Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 alexrg
|
8baa47fe1e | ||
|
alexrg
|
a24c25a3fb | ||
|
alexrg
|
991fc70600 | ||
|
alexrg
|
93871b62b0 | ||
|
alexrg
|
1fe2006404 | ||
|
alexrg
|
7a4f599f55 |
@@ -55,11 +55,11 @@ Operational documentation:
|
||||
- [Domain monitoring, usage reports, and six-month retention](docs/monitoring.md)
|
||||
- [Decision: do not persist password verifiers in Redis](docs/decisions/0001-no-password-cache.md)
|
||||
|
||||
| Prefix | Role | Default OU |
|
||||
|---|---|---|
|
||||
| `DO` | Professor / docente | `OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx` |
|
||||
| `AL` | Student / alumno | `OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx` |
|
||||
| `AD` | Administrative | `OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx` |
|
||||
| Prefix | Role | Default OU | Security group in the same OU |
|
||||
|---|---|---|---|
|
||||
| `DO` | Professor / docente | `OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx` | `SGU-Docentes` |
|
||||
| `AL` | Student / alumno | `OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx` | `SGU-Alumnos` |
|
||||
| `AD` | Administrative | `OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx` | `SGU-Administrativos` |
|
||||
|
||||
If the broker or institutional NTLM authority is unavailable, the provider
|
||||
submits the unchanged credentials to Windows for normal AD/cached-domain
|
||||
@@ -97,6 +97,9 @@ the latest .NET 10 x64 runtime. The broker is published self-contained.
|
||||
Follow [docs/lab-runbook.md](docs/lab-runbook.md). Review
|
||||
[docs/security.md](docs/security.md) before production deployment and
|
||||
[docs/architecture.md](docs/architecture.md) for the component contract.
|
||||
For a public Azure VM connected to local Hyper-V clients through Azure VPN
|
||||
Gateway, use [docs/azure-vpn-deployment.md](docs/azure-vpn-deployment.md). AD
|
||||
ports remain private even though the VM owns a public IP.
|
||||
|
||||
Never disable the built-in Microsoft password Credential Provider. It is the
|
||||
supported recovery path if a third-party provider fails to load.
|
||||
|
||||
+19
-3
@@ -27,8 +27,8 @@ accepted it. The broker then makes separately bounded, best-effort profile GETs.
|
||||
It uses the administrative incident overview for `AD`, the student information
|
||||
page for `AL`, and the portal menu as a conservative base for `DO`. After the
|
||||
incident page confirms an `AD` employee number, two additional GETs in the same
|
||||
in-memory session read the structured name from `datos/personales.aspx` and the
|
||||
address from `datos/ubicacion.aspx`. Docentes request
|
||||
in-memory session read the structured name and selected sex from
|
||||
`datos/personales.aspx` and the address from `datos/ubicacion.aspx`. Docentes request
|
||||
`nomina/consultanomina.aspx` for a matching employee number, email, employee
|
||||
type and job title, then attempt the same two shared staff modules without
|
||||
requiring any optional route to exist. A supplemental
|
||||
@@ -61,7 +61,9 @@ passes the submitted password directly to ADSI `SetPassword`.
|
||||
When the authenticated HTML exposes recognized stable IDs, the broker also
|
||||
updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
|
||||
`department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and
|
||||
`postalCode` attributes. Administrative and student numbers must match the six
|
||||
`postalCode` attributes. The SGU sex value is normalized to `Male`/`Female` and
|
||||
written as the managed `SGU-Gender:` line in the built-in `info` attribute while
|
||||
preserving unrelated notes. Administrative and student numbers must match the six
|
||||
numeric digits of the requested identity before any role-specific metadata is
|
||||
trusted. Administrative personal and location pages are accepted only after
|
||||
that incident-page match. Docente payroll metadata must match the requested
|
||||
@@ -72,6 +74,17 @@ is deliberately left unset because the verified page does not expose it.
|
||||
Missing metadata does not clear existing AD values and never changes the
|
||||
password outcome.
|
||||
|
||||
Every synchronization also enforces one idempotent security-group membership
|
||||
from the classified institutional prefix: `AL` to `SGU-Alumnos`, `AD` to
|
||||
`SGU-Administrativos`, and `DO` to `SGU-Docentes`. Each role group is stored
|
||||
inside its corresponding user OU. During an upgrade,
|
||||
the bootstrap moves a legacy group from the `Usuarios-SGU` root while preserving
|
||||
its SID and memberships instead of creating a duplicate. Membership enforcement
|
||||
happens synchronously inside the broker before the institutional password is written to AD. A missing
|
||||
or inaccessible role group therefore fails provisioning instead of leaving a
|
||||
new usable account without its authorization classification. Existing accounts
|
||||
are repaired automatically on their next successful SGU authentication.
|
||||
|
||||
Human-readable SGU values are decoded with BOM/header/meta detection, strict
|
||||
UTF-8 validation, and a Windows-1252 fallback for the legacy portal. Names and
|
||||
titles are normalized with Spanish-aware casing; particles such as `de`, `del`
|
||||
@@ -110,6 +123,9 @@ settings for managed clients.
|
||||
|
||||
That computer GPO also owns the base lock-screen image and a per-logon command
|
||||
for the personalized desktop wallpaper. The client-side renderer reads the
|
||||
managed `SGU-Gender: Male|Female` line from the user's built-in `info` attribute
|
||||
(without requiring an irreversible AD schema extension). It uses neutral Spanish
|
||||
when that optional enrichment is unavailable. The renderer also reads the
|
||||
authenticated user's `displayName` plus the computer object's `location` and
|
||||
immediate parent OU, then composes those values over the bundled dark-blue
|
||||
background with the bundled Indivisa fonts. Missing directory attributes degrade
|
||||
|
||||
@@ -0,0 +1,179 @@
|
||||
# Active Directory SGU en Azure con VPN Point-to-Site
|
||||
|
||||
Esta variante conserva Active Directory en una VM Windows Server 2025 con IP
|
||||
pública de Azure, pero **no publica Active Directory en Internet**. La IP pública
|
||||
sirve para el ciclo de vida y, opcionalmente, RDP desde un único CIDR
|
||||
administrativo. DNS, Kerberos, LDAP, SMB, RPC, WinRM, Auth Broker, monitoreo y
|
||||
RustDesk viajan por Azure VPN Gateway Point-to-Site (P2S).
