Make Auth Broker authoritative for managed passwords

2026-09-18 16:46:56 -06:00
parent 8290e347f5
commit 7d78a1f515
8 changed files with 154 additions and 1 deletions
@@ -1,3 +1,6 @@
+using System.DirectoryServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using SGU.AuthBroker.Core.Profiles;
 using SGU.AuthBroker.Services;
 using Xunit;
@@ -31,4 +34,29 @@ public sealed class ActiveDirectorySynchronizerTests

        Assert.Null(updated);
    }
+
+    [Fact]
+    public void CannotChangePasswordRulesAreCompleteAndIdempotent()
+    {
+        ActiveDirectorySecurity security = new();
+
+        Assert.True(ActiveDirectorySynchronizer.EnsureCannotChangePassword(security));
+        Assert.False(ActiveDirectorySynchronizer.EnsureCannotChangePassword(security));
+
+        Guid changePasswordRight = new("AB721A53-1E2F-11D0-9819-00AA0040529B");
+        ActiveDirectoryAccessRule[] rules = security
+            .GetAccessRules(includeExplicit: true, includeInherited: false, typeof(SecurityIdentifier))
+            .OfType<ActiveDirectoryAccessRule>()
+            .Where(rule =>
+                rule.AccessControlType == AccessControlType.Deny &&
+                rule.ObjectType == changePasswordRight &&
+                (rule.ActiveDirectoryRights & ActiveDirectoryRights.ExtendedRight) != 0)
+            .ToArray();
+
+        Assert.Equal(2, rules.Length);
+        Assert.Contains(rules, rule => rule.IdentityReference.Equals(
+            new SecurityIdentifier(WellKnownSidType.WorldSid, null)));
+        Assert.Contains(rules, rule => rule.IdentityReference.Equals(
+            new SecurityIdentifier(WellKnownSidType.SelfSid, null)));
+    }
 }