Make Auth Broker authoritative for managed passwords

2026-09-18 16:46:56 -06:00
parent 8290e347f5
commit 7d78a1f515
8 changed files with 154 additions and 1 deletions
@@ -0,0 +1,21 @@
+$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+$synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs'
+$deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1'
+$synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw
+$deploy = Get-Content -LiteralPath $deployPath -Raw
+
+Describe 'SGU Auth Broker password authority' {
+    It 'denies the Change Password extended right to SELF and Everyone before SetPassword' {
+        $synchronizer | Should Match 'AB721A53-1E2F-11D0-9819-00AA0040529B'
+        $synchronizer | Should Match 'WellKnownSidType\.WorldSid'
+        $synchronizer | Should Match 'WellKnownSidType\.SelfSid'
+        $synchronizer | Should Match 'AccessControlType\.Deny'
+        $synchronizer.IndexOf('EnsureCannotChangePassword(user', [StringComparison]::Ordinal) |
+            Should BeLessThan $synchronizer.IndexOf('user.Invoke("SetPassword"', [StringComparison]::Ordinal)
+    }
+
+    It 'repairs every existing account below Usuarios-SGU during broker deployment' {
+        $deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree'
+        $deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true'
+    }
+}