|
||||
|
||||
La plantilla crea:
|
||||
|
||||
- VNet `10.77.0.0/16`, subnet del DC `10.77.0.0/24` y `GatewaySubnet`;
|
||||
- Windows Server 2025 con IP privada estática `10.77.0.4` reservada en la NIC;
|
||||
- IP pública Standard para la VM, protegida por NSG;
|
||||
- VPN Gateway `VpnGw1` con IKEv2/SSTP y autenticación por certificados;
|
||||
- pool P2S `172.30.0.0/24`, autorizado en los firewalls SGU;
|
||||
- DNS de la NIC del servidor apuntando a `10.77.0.4`.
|
||||
|
||||
Los prefijos son parámetros. Deben ser RFC1918 y no deben solaparse con las
|
||||
redes usadas por Hyper-V, el `Default Switch`, Wi-Fi o Ethernet locales.
|
||||
|
||||
## 1. Crear la autoridad P2S y el certificado de administración
|
||||
|
||||
En la estación administrativa donde está el repositorio:
|
||||
|
||||
```powershell
|
||||
$p2s = .\scripts\New-SguAzureP2sCertificates.ps1 `
|
||||
-ClientName 'AdminWorkstation'
|
||||
```
|
||||
|
||||
Se pide una contraseña para proteger el PFX. La clave privada de la autoridad
|
||||
raíz permanece no exportable en `Cert:\CurrentUser\My`; Azure recibe solamente
|
||||
el `.cer` público. El PFX es una credencial de acceso a la VNet: se debe copiar
|
||||
únicamente a la VM correspondiente y eliminarse de ubicaciones compartidas
|
||||
después de importarlo.
|
||||
|
||||
## 2. Desplegar Azure
|
||||
|
||||
Requisitos: Azure CLI, una sesión iniciada con `az login`, permisos para crear
|
||||
red, gateway, IP pública y VM, y una suscripción seleccionable.
|
||||
|
||||
```powershell
|
||||
$azure = .\scripts\Deploy-SguAzureInfrastructure.ps1 `
|
||||
-SubscriptionId '00000000-0000-0000-0000-000000000000' `
|
||||
-ResourceGroupName 'rg-sgu-lab' `
|
||||
-Location 'centralus' `
|
||||
-AdministratorUsername 'azureadmin' `
|
||||
-P2sRootCertificatePath $p2s.RootCertificatePath
|
||||
```
|
||||
|
||||
La contraseña local de la VM se solicita como `SecureString`, se coloca sólo en
|
||||
un archivo temporal con ACL exclusiva para el usuario actual y se elimina al
|
||||
terminar. No aparece en los argumentos de Azure CLI ni queda guardada en el
|
||||
repositorio.
|
||||
|
||||
Por omisión ningún puerto administrativo de la VM se abre desde Internet. Para
|
||||
habilitar temporalmente RDP durante el bootstrap, indique exclusivamente su IP
|
||||
pública actual:
|
||||
|
||||
```powershell
|
||||
-AdministratorSourceAddressPrefix '203.0.113.10/32'
|
||||
```
|
||||
|
||||
No utilice `0.0.0.0/0`. El despliegue de un VPN Gateway suele tardar bastante
|
||||
más que la VM; el comando espera hasta que Azure entregue un resultado final.
|
||||
|
||||
## 3. Descargar P2S y entrar por la IP privada
|
||||
|
||||
Cuando el gateway esté `Succeeded`:
|
||||
|
||||
```powershell
|
||||
$vpn = .\scripts\Get-SguAzureP2sPackage.ps1 `
|
||||
-SubscriptionId '00000000-0000-0000-0000-000000000000' `
|
||||
-ResourceGroupName 'rg-sgu-lab' `
|
||||
-VpnGatewayName $azure.VpnGatewayName
|
||||
|
||||
.\scripts\Install-SguAzureP2sClient.ps1 `
|
||||
-VpnProfilePackagePath $vpn.PackagePath `
|
||||
-ClientCertificatePfxPath $p2s.ClientCertificatePath `
|
||||
-ClientRootCertificatePath $p2s.RootCertificatePath `
|
||||
-Connect
|
||||
```
|
||||
|
||||
Con el túnel conectado, use RDP contra `10.77.0.4` y habilite la redirección de
|
||||
una unidad local para copiar `sgu-server-bootstrap-VERSION.zip` a la VM. La NIC
|
||||
ya apunta a su futura dirección DNS propia, por lo que la resolución pública no
|
||||
está disponible hasta que el bootstrap instale DNS y sus reenviadores. Así no es
|
||||
necesario abrir 3389 en la IP pública. La opción
|
||||
`AdministratorSourceAddressPrefix` queda como ruta de recuperación temporal,
|
||||
no como el camino normal.
|
||||
|
||||
## 4. Ejecutar el bootstrap dentro de Windows Server
|
||||
|
||||
Descargue y extraiga `sgu-server-bootstrap-VERSION.zip` dentro de la VM. La IP
|
||||
que recibe el bootstrap es la **privada** de la NIC, nunca la pública:
|
||||
|
||||
```bat
|
||||
Start-SguAzureServerBootstrap.cmd 10.77.0.4 172.30.0.0/24
|
||||
```
|
||||
|
||||
El modo `PlatformManaged` comprueba que Azure ya asignó `10.77.0.4/24`, pero no
|
||||
deshabilita DHCP, no reemplaza la ruta predeterminada y no reinicia el adaptador.
