alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 25 Wiki Activity

Add six-month domain and broker monitoring

Browse Source
This commit is contained in:
alexrg
2026-09-04 16:57:34 -06:00
parent f2a40f051b
commit dcbf5e87e3
20 changed files with 998 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/SGU.AuthBroker/Services/ActiveDirectorySynchronizer.cs
+40 -10
View File
@@ -7,7 +7,9 @@ using SGU.AuthBroker.Options;
namespace SGU.AuthBroker.Services;
public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActiveDirectorySynchronizer
public sealed class ActiveDirectorySynchronizer(
BrokerOptions options,
ILogger<ActiveDirectorySynchronizer> logger) : IActiveDirectorySynchronizer
{
private const int AccountDisabled = 0x0002;
private const int NormalAccount = 0x0200;
@@ -28,9 +30,26 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
await gate.WaitAsync(cancellationToken).ConfigureAwait(false);
try
{
return await Task.Run(
() => Synchronize(identity, profile, password),
cancellationToken).ConfigureAwait(false);
try
{
return await Task.Run(
() => Synchronize(identity, profile, password),
cancellationToken).ConfigureAwait(false);
}
catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
{
throw;
}
catch (Exception exception)
{
logger.LogError(
BrokerEventIds.DirectorySynchronizationFailure,
exception,
"Active Directory synchronization failed for {InstitutionalUser} with role {Role}.",
identity.UserName,
identity.Role);
throw;
}
}
finally
{
@@ -100,8 +119,8 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
user.Properties["pwdLastSet"].Value = -1;
user.CommitChanges();
TryApplyProfile(user, identity, profile, options.DefaultCompany);
TryEnsureRemoteDesktopGroupMembership(user);
TryApplyProfile(user, identity, profile, options.DefaultCompany, logger);
TryEnsureRemoteDesktopGroupMembership(user, identity.UserName);
return new DirectorySyncResult(
options.DomainNetbios,
@@ -120,7 +139,8 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
DirectoryEntry user,
UserIdentity identity,
InstitutionalProfile? profile,
string defaultCompany)
string defaultCompany,
ILogger logger)
{
try
{
@@ -146,10 +166,15 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
user.CommitChanges();
}
catch
catch (Exception exception)
{
// Metadata is intentionally best-effort. User creation, password sync,
// and account enablement have already committed successfully.
logger.LogWarning(
BrokerEventIds.DirectoryOptionalMetadataFailure,
exception,
"Optional Active Directory profile metadata could not be committed for {InstitutionalUser}; password synchronization remains completed.",
identity.UserName);
try
{
user.RefreshCache();
@@ -170,7 +195,7 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
}
}
private void TryEnsureRemoteDesktopGroupMembership(DirectoryEntry user)
private void TryEnsureRemoteDesktopGroupMembership(DirectoryEntry user, string institutionalUser)
{
if (string.IsNullOrWhiteSpace(options.RemoteDesktopGroupDn))
{
@@ -194,10 +219,15 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
group.CommitChanges();
}
}
catch
catch (Exception exception)
{
// Remote access is lab policy and must not invalidate a completed
// password synchronization if the optional group is unavailable.
logger.LogWarning(
BrokerEventIds.DirectoryGroupMembershipFailure,
exception,
"Optional remote-desktop group membership could not be updated for {InstitutionalUser}; password synchronization remains completed.",
institutionalUser);
}
}