Improve SGU logon resilience and client UX

2026-09-01 10:37:40 -06:00
parent 3d0897316d
commit da01343985
27 changed files with 869 additions and 37 deletions
@@ -52,6 +52,12 @@ infrastructure:
  to Windows. Windows must still validate it against AD or the cached domain
  verifier, so this does not grant access without the last synchronized password.

+Redis is deliberately not used for password continuity. A second persistent
+password verifier duplicates attackable credential material, while a reversible
+encrypted password becomes a credential vault. AD and Windows cached domain
+logon already implement the required last-known-password behavior. See
+[`decisions/0001-no-password-cache.md`](decisions/0001-no-password-cache.md).
+
 The installer never registers a Credential Provider filter and never disables
 Microsoft's password, PIN, smart-card, or Windows Hello providers.