Improve SGU logon resilience and client UX

src/SGU.AuthBroker/Options/BrokerOptions.cs

@@ -78,6 +78,13 @@ public sealed class BrokerOptions
                 throw new InvalidOperationException($"The OU mapping for {role} must be beneath BaseDn.");
             }
         }
+
+        if (!string.IsNullOrWhiteSpace(Directory.RemoteDesktopGroupDn) &&
+            (!Directory.RemoteDesktopGroupDn.StartsWith("CN=", StringComparison.OrdinalIgnoreCase) ||
+             !Directory.RemoteDesktopGroupDn.EndsWith($",{Directory.BaseDn}", StringComparison.OrdinalIgnoreCase)))
+        {
+            throw new InvalidOperationException("RemoteDesktopGroupDn must identify a group beneath BaseDn.");
+        }
     }
 
     private static bool IsCertificateThumbprint(string value)
@@ -130,6 +137,8 @@ public sealed class ActiveDirectoryOptions
 
     public string AdministrativeOuDn { get; init; } = "OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx";
 
+    public string RemoteDesktopGroupDn { get; init; } = string.Empty;
+
     public bool CreateMissingOus { get; init; }
 
     public string GetOuDn(InstitutionalRole role) => role switch