Make Auth Broker authoritative for managed passwords

docs/architecture.md

@@ -62,6 +62,15 @@ plus six digits. It searches `BaseDn` by `sAMAccountName`, creates the user when
 absent, moves it to the mapped OU when required, sets `userPrincipalName`, and
 passes the submitted password directly to ADSI `SetPassword`.
 
+Before an account becomes usable, the broker applies explicit deny ACEs for the
+Active Directory `Change Password` extended right to SELF and Everyone. Users
+beneath `OU=Usuarios-SGU` therefore cannot replace the synchronized password
+from Windows, Ctrl+Alt+Delete, LDAP or another client. The broker's
+administrative `SetPassword` operation uses the separate `Reset Password` right
+and remains able to synchronize the current institutional credential after each
+successful SGU authentication. Repeated synchronizations detect the existing
+ACEs and do not duplicate them.
+
 When the authenticated HTML exposes recognized stable IDs, the broker also
 updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
 `department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and

docs/release-0.6.8.md

@@ -0,0 +1,17 @@
+# SGU Credential Provider 0.6.8
+
+Esta versión declara al Auth Broker como la única autoridad de contraseñas para
+todas las cuentas administradas bajo `OU=Usuarios-SGU`.
+
+- Cada creación, movimiento o actualización de una cuenta agrega de forma
+  idempotente las denegaciones SELF y Everyone para el derecho extendido de
+  Active Directory `Change Password`.
+- El usuario no puede cambiar la contraseña desde Windows, Ctrl+Alt+Delete,
+  LDAP ni herramientas equivalentes.
+- El broker conserva el derecho administrativo separado `Reset Password` y
+  continúa sincronizando la contraseña institucional exacta mediante
+  `SetPassword` después de una autenticación SGU válida.
+- El despliegue del broker recorre todas las cuentas existentes en
+  `Usuarios-SGU` y corrige aquellas que todavía permiten cambios directos.
+
+No se modifica la contraseña institucional ni se almacena una copia adicional.

docs/security.md

@@ -18,6 +18,9 @@ the same source list. RDP uses a separate allowlist. See
   `Marshal.ZeroFreeGlobalAllocUnicode`; managed references are released as soon
   as each request completes.
 - The broker uses the exact received value for both NTLM and AD `SetPassword`.
+- Managed `Usuarios-SGU` accounts deny the SELF and Everyone `Change Password`
+  extended right. Only an administrator or the broker through the separate
+  `Reset Password` right can replace the AD password.
 - There is no HMAC password, pepper, local password cache, Supabase password, or
   other derived credential in this Windows path.
 - Neither application logs request bodies or passwords. Deployment configuration