|
||||
El DNS de AD publica únicamente la dirección privada. `168.63.129.16` se usa
|
||||
como reenviador DNS de la plataforma Azure.
|
||||
|
||||
Después del reinicio de promoción, verificar:
|
||||
|
||||
```powershell
|
||||
Get-Content C:\ProgramData\SGU\Bootstrap\Server\bootstrap-complete.json
|
||||
Resolve-DnsName _ldap._tcp.dc._msdcs.lci.lasalle.mx -Type SRV -Server 10.77.0.4
|
||||
```
|
||||
|
||||
El JSON debe indicar `NetworkConfigurationMode = PlatformManaged`, el pool P2S
|
||||
en `TrustedClientNetworks` y ambos prefijos en `AllowedRemoteAddresses`.
|
||||
|
||||
## 5. Emitir un certificado y enrolar cada VM Hyper-V
|
||||
|
||||
En la estación administrativa, emita una credencial distinta por equipo:
|
||||
|
||||
```powershell
|
||||
$w11 = .\scripts\New-SguAzureP2sCertificates.ps1 -ClientName 'Windows11'
|
||||
```
|
||||
|
||||
Copie a la VM Windows 11 de Hyper-V:
|
||||
|
||||
- `sgu-client-bootstrap-VERSION.zip` extraído;
|
||||
- `$vpn.PackagePath`;
|
||||
- `$w11.ClientCertificatePath`;
|
||||
- `sgu-azure-p2s-root.cer`.
|
||||
|
||||
Desde la carpeta extraída del bootstrap de cliente, instale P2S y enrole:
|
||||
|
||||
```bat
|
||||
Start-SguAzureClientEnrollment.cmd 10.77.0.4 C:\SGU\sgu-azure-vpn-client.zip C:\SGU\sgu-azure-p2s-Windows11.pfx C:\SGU\sgu-azure-p2s-root.cer
|
||||
```
|
||||
|
||||
En una sola ejecución el comando:
|
||||
|
||||
1. importa el certificado de cliente en `LocalMachine\My` sin dejar la
|
||||
contraseña en disco;
|
||||
2. instala un perfil IKEv2 de todos los usuarios llamado `SGU Azure P2S`;
|
||||
3. agrega la ruta `10.77.0.0/16` y una regla NRPT que envía sólo
|
||||
`.lci.lasalle.mx` al DNS `10.77.0.4`;
|
||||
4. conecta P2S con certificado de máquina;
|
||||
5. registra mTLS, instala SGU/RustDesk y une el equipo al dominio;
|
||||
6. reinicia Windows.
|
||||
|
||||
Si la red local bloquea IKEv2 (UDP 500/4500), el paquete de Azure también
|
||||
incluye un perfil SSTP sobre TCP 443, pero ese fallback todavía requiere
|
||||
instalación manual con el instalador oficial incluido en `WindowsAmd64`.
|
||||
|
||||
Windows 11 Pro admite unión a AD y VPN nativa, pero Microsoft no licencia el
|
||||
**Always On VPN device tunnel** para Pro. Por ello el perfil se instala para
|
||||
todos los usuarios y se puede seleccionar desde el control de red de la
|
||||
pantalla de inicio de sesión; antes del primer logon de una cuenta de dominio,
|
||||
conecte `SGU Azure P2S` allí. Enterprise/Education pueden recibir posteriormente
|
||||
un device tunnel Always On, pero eso no es requisito del enrolamiento SGU.
|
||||
|
||||
Validación dentro del cliente, con la VPN conectada:
|
||||
|
||||
```powershell
|
||||
Get-VpnConnection -Name 'SGU Azure P2S' -AllUserConnection
|
||||
Get-DnsClientNrptRule | Where-Object DisplayName -like 'SGU Azure P2S*'
|
||||
Test-NetConnection 10.77.0.4 -Port 5985
|
||||
Resolve-DnsName _ldap._tcp.dc._msdcs.lci.lasalle.mx -Type SRV
|
||||
nltest.exe /dsgetdc:lci.lasalle.mx
|
||||
```
|
||||
|
||||
## Seguridad y referencias
|
||||
|
||||
No agregue reglas NSG públicas para 53, 88, 135, 389, 445, 464, 636, 3268,
|
||||
3269 ni RPC dinámico. El conjunto de puertos necesario para una unión de dominio
|
||||
es precisamente la razón de encapsularlo en P2S.
|
||||
|
||||
- [Azure VPN Gateway P2S con certificados](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-certificate-gateway)
|
||||
- [Cliente P2S nativo de Windows](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-certificate)
|
||||
- [Instalación de certificados P2S](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert)
|
||||
- [Puertos necesarios para unir un dominio](https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/active-directory-domain-join-troubleshooting-guidance)
|
||||
- [Requisitos de edición de Windows](https://learn.microsoft.com/en-us/windows/security/licensing-and-edition-requirements)
|
||||
- [Limitación de Always On device tunnel](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel)
|
||||
@@ -1,6 +1,6 @@
|
||||
# Recuperación desde cero y alta en una sola ejecución
|
||||
|
||||
Los releases entregan tres ZIP independientes. Cada uno contiene sus binarios,
|
||||
Los releases entregan cuatro ZIP independientes. Cada uno contiene sus binarios,
|
||||
scripts, instalador offline requerido y un manifiesto SHA-256 interno. No contienen
|
||||
contraseñas, claves privadas ni certificados reutilizables.
|
||||
|
||||
@@ -17,6 +17,11 @@ Compatible con Windows Server con Windows PowerShell 5.1. El servidor necesita
|
||||
una interfaz privada para el dominio y, para autenticar contra SGU, salida HTTPS
|
||||
por esa u otra interfaz.
