Enrich administrative profiles from SGU

docs/architecture.md

@@ -25,8 +25,12 @@ returns the NTLM challenge without waiting for the slow application pages. A
 `401` or `403` rejects the credential; an allowed `2xx` or `3xx` proves that IIS
 accepted it. The broker then makes a separately bounded, best-effort GET to the
 administrative incident overview for `AD`, the student information page for
-`AL`, or the portal menu for `DO`. A profile timeout does not invalidate an
-already authenticated credential. NTLM may still require its normal
+`AL`, or the portal menu for `DO`. After the incident page confirms an `AD`
+employee number, two additional GETs in the same in-memory session read the
+structured name from `datos/personales.aspx` and the address from
+`datos/ubicacion.aspx`. A supplemental failure preserves fields already
+collected, and a profile timeout does not invalidate an already authenticated
+credential. NTLM may still require its normal
 challenge/response round trips on the connection. Transient portal cookies are
 kept only in an in-memory per-request container and are never persisted or
 returned to the client.
@@ -54,8 +58,9 @@ When the authenticated HTML exposes recognized stable IDs, the broker also
 updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
 `department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and
 `postalCode` attributes. Administrative and student numbers must match the six
-numeric digits of the requested identity before any scraped metadata is
-trusted. Student faculty/department is deliberately left unset because the
+numeric digits of the requested identity before any role-specific metadata is
+trusted. Administrative personal and location pages are accepted only after
+that incident-page match. Student faculty/department is deliberately left unset because the
 verified page does not expose it. Missing metadata does not clear existing AD
 values and never changes the password outcome.
 

docs/broker-operations.md

@@ -46,13 +46,14 @@ Eso es comportamiento esperado, no una caída del servicio.
 
 ## Timeouts y recuperación
 
-- El Credential Provider espera hasta **35 segundos** por el broker.
+- El Credential Provider espera hasta **90 segundos** por el broker.
 - El broker permite hasta **20 segundos** para el desafío NTLM ligero de
-  `/psulsa/` y hasta **10 segundos totales** adicionales para enriquecer el
-  perfil. La consulta de perfil es best effort: si la página pesada queda
-  congelada después de que NTLM aceptó la contraseña, el usuario se sincroniza
-  sin metadatos y puede iniciar sesión. El máximo combinado queda por debajo de
-  los 35 segundos del cliente.
+  `/psulsa/`. El enriquecimiento usa el límite total independiente
+  `ProfileTimeoutSeconds` —**90 segundos** en la configuración del laboratorio—
+  y conserva los campos que alcance a obtener si una página administrativa se
+  retrasa o falla. El Credential Provider mantiene su propio límite de **90
+  segundos**: si SGU excede ese presupuesto, Windows continúa por el fallback
+  normal de AD o credenciales de dominio en caché.
 - El instalador configura recuperación del servicio con reinicios a los 5, 15
   y 60 segundos y reinicia el contador de fallos después de 24 horas.
 - Si el broker o SGU no está disponible, el Credential Provider entrega la

docs/security.md

@@ -30,8 +30,14 @@
 
 ## Profile minimization
 
-- Administrative enrichment reads only employee number, display name,
-  employee type/status, email, job title, and department from known element IDs.
+- Administrative enrichment first verifies the employee number and reads
+  employee type/status, email, job title, and department from the incident
+  overview. Only after that match, it reads given names and paternal/maternal
+  surnames from the personal page plus street, exterior/interior number,
+  neighborhood, locality, state, and postal code from the location page.
+- Administrative birth date, RFC, CURP, sex, blood type, marital status,
+  nationality, telephone, email lists, housing type, and emergency-contact
+  fields are ignored.
 - Student enrichment reads only the matching student number, given names,
   paternal/maternal surnames, email, career, street, neighborhood,
   city/municipality, state, and postal code from known element IDs.
@@ -40,11 +46,13 @@
 - Incident details, calendars, photographs, manager names, and manager positions
   are deliberately ignored.
 - The employee or student number must match the authenticated `AD` or `AL` key
-  before metadata is synchronized.
+  before role-specific metadata is synchronized. The two supplemental
+  administrative pages are never requested unless the incident page supplied
+  the matching employee number.
 - If SGU changes its HTML, authentication and exact-password synchronization
   continue without enrichment; existing AD metadata is not erased.
 - Slow profile pages cannot change an accepted credential into a rejection. The
-  lightweight NTLM root is authoritative; enrichment has its own shorter total
+  lightweight NTLM root is authoritative; enrichment has its own independent total
   timeout.
 
 Lab self-signed certificates are appropriate only for the isolated VM network.