Add branded default provider and enforced enrollment

2026-09-01 11:20:06 -06:00
parent da01343985
commit f3afd62993
22 changed files with 787 additions and 17 deletions
@@ -0,0 +1,67 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)]
+    [string]$CertificatePath,
+    [string]$BrokerConfigurationPath = 'C:\Program Files\SGU\AuthBroker\appsettings.Production.json'
+)
+
+$ErrorActionPreference = 'Stop'
+$serviceName = 'SGUAuthBroker'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated PowerShell session on the broker server.'
+}
+
+if (-not (Test-Path -LiteralPath $CertificatePath -PathType Leaf)) {
+    throw 'CertificatePath does not exist.'
+}
+if (-not (Test-Path -LiteralPath $BrokerConfigurationPath -PathType Leaf)) {
+    throw 'The broker production configuration does not exist.'
+}
+
+$candidate = [Security.Cryptography.X509Certificates.X509Certificate2]::new($CertificatePath)
+if ($candidate.NotBefore -gt (Get-Date) -or $candidate.NotAfter -lt (Get-Date)) {
+    throw 'The client certificate is outside its validity period.'
+}
+$clientAuthenticationOid = '1.3.6.1.5.5.7.3.2'
+$ekuExtension = $candidate.Extensions |
+    Where-Object { $_.Oid.Value -eq '2.5.29.37' } |
+    Select-Object -First 1
+if (-not $ekuExtension -or
+    $ekuExtension.EnhancedKeyUsages.Value -notcontains $clientAuthenticationOid) {
+    throw 'The certificate is not valid for TLS client authentication.'
+}
+
+if ($PSCmdlet.ShouldProcess($candidate.Thumbprint, 'Trust and allow the SGU client certificate')) {
+    $trustedCertificate = Import-Certificate `
+        -FilePath $CertificatePath `
+        -CertStoreLocation Cert:\LocalMachine\Root |
+        Select-Object -First 1
+
+    $configuration = Get-Content -LiteralPath $BrokerConfigurationPath -Raw | ConvertFrom-Json
+    $allowed = @($configuration.Broker.Tls.AllowedClientThumbprints |
+        ForEach-Object { $_ -replace ' ', '' })
+    if ($allowed -notcontains $trustedCertificate.Thumbprint) {
+        $configuration.Broker.Tls.AllowedClientThumbprints = @($allowed + $trustedCertificate.Thumbprint)
+        $backupPath = "$BrokerConfigurationPath.before-$($trustedCertificate.Thumbprint.Substring(0, 12)).bak"
+        Copy-Item -LiteralPath $BrokerConfigurationPath -Destination $backupPath -Force
+        [IO.File]::WriteAllText(
+            $BrokerConfigurationPath,
+            ($configuration | ConvertTo-Json -Depth 8),
+            [Text.UTF8Encoding]::new($false))
+    }
+
+    Restart-Service -Name $serviceName -Force
+    (Get-Service -Name $serviceName).WaitForStatus(
+        [System.ServiceProcess.ServiceControllerStatus]::Running,
+        [TimeSpan]::FromSeconds(20))
+}
+
+[pscustomobject]@{
+    Subject = $candidate.Subject
+    Thumbprint = $candidate.Thumbprint
+    NotAfter = $candidate.NotAfter
+    Allowed = @((Get-Content -LiteralPath $BrokerConfigurationPath -Raw | ConvertFrom-Json).Broker.Tls.AllowedClientThumbprints) -contains $candidate.Thumbprint
+    ServiceStatus = (Get-Service -Name $serviceName).Status
+}