|
||||
|
||||
Cuando el servidor vive en Azure, no se configura la IP dentro del sistema
|
||||
operativo. La NIC reserva la IP privada y se usa el modo `PlatformManaged`; el
|
||||
procedimiento completo, incluidos VPN Gateway y los clientes Hyper-V, está en
|
||||
[azure-vpn-deployment.md](azure-vpn-deployment.md).
|
||||
|
||||
1. Descargar y extraer `sgu-server-bootstrap-VERSION.zip`.
|
||||
2. Abrir el directorio extraído.
|
||||
3. Ejecutar, indicando la IP fija que tendrá el controlador:
|
||||
@@ -186,4 +191,4 @@ la línea de comandos. Para empaquetar recursos institucionales adicionales:
|
||||
-ServerContentPath C:\Preparacion\Packages
|
||||
```
|
||||
|
||||
`SHA256SUMS-VERSION.txt` permite comprobar los tres ZIP antes de usarlos.
|
||||
`SHA256SUMS-VERSION.txt` permite comprobar los cuatro ZIP antes de usarlos.
|
||||
|
||||
@@ -98,6 +98,7 @@ Get-Service SGUAuthBroker
|
||||
Get-NetTCPConnection -LocalPort 8443 -State Listen
|
||||
sc.exe qfailure SGUAuthBroker
|
||||
Get-ADOrganizationalUnit -Filter * -SearchBase 'OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx'
|
||||
Get-ADGroup -Filter 'SamAccountName -like "SGU-*"' -SearchBase 'OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx'
|
||||
```
|
||||
|
||||
## 4. Broker preflight from Windows 10
|
||||
|
||||
+2
-1
@@ -29,7 +29,8 @@ rol, `TraceId`, resultado y tiempo total. Los Event ID estables distinguen:
|
||||
IDs admitidos; `1202` timeout; `1203` excepción; `1204` página opcional no
|
||||
disponible;
|
||||
- `1300` fallo de sincronización AD; `1301` metadatos opcionales no aplicados;
|
||||
`1302` membresía RDP opcional no aplicada.
|
||||
`1302` membresía RDP opcional no aplicada; `1303` cuenta agregada a su grupo
|
||||
institucional de Alumnos, Administrativos o Docentes.
|
||||
|
||||
No se almacena HTML, contraseña, hash de contraseña ni contenido de la
|
||||
respuesta SGU.
|
||||
|
||||
+17
-5
@@ -1,5 +1,14 @@
|
||||
# Security model
|
||||
|
||||
## Public Azure deployment
|
||||
|
||||
Owning a public Azure IP does not make the domain controller an Internet-facing
|
||||
directory service. The supported cloud topology exposes no AD DS, DNS, SMB,
|
||||
RPC, WinRM, broker, monitoring, or RustDesk port publicly. Hyper-V and later
|
||||
physical Windows clients enter the VNet through certificate-authenticated Azure
|
||||
VPN Gateway P2S; the Azure NSG and Windows firewall accept the P2S pool and the
|
||||
private VNet only. See [azure-vpn-deployment.md](azure-vpn-deployment.md).
|
||||
|
||||
## Password handling
|
||||
|
||||
- The Credential Provider receives the password in Lithnet's secure password
|
||||
@@ -33,15 +42,18 @@
|
||||
- Administrative enrichment first verifies the employee number and reads
|
||||
employee type/status, email, job title, and department from the incident
|
||||
overview. Only after that match, it reads given names and paternal/maternal
|
||||
surnames from the personal page plus street, exterior/interior number,
|
||||
neighborhood, locality, state, and postal code from the location page.
|
||||
- Administrative birth date, RFC, CURP, sex, blood type, marital status,
|
||||
surnames and the normalized `Male`/`Female` value from the personal page plus
|
||||
street, exterior/interior number, neighborhood, locality, state, and postal
|
||||
code from the location page. AD stores only the controlled `SGU-Gender` line,
|
||||
not the original HTML field.
|
||||
- Administrative birth date, RFC, CURP, blood type, marital status,
|
||||
nationality, telephone, email lists, housing type, and emergency-contact
|
||||
fields are ignored.
|
||||
- Student enrichment reads only the matching student number, given names,
|
||||
paternal/maternal surnames, email, career, street, neighborhood,
|
||||
city/municipality, state, and postal code from known element IDs.
|
||||
- Student CURP, birth date, sex, blood type, marital status, telephone, mobile,
|
||||
city/municipality, state, postal code, and normalized sex from known element
|
||||
IDs.
|
||||
- Student CURP, birth date, blood type, marital status, telephone, mobile,
|
||||
guardian, medical, financial, and academic-history values are ignored.
|
||||
- Professor enrichment keeps the menu display name as its base. From the payroll
|
||||
consultation header it reads only a matching employee number, name, email,
|
||||
|
||||
@@ -16,14 +16,20 @@ El generador consulta Active Directory con la identidad ya autenticada y sin
|
||||
guardar credenciales. Obtiene:
|
||||
|
||||
- `displayName` del usuario; si falta, utiliza `sAMAccountName`.
|
||||
- La línea administrada `SGU-Gender: Male|Female` del atributo `info`; el Auth
|
||||
Broker la obtiene del SGU y conserva cualquier otra nota que ya exista.
|
||||
- `location` del objeto de equipo.
|
||||
- La OU padre inmediata a partir de `distinguishedName`.
