rule.IdentityReference.Equals(
+            new SecurityIdentifier(WellKnownSidType.SelfSid, null)));
+    }
 }