Add SGU credential provider and authentication broker

2026-08-31 17:48:18 -06:00
parent 5e216f42a4
commit 1f43f200b4
50 changed files with 3226 additions and 236 deletions
@@ -0,0 +1,99 @@
+using SGU.AuthBroker.Core.Authentication;
+using SGU.AuthBroker.Core.Directory;
+using SGU.AuthBroker.Core.Identity;
+using Xunit;
+
+namespace SGU.AuthBroker.Core.Tests;
+
+public sealed class AuthenticationWorkflowTests
+{
+    [Fact]
+    public async Task PassesTheExactOriginalPasswordToNtlmAndActiveDirectory()
+    {
+        const string original = "Árbol-Exacto-🔐-NoDerivar-27!";
+        CapturingNtlmValidator ntlm = new(NtlmValidationResult.Valid());
+        CapturingDirectorySynchronizer directory = new();
+        AuthenticationWorkflow workflow = new(ntlm, directory);
+
+        AuthenticationFlowResult result = await workflow.AuthenticateAsync(
+            "do123456",
+            original,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(AuthenticationFlowOutcome.Authorized, result.Outcome);
+        Assert.Same(original, ntlm.Password);
+        Assert.Same(original, directory.Password);
+        Assert.Equal("DO123456", ntlm.UserName);
+        Assert.Equal(InstitutionalRole.Professor, directory.Identity?.Role);
+    }
+
+    [Fact]
+    public async Task InvalidNtlmCredentialsNeverReachActiveDirectory()
+    {
+        CapturingDirectorySynchronizer directory = new();
+        AuthenticationWorkflow workflow = new(
+            new CapturingNtlmValidator(NtlmValidationResult.Invalid()),
+            directory);
+
+        AuthenticationFlowResult result = await workflow.AuthenticateAsync(
+            "AL123456",
+            "Wrong",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(AuthenticationFlowOutcome.InvalidCredentials, result.Outcome);
+        Assert.Null(directory.Password);
+    }
+
+    [Fact]
+    public async Task NtlmOutageIsReportedAsUnavailableForProviderFallback()
+    {
+        CapturingDirectorySynchronizer directory = new();
+        AuthenticationWorkflow workflow = new(
+            new CapturingNtlmValidator(NtlmValidationResult.Unavailable()),
+            directory);
+
+        AuthenticationFlowResult result = await workflow.AuthenticateAsync(
+            "AD123456",
+            "LastKnownPassword",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(AuthenticationFlowOutcome.Unavailable, result.Outcome);
+        Assert.Null(directory.Password);
+    }
+
+    private sealed class CapturingNtlmValidator(NtlmValidationResult result) : INtlmCredentialValidator
+    {
+        public string? UserName { get; private set; }
+
+        public string? Password { get; private set; }
+
+        public Task<NtlmValidationResult> ValidateAsync(string userName, string password, CancellationToken cancellationToken)
+        {
+            UserName = userName;
+            Password = password;
+            return Task.FromResult(result);
+        }
+    }
+
+    private sealed class CapturingDirectorySynchronizer : IActiveDirectorySynchronizer
+    {
+        public UserIdentity? Identity { get; private set; }
+
+        public string? Password { get; private set; }
+
+        public Task<DirectorySyncResult> SynchronizeAsync(
+            UserIdentity identity,
+            string password,
+            CancellationToken cancellationToken)
+        {
+            Identity = identity;
+            Password = password;
+            return Task.FromResult(new DirectorySyncResult(
+                "LCI",
+                identity.UserName,
+                $"{identity.UserName}@lci.lasalle.mx",
+                true,
+                false));
+        }
+    }
+}