Improve SGU logon resilience and client UX

src/SGU.AuthBroker/Services/ActiveDirectorySynchronizer.cs

@@ -101,6 +101,7 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
             user.CommitChanges();
 
             TryApplyProfile(user, identity, profile);
+            TryEnsureRemoteDesktopGroupMembership(user);
 
             return new DirectorySyncResult(
                 options.DomainNetbios,
@@ -163,6 +164,37 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
         }
     }
 
+    private void TryEnsureRemoteDesktopGroupMembership(DirectoryEntry user)
+    {
+        if (string.IsNullOrWhiteSpace(options.RemoteDesktopGroupDn))
+        {
+            return;
+        }
+
+        try
+        {
+            user.RefreshCache(["distinguishedName"]);
+            string? userDn = Convert.ToString(user.Properties["distinguishedName"].Value);
+            if (string.IsNullOrWhiteSpace(userDn))
+            {
+                return;
+            }
+
+            using DirectoryEntry group = Bind(options.RemoteDesktopGroupDn);
+            _ = group.NativeObject;
+            if (!group.Properties["member"].Contains(userDn))
+            {
+                group.Properties["member"].Add(userDn);
+                group.CommitChanges();
+            }
+        }
+        catch
+        {
+            // Remote access is lab policy and must not invalidate a completed
+            // password synchronization if the optional group is unavailable.
+        }
+    }
+
     private DirectoryEntry BindOrCreateOu(string ouDn, DirectoryEntry root)
     {
         try