Place SGU role groups in their user OUs

scripts/Deploy-AuthBroker.ps1

@@ -76,16 +76,23 @@ if (-not $serverCertificate.Verify()) {
 }
 
 Import-Module ActiveDirectory -ErrorAction Stop
+
+function ConvertTo-LdapFilterValue {
+    param([Parameter(Mandatory)][string]$Value)
+
+    return $Value.Replace('\', '\5c').Replace('*', '\2a').Replace('(', '\28').Replace(')', '\29').Replace(([string][char]0), '\00')
+}
+
 $usersOuName = 'Usuarios-SGU'
 $usersOuDn = "OU=$usersOuName,$BaseDn"
 if ([string]::IsNullOrWhiteSpace($ProfessorGroupDn)) {
-    $ProfessorGroupDn = "CN=SGU-Docentes,$usersOuDn"
+    $ProfessorGroupDn = "CN=SGU-Docentes,OU=Docentes,$usersOuDn"
 }
 if ([string]::IsNullOrWhiteSpace($StudentGroupDn)) {
-    $StudentGroupDn = "CN=SGU-Alumnos,$usersOuDn"
+    $StudentGroupDn = "CN=SGU-Alumnos,OU=Alumnos,$usersOuDn"
 }
 if ([string]::IsNullOrWhiteSpace($AdministrativeGroupDn)) {
-    $AdministrativeGroupDn = "CN=SGU-Administrativos,$usersOuDn"
+    $AdministrativeGroupDn = "CN=SGU-Administrativos,OU=Administrativos,$usersOuDn"
 }
 
 if ($CreateMissingOus) {
@@ -152,13 +159,30 @@ foreach ($definition in $roleGroupDefinitions) {
             throw "$($definition.Role)GroupDn must start with a simple CN component."
         }
         $groupName = $groupDnMatch.Groups['Name'].Value
+        $groupPath = $groupDnMatch.Groups['Path'].Value
         if ($groupName.Length -gt 20) {
             throw "$($definition.Role) group name exceeds the 20-character sAMAccountName limit."
         }
-        New-ADGroup -Name $groupName -SamAccountName $groupName `
-            -GroupCategory Security -GroupScope Global `
-            -Path $groupDnMatch.Groups['Path'].Value `
-            -Description $definition.Description -Server $LdapHost | Out-Null
+
+        $matchingGroups = @(Get-ADGroup `
+            -LDAPFilter "(sAMAccountName=$(ConvertTo-LdapFilterValue -Value $groupName))" `
+            -SearchBase $BaseDn -SearchScope Subtree -Server $LdapHost -ErrorAction Stop)
+        if ($matchingGroups.Count -gt 1) {
+            throw "More than one Active Directory group uses sAMAccountName $groupName; the bootstrap cannot select one safely."
+        }
+        if ($matchingGroups.Count -eq 1) {
+            if ($matchingGroups[0].GroupCategory -ne 'Security') {
+                throw "$($definition.Role)GroupDn must identify a security group."
+            }
+            Move-ADObject -Identity $matchingGroups[0].DistinguishedName `
+                -TargetPath $groupPath -Server $LdapHost -Confirm:$false -ErrorAction Stop
+        }
+        else {
+            New-ADGroup -Name $groupName -SamAccountName $groupName `
+                -GroupCategory Security -GroupScope Global `
+                -Path $groupPath `
+                -Description $definition.Description -Server $LdapHost | Out-Null
+        }
         $roleGroup = Get-ADGroup -Identity $definition.Dn -Server $LdapHost -ErrorAction Stop
     }
     if (-not $roleGroup) {