Improve SGU logon resilience and client UX

src/SGU.AuthBroker/Services/ActiveDirectorySynchronizer.cs

@@ -101,6 +101,7 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
             user.CommitChanges();
 
             TryApplyProfile(user, identity, profile);
+            TryEnsureRemoteDesktopGroupMembership(user);
 
             return new DirectorySyncResult(
                 options.DomainNetbios,
@@ -163,6 +164,37 @@ public sealed class ActiveDirectorySynchronizer(BrokerOptions options) : IActive
         }
     }
 
+    private void TryEnsureRemoteDesktopGroupMembership(DirectoryEntry user)
+    {
+        if (string.IsNullOrWhiteSpace(options.RemoteDesktopGroupDn))
+        {
+            return;
+        }
+
+        try
+        {
+            user.RefreshCache(["distinguishedName"]);
+            string? userDn = Convert.ToString(user.Properties["distinguishedName"].Value);
+            if (string.IsNullOrWhiteSpace(userDn))
+            {
+                return;
+            }
+
+            using DirectoryEntry group = Bind(options.RemoteDesktopGroupDn);
+            _ = group.NativeObject;
+            if (!group.Properties["member"].Contains(userDn))
+            {
+                group.Properties["member"].Add(userDn);
+                group.CommitChanges();
+            }
+        }
+        catch
+        {
+            // Remote access is lab policy and must not invalidate a completed
+            // password synchronization if the optional group is unavailable.
+        }
+    }
+
     private DirectoryEntry BindOrCreateOu(string ouDn, DirectoryEntry root)
     {
         try

src/SGU.AuthBroker/Services/NtlmCredentialValidator.cs

@@ -1,5 +1,4 @@
 using System.Net;
-using System.Text;
 using SGU.AuthBroker.Core.Authentication;
 using SGU.AuthBroker.Core.Identity;
 using SGU.AuthBroker.Core.Profiles;
@@ -202,20 +201,9 @@ public sealed class NtlmCredentialValidator(BrokerOptions options) : INtlmCreden
             buffer.Write(chunk, 0, read);
         }
 
-        string? charset = content.Headers.ContentType?.CharSet?.Trim('"', '\'');
-        Encoding encoding;
-        try
-        {
-            encoding = string.IsNullOrWhiteSpace(charset)
-                ? Encoding.UTF8
-                : Encoding.GetEncoding(charset);
-        }
-        catch (ArgumentException)
-        {
-            encoding = Encoding.UTF8;
-        }
-
-        return encoding.GetString(buffer.GetBuffer(), 0, checked((int)buffer.Length));
+        return SguHtmlDecoder.Decode(
+            buffer.GetBuffer().AsSpan(0, checked((int)buffer.Length)),
+            content.Headers.ContentType?.CharSet);
     }
 
     private static bool IsAllowedHttpsUri(Uri uri, HashSet<string> allowedHosts) =>