alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 25 Wiki Activity

Place SGU role groups in their user OUs

Browse Source
This commit is contained in:
alexrg
2026-09-08 16:12:58 -06:00
parent a24c25a3fb
commit 8baa47fe1e
7 changed files with 51 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+5 -2
View File
@@ -76,8 +76,11 @@ password outcome.
Every synchronization also enforces one idempotent security-group membership
from the classified institutional prefix: `AL` to `SGU-Alumnos`, `AD` to
`SGU-Administrativos`, and `DO` to `SGU-Docentes`. This happens synchronously
inside the broker before the institutional password is written to AD. A missing
`SGU-Administrativos`, and `DO` to `SGU-Docentes`. Each role group is stored
inside its corresponding user OU. During an upgrade,
the bootstrap moves a legacy group from the `Usuarios-SGU` root while preserving
its SID and memberships instead of creating a duplicate. Membership enforcement
happens synchronously inside the broker before the institutional password is written to AD. A missing
or inaccessible role group therefore fails provisioning instead of leaving a
new usable account without its authorization classification. Existing accounts
are repaired automatically on their next successful SGU authentication.