|
||||
|
||||
El texto secundario sigue estas reglas:
|
||||
El saludo usa `Bienvenido/ubicado` para `Male` y `Bienvenida/ubicada` para
|
||||
`Female`. Cuando el enriquecimiento no produjo este dato, utiliza la redacción
|
||||
neutral `Te damos la bienvenida` y `Ubicación:`. El texto secundario sigue estas
|
||||
reglas:
|
||||
|
||||
1. Con `location` y OU: `Estás ubicado en la Sala de Inmersión del Centro de Experiencia Digital.`
|
||||
2. Con sólo uno de los datos: muestra únicamente el dato disponible.
|
||||
3. Sin ambos: `Bienvenido al Laboratorio de Cómputo de Ingeniería.`
|
||||
3. Sin ambos: el texto adaptado `Bienvenido/Bienvenida al Laboratorio...`; sin
|
||||
sexo disponible, la forma neutral `Acceso al Laboratorio de Cómputo de Ingeniería.`
|
||||
|
||||
La ausencia de AD, de un atributo o de una tipografía nunca bloquea la sesión.
|
||||
Los errores de generación se registran en
|
||||
|
||||
@@ -0,0 +1,323 @@
|
||||
targetScope = 'resourceGroup'
|
||||
|
||||
@description('Short prefix used for every Azure resource.')
|
||||
@minLength(3)
|
||||
@maxLength(18)
|
||||
param deploymentPrefix string = 'sgu-lab'
|
||||
|
||||
@description('Azure region for the virtual network, gateway, and VM.')
|
||||
param location string = resourceGroup().location
|
||||
|
||||
@description('Windows Server VM administrator name. This must not be Administrator.')
|
||||
@minLength(1)
|
||||
@maxLength(20)
|
||||
param administratorUsername string
|
||||
|
||||
@secure()
|
||||
@description('Windows Server VM administrator password.')
|
||||
param administratorPassword string
|
||||
|
||||
@description('Windows Server computer name; Active Directory limits this to 15 characters.')
|
||||
@minLength(1)
|
||||
@maxLength(15)
|
||||
param computerName string = 'SGU-DC01'
|
||||
|
||||
@description('VM size for the Windows Server 2025 domain controller.')
|
||||
param vmSize string = 'Standard_D2s_v5'
|
||||
|
||||
@description('Address space assigned to the Azure virtual network.')
|
||||
param virtualNetworkAddressPrefix string = '10.77.0.0/16'
|
||||
|
||||
@description('Subnet that contains the domain controller.')
|
||||
param domainControllerSubnetPrefix string = '10.77.0.0/24'
|
||||
|
||||
@description('Reserved Azure VPN Gateway subnet. Use /27 or larger.')
|
||||
param gatewaySubnetPrefix string = '10.77.255.0/27'
|
||||
|
||||
@description('Static private IP reserved on the Azure NIC for AD DS and DNS.')
|
||||
param domainControllerPrivateIp string = '10.77.0.4'
|
||||
|
||||
@description('Point-to-site client pool. It must not overlap the VNet or local Hyper-V networks.')
|
||||
param vpnClientAddressPoolPrefix string = '172.30.0.0/24'
|
||||
|
||||
@description('Name presented for the trusted P2S root certificate.')
|
||||
param p2sRootCertificateName string = 'SGU-P2S-Root'
|
||||
|
||||
@description('Base64 DER bytes of the trusted P2S root certificate, without PEM markers.')
|
||||
param p2sRootCertificateData string
|
||||
|
||||
@description('Optional public CIDR allowed to RDP to the VM public IP, for example 203.0.113.10/32. Leave empty to expose no management port.')
|
||||
param administratorSourceAddressPrefix string = ''
|
||||
|
||||
var virtualNetworkName = '${deploymentPrefix}-vnet'
|
||||
var domainControllerSubnetName = 'DomainControllers'
|
||||
var gatewaySubnetName = 'GatewaySubnet'
|
||||
var networkSecurityGroupName = '${deploymentPrefix}-dc-nsg'
|
||||
var domainControllerPublicIpName = '${deploymentPrefix}-dc-pip'
|
||||
var gatewayPublicIpName = '${deploymentPrefix}-vpngw-pip'
|
||||
var networkInterfaceName = '${deploymentPrefix}-dc-nic'
|
||||
var virtualMachineName = '${deploymentPrefix}-dc'
|
||||
var virtualNetworkGatewayName = '${deploymentPrefix}-vpngw'
|
||||
|
||||
resource networkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2024-05-01' = {
|
||||
name: networkSecurityGroupName
|
||||
location: location
|
||||
properties: {
|
||||
securityRules: concat([
|
||||
{
|
||||
name: 'Allow-SGU-P2S-clients'
|
||||
properties: {
|
||||
priority: 100
|
||||
access: 'Allow'
|
||||
direction: 'Inbound'
|
||||
protocol: '*'
|
||||
sourcePortRange: '*'
|
||||
destinationPortRange: '*'
|
||||
sourceAddressPrefix: vpnClientAddressPoolPrefix
|
||||
destinationAddressPrefix: domainControllerPrivateIp
|
||||
description: 'AD, DNS, broker, monitoring, and RustDesk are reachable only through the authenticated P2S address pool.'
|
||||
}
|
||||
}
|
||||
], empty(administratorSourceAddressPrefix) ? [] : [
|
||||
{
|
||||
name: 'Allow-RDP-from-administrator'
|
||||
properties: {
|
||||
priority: 110
|
||||
access: 'Allow'
|
||||
direction: 'Inbound'
|
||||
protocol: 'Tcp'
|
||||
sourcePortRange: '*'
|
||||
destinationPortRange: '3389'
|
||||
sourceAddressPrefix: administratorSourceAddressPrefix
|
||||
destinationAddressPrefix: domainControllerPrivateIp
|
||||
description: 'Optional bootstrap-only RDP access from one explicitly supplied public CIDR.'
|
||||
}
|
||||
}
|
||||
])
|
||||
}
|
||||
}
|
||||
|
||||
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-05-01' = {
|
||||
name: virtualNetworkName
|
||||
location: location
|
||||
properties: {
|
||||
addressSpace: {
|
||||
addressPrefixes: [
|
||||
virtualNetworkAddressPrefix
|
||||
]
|
||||
}
|
||||
subnets: [
|
||||
{
|
||||
name: domainControllerSubnetName
|
||||
properties: {
|
||||
addressPrefix: domainControllerSubnetPrefix
|
||||
networkSecurityGroup: {
|
||||
id: networkSecurityGroup.id
|
||||
}
|
||||
}
|
||||
}
|
||||
{
|
||||
name: gatewaySubnetName
|
||||
properties: {
|
||||
addressPrefix: gatewaySubnetPrefix
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource domainControllerPublicIp 'Microsoft.Network/publicIPAddresses@2024-05-01' = {
|
||||
name: domainControllerPublicIpName
|
||||
location: location
|
||||
sku: {
|
||||
name: 'Standard'
|
||||
}
|
||||
properties: {
|
||||
publicIPAllocationMethod: 'Static'
|
||||
publicIPAddressVersion: 'IPv4'
|
||||
idleTimeoutInMinutes: 30
|
||||
}
|
||||
}
|
||||
|
||||
resource gatewayPublicIp 'Microsoft.Network/publicIPAddresses@2024-05-01' = {
|
||||
name: gatewayPublicIpName
|
||||
location: location
|
||||
sku: {
|
||||
name: 'Standard'
|
||||
}
|
||||
properties: {
|
||||
publicIPAllocationMethod: 'Static'
|
||||
publicIPAddressVersion: 'IPv4'
|
||||
}
|
||||
}
|
||||
|
||||
resource networkInterface 'Microsoft.Network/networkInterfaces@2024-05-01' = {
|
||||
name: networkInterfaceName
|
||||
location: location
|
||||
properties: {
|
||||
enableAcceleratedNetworking: true
|
||||
dnsSettings: {
|
||||
dnsServers: [
|
||||
domainControllerPrivateIp
|
||||
]
|
||||
}
|
||||
ipConfigurations: [
|
||||
{
|
||||
name: 'ipconfig1'
|
||||
properties: {
|
||||
privateIPAllocationMethod: 'Static'
|
||||
privateIPAddressVersion: 'IPv4'
|
||||
privateIPAddress: domainControllerPrivateIp
|
||||
subnet: {
|
||||
id: resourceId('Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, domainControllerSubnetName)
|
||||
}
|
||||
publicIPAddress: {
|
||||
id: domainControllerPublicIp.id
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
dependsOn: [
|
||||
virtualNetwork
|
||||
]
|
||||
}
|
||||
|
||||
resource virtualMachine 'Microsoft.Compute/virtualMachines@2024-07-01' = {
|
||||
name: virtualMachineName
|
||||
location: location
|
||||
identity: {
|
||||
type: 'SystemAssigned'
|
||||
}
|
||||
properties: {
|
||||
hardwareProfile: {
|
||||
vmSize: vmSize
|
||||
}
|
||||
securityProfile: {
|
||||
securityType: 'TrustedLaunch'
|
||||
uefiSettings: {
|
||||
secureBootEnabled: true
|
||||
vTpmEnabled: true
|
||||
}
|
||||
}
|
||||
osProfile: {
|
||||
computerName: computerName
|
||||
adminUsername: administratorUsername
|
||||
adminPassword: administratorPassword
|
||||
windowsConfiguration: {
|
||||
provisionVMAgent: true
|
||||
enableAutomaticUpdates: true
|
||||
patchSettings: {
|
||||
patchMode: 'AutomaticByPlatform'
|
||||
assessmentMode: 'AutomaticByPlatform'
|
||||
enableHotpatching: false
|
||||
}
|
||||
}
|
||||
}
|
||||
storageProfile: {
|
||||
imageReference: {
|
||||
publisher: 'MicrosoftWindowsServer'
|
||||
offer: 'WindowsServer'
|
||||
sku: '2025-datacenter-azure-edition'
|
||||
version: 'latest'
|
||||
}
|
||||
osDisk: {
|
||||
createOption: 'FromImage'
|
||||
managedDisk: {
|
||||
storageAccountType: 'Premium_LRS'
|
||||
}
|
||||
deleteOption: 'Delete'
|
||||
}
|
||||
}
|
||||
networkProfile: {
|
||||
networkInterfaces: [
|
||||
{
|
||||
id: networkInterface.id
|
||||
properties: {
|
||||
primary: true
|
||||
deleteOption: 'Delete'
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
diagnosticsProfile: {
|
||||
bootDiagnostics: {
|
||||
enabled: true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource virtualNetworkGateway 'Microsoft.Network/virtualNetworkGateways@2024-05-01' = {
|
||||
name: virtualNetworkGatewayName
|
||||
location: location
|
||||
properties: {
|
||||
gatewayType: 'Vpn'
|
||||
vpnType: 'RouteBased'
|
||||
activeActive: false
|
||||
enableBgp: false
|
||||
ipConfigurations: [
|
||||
{
|
||||
name: 'gateway-ipconfig'
|
||||
properties: {
|
||||
privateIPAllocationMethod: 'Dynamic'
|
||||
subnet: {
|
||||
id: resourceId('Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, gatewaySubnetName)
|
||||
}
|
||||
publicIPAddress: {
|
||||
id: gatewayPublicIp.id
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
sku: {
|
||||
name: 'VpnGw1'
|
||||
tier: 'VpnGw1'
|
||||
}
|
||||
vpnClientConfiguration: {
|
||||
vpnClientAddressPool: {
|
||||
addressPrefixes: [
|
||||
vpnClientAddressPoolPrefix
|
||||
]
|
||||
}
|
||||
vpnClientProtocols: [
|
||||
'IkeV2'
|
||||
'SSTP'
|
||||
]
|
||||
vpnAuthenticationTypes: [
|
||||
'Certificate'
|
||||
]
|
||||
vpnClientRootCertificates: [
|
||||
{
|
||||
name: p2sRootCertificateName
|
||||
properties: {
|
||||
publicCertData: p2sRootCertificateData
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
dependsOn: [
|
||||
virtualNetwork
|
||||
]
|
||||
}
|
||||
|
||||
output domainControllerName string = virtualMachine.name
|
||||
output domainControllerPrivateIp string = domainControllerPrivateIp
|
||||
output domainControllerPublicIp string = domainControllerPublicIp.properties.ipAddress
|
||||
output virtualNetworkName string = virtualNetwork.name
|
||||
output virtualNetworkAddressPrefix string = virtualNetworkAddressPrefix
|
||||
output vpnGatewayName string = virtualNetworkGateway.name
|
||||
output vpnClientAddressPoolPrefix string = vpnClientAddressPoolPrefix
|
||||
output serverBootstrapArguments array = [
|
||||
'-ServerIPv4Address'
|
||||
domainControllerPrivateIp
|
||||
'-PrefixLength'
|
||||
last(split(domainControllerSubnetPrefix, '/'))
|
||||
'-NetworkConfigurationMode'
|
||||
'PlatformManaged'
|
||||
'-TrustedClientNetworks'
|
||||
vpnClientAddressPoolPrefix
|
||||
'-DnsForwarders'
|
||||
'168.63.129.16'
|
||||
]
|
||||
@@ -31,6 +31,9 @@ param(
|
||||
[string]$BaseDn = 'DC=lci,DC=lasalle,DC=mx',
|
||||
[string]$DomainNetbios = 'LCI',
|
||||
[string]$UpnSuffix = 'lci.lasalle.mx',
|
||||
[string]$ProfessorGroupDn = '',
|
||||
[string]$StudentGroupDn = '',
|
||||
[string]$AdministrativeGroupDn = '',
|
||||
[string]$RemoteDesktopGroupDn = '',
|
||||
[ValidateLength(1, 64)]
|
||||
[string]$DefaultCompany = 'La Salle',
|
||||
@@ -72,10 +75,27 @@ if (-not $serverCertificate.Verify()) {
|
||||
throw 'The HTTPS server certificate chain is not trusted or is outside its validity period. Import the issuing CA chain; for a self-signed lab certificate, trust its public .cer in LocalMachine\Root.'
|
||||
}
|
||||
|
||||
Import-Module ActiveDirectory -ErrorAction Stop
|
||||
|
||||
function ConvertTo-LdapFilterValue {
|
||||
param([Parameter(Mandatory)][string]$Value)
|
||||
|
||||
return $Value.Replace('\', '\5c').Replace('*', '\2a').Replace('(', '\28').Replace(')', '\29').Replace(([string][char]0), '\00')
|
||||
}
|
||||
|
||||
$usersOuName = 'Usuarios-SGU'
|
||||
$usersOuDn = "OU=$usersOuName,$BaseDn"
|
||||
if ([string]::IsNullOrWhiteSpace($ProfessorGroupDn)) {
|
||||
$ProfessorGroupDn = "CN=SGU-Docentes,OU=Docentes,$usersOuDn"
|
||||
}
|
||||
if ([string]::IsNullOrWhiteSpace($StudentGroupDn)) {
|
||||
$StudentGroupDn = "CN=SGU-Alumnos,OU=Alumnos,$usersOuDn"
|
||||
}
|
||||
if ([string]::IsNullOrWhiteSpace($AdministrativeGroupDn)) {
|
||||
$AdministrativeGroupDn = "CN=SGU-Administrativos,OU=Administrativos,$usersOuDn"
|
||||
}
|
||||
|
||||
if ($CreateMissingOus) {
|
||||
Import-Module ActiveDirectory -ErrorAction Stop
|
||||
$usersOuName = 'Usuarios-SGU'
|
||||
$usersOuDn = "OU=$usersOuName,$BaseDn"
|
||||
if (-not (Get-ADOrganizationalUnit -LDAPFilter "(ou=$usersOuName)" -SearchBase $BaseDn -SearchScope OneLevel -Server $LdapHost -ErrorAction SilentlyContinue)) {
|
||||
New-ADOrganizationalUnit -Name $usersOuName -Path $BaseDn -ProtectedFromAccidentalDeletion $true -Server $LdapHost | Out-Null
|
||||
}
|
||||
@@ -117,8 +137,63 @@ if ($CreateMissingOus) {
|
||||
}
|
||||
}
|
||||
|
||||
$roleGroupDefinitions = @(
|
||||
[pscustomobject]@{ Role = 'Professor'; Dn = $ProfessorGroupDn; Description = 'SGU accounts with the DO institutional prefix.' }
|
||||
[pscustomobject]@{ Role = 'Student'; Dn = $StudentGroupDn; Description = 'SGU accounts with the AL institutional prefix.' }
|
||||
[pscustomobject]@{ Role = 'Administrative'; Dn = $AdministrativeGroupDn; Description = 'SGU accounts with the AD institutional prefix.' }
|
||||
)
|
||||
foreach ($definition in $roleGroupDefinitions) {
|
||||
if (-not $definition.Dn.EndsWith(",$BaseDn", [StringComparison]::OrdinalIgnoreCase)) {
|
||||
throw "$($definition.Role)GroupDn must identify a security group beneath BaseDn."
|
||||
}
|
||||
|
||||
try {
|
||||
$roleGroup = Get-ADGroup -Identity $definition.Dn -Server $LdapHost -ErrorAction Stop
|
||||
}
|
||||
catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
|
||||
$roleGroup = $null
|
||||
}
|
||||
if (-not $roleGroup -and $CreateMissingOus) {
|
||||
$groupDnMatch = [regex]::Match($definition.Dn, '^CN=(?<Name>[^,]+),(?<Path>.+)$', [Text.RegularExpressions.RegexOptions]::IgnoreCase)
|
||||
if (-not $groupDnMatch.Success) {
|
||||
throw "$($definition.Role)GroupDn must start with a simple CN component."
|
||||
}
|
||||
$groupName = $groupDnMatch.Groups['Name'].Value
|
||||
$groupPath = $groupDnMatch.Groups['Path'].Value
|
||||
if ($groupName.Length -gt 20) {
|
||||
throw "$($definition.Role) group name exceeds the 20-character sAMAccountName limit."
|
||||
}
|
||||
|
||||
$matchingGroups = @(Get-ADGroup `
|
||||
-LDAPFilter "(sAMAccountName=$(ConvertTo-LdapFilterValue -Value $groupName))" `
|
||||
-SearchBase $BaseDn -SearchScope Subtree -Server $LdapHost -ErrorAction Stop)
|
||||
if ($matchingGroups.Count -gt 1) {
|
||||
throw "More than one Active Directory group uses sAMAccountName $groupName; the bootstrap cannot select one safely."
|
||||
}
|
||||
if ($matchingGroups.Count -eq 1) {
|
||||
if ($matchingGroups[0].GroupCategory -ne 'Security') {
|
||||
throw "$($definition.Role)GroupDn must identify a security group."
|
||||
}
|
||||
Move-ADObject -Identity $matchingGroups[0].DistinguishedName `
|
||||
-TargetPath $groupPath -Server $LdapHost -Confirm:$false -ErrorAction Stop
|
||||
}
|
||||
else {
|
||||
New-ADGroup -Name $groupName -SamAccountName $groupName `
|
||||
-GroupCategory Security -GroupScope Global `
|
||||
-Path $groupPath `
|
||||
-Description $definition.Description -Server $LdapHost | Out-Null
|
||||
}
|
||||
$roleGroup = Get-ADGroup -Identity $definition.Dn -Server $LdapHost -ErrorAction Stop
|
||||
}
|
||||
if (-not $roleGroup) {
|
||||
throw "The required $($definition.Role) security group does not exist: $($definition.Dn)"
|
||||
}
|
||||
if ($roleGroup.GroupCategory -ne 'Security') {
|
||||
throw "$($definition.Role)GroupDn must identify a security group."
|
||||
}
|
||||
}
|
||||
|
||||
if ($RemoteDesktopGroupDn) {
|
||||
Import-Module ActiveDirectory -ErrorAction Stop
|
||||
$remoteDesktopGroup = Get-ADGroup -Identity $RemoteDesktopGroupDn -Server $LdapHost -ErrorAction Stop
|
||||
if ($remoteDesktopGroup.GroupCategory -ne 'Security' -or
|
||||
-not $remoteDesktopGroup.DistinguishedName.EndsWith(",$BaseDn", [StringComparison]::OrdinalIgnoreCase)) {
|
||||
@@ -186,6 +261,9 @@ $productionSettings = @{
|
||||
ProfessorOuDn = "OU=Docentes,OU=Usuarios-SGU,$BaseDn"
|
||||
StudentOuDn = "OU=Alumnos,OU=Usuarios-SGU,$BaseDn"
|
||||
AdministrativeOuDn = "OU=Administrativos,OU=Usuarios-SGU,$BaseDn"
|
||||
ProfessorGroupDn = $ProfessorGroupDn
|
||||
StudentGroupDn = $StudentGroupDn
|
||||
AdministrativeGroupDn = $AdministrativeGroupDn
|
||||
RemoteDesktopGroupDn = $RemoteDesktopGroupDn
|
||||
DefaultCompany = $DefaultCompany
|
||||
CreateMissingOus = [bool]$CreateMissingOus
|
||||
|
||||
@@ -0,0 +1,140 @@
|
||||
#Requires -Version 5.1
|
||||
[CmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$SubscriptionId,
|
||||
[string]$ResourceGroupName = 'rg-sgu-lab',
|
||||
[string]$Location = 'centralus',
|
||||
[string]$DeploymentPrefix = 'sgu-lab',
|
||||
[Parameter(Mandatory)][string]$AdministratorUsername,
|
||||
[securestring]$AdministratorPassword,
|
||||
[Parameter(Mandatory)][string]$P2sRootCertificatePath,
|
||||
[string]$ComputerName = 'SGU-DC01',
|
||||
[string]$VmSize = 'Standard_D2s_v5',
|
||||
[string]$VirtualNetworkAddressPrefix = '10.77.0.0/16',
|
||||
[string]$DomainControllerSubnetPrefix = '10.77.0.0/24',
|
||||
[ipaddress]$DomainControllerPrivateIp = '10.77.0.4',
|
||||
[string]$GatewaySubnetPrefix = '10.77.255.0/27',
|
||||
[string]$VpnClientAddressPoolPrefix = '172.30.0.0/24',
|
||||
[string]$AdministratorSourceAddressPrefix = '',
|
||||
[string]$TemplateFile = (Join-Path $PSScriptRoot '..\infra\azure\main.bicep')
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$ProgressPreference = 'SilentlyContinue'
|
||||
|
||||
if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
|
||||
throw 'Azure CLI is required. Install it from https://aka.ms/installazurecliwindows and run az login.'
|
||||
}
|
||||
if (-not (Test-Path -LiteralPath $TemplateFile -PathType Leaf)) {
|
||||
throw "Azure Bicep template not found: $TemplateFile"
|
||||
}
|
||||
if (-not (Test-Path -LiteralPath $P2sRootCertificatePath -PathType Leaf)) {
|
||||
throw "P2S root certificate not found: $P2sRootCertificatePath"
|
||||
}
|
||||
if (-not $AdministratorPassword) {
|
||||
$AdministratorPassword = