Add SGU credential provider and authentication broker

2026-08-31 17:48:18 -06:00
parent 5e216f42a4
commit 1f43f200b4
50 changed files with 3226 additions and 236 deletions
@@ -0,0 +1,37 @@
+# Toolchain
+
+## Development host
+
+- Windows 11 with Hyper-V.
+- Visual Studio 2026 with `.vsconfig` workloads.
+- .NET SDK 10.0.400 or a compatible later 10.0 feature band.
+- Windows 11 SDK 10.0.28000.
+- MSVC x64/x86 tools, CMake, Ninja, WinDbg, Git, and PowerShell 7/Windows PowerShell.
+
+The SGU additions are C#, but the repository keeps the upstream native/COM
+interop source and benefits from the full Windows desktop toolchain.
+
+## Windows Server target
+
+The broker is published self-contained for `win-x64`. It requires:
+
+- Windows Server 2025 or supported Windows Server with AD management APIs.
+- An HTTPS server certificate in `LocalMachine\My`.
+- Trusted and allow-listed client certificates.
+- Delegated AD rights for `OU=Usuarios-SGU` and its managed child OUs.
+- Network access to the configured HTTPS NTLM endpoint.
+
+## Windows client target
+
+- Windows 10 22H2 for the lab; Windows 11 is the production target.
+- Latest .NET 10 x64 runtime. Managed COM hosting cannot be self-contained.
+- Client certificate with non-exportable private key in `LocalMachine\My`.
+- Trust for the broker certificate or issuing CA.
+- Domain membership and DNS resolution for the broker.
+
+No Visual Studio, compiler, SDK, PowerShell module, or source tree is required on
+the target client.
+
+For an isolated target, download the current `Microsoft.DotNet.Runtime.10`
+offline installer on the development host, verify its publisher/signature, stage
+it with the provider, and pass its path to `Install-CredentialProvider.ps1`.