Classify SGU accounts into AD role groups

2026-09-08 11:33:02 -06:00
parent 0a2dbbeb93
commit 7a4f599f55
11 changed files with 153 additions and 5 deletions
@@ -1,4 +1,5 @@
 using SGU.AuthBroker.Options;
+using SGU.AuthBroker.Core.Identity;
 using Xunit;

 namespace SGU.AuthBroker.Tests;
@@ -28,4 +29,31 @@ public sealed class BrokerOptionsTests

        Assert.Contains("thumbprint", exception.Message, StringComparison.OrdinalIgnoreCase);
    }
+
+    [Theory]
+    [InlineData(InstitutionalRole.Student, "CN=SGU-Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
+    [InlineData(InstitutionalRole.Administrative, "CN=SGU-Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
+    [InlineData(InstitutionalRole.Professor, "CN=SGU-Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
+    public void DefaultRoleGroupMappingsMatchInstitutionalPrefixes(InstitutionalRole role, string expectedGroupDn)
+    {
+        ActiveDirectoryOptions options = new();
+
+        Assert.Equal(expectedGroupDn, options.GetGroupDn(role));
+    }
+
+    [Fact]
+    public void ValidateRejectsARoleGroupOutsideTheConfiguredDirectoryBase()
+    {
+        BrokerOptions options = new()
+        {
+            Directory = new ActiveDirectoryOptions
+            {
+                StudentGroupDn = "CN=SGU-Alumnos,DC=example,DC=invalid"
+            }
+        };
+
+        InvalidOperationException exception = Assert.Throws<InvalidOperationException>(options.Validate);
+
+        Assert.Contains("security-group", exception.Message, StringComparison.OrdinalIgnoreCase);
+    }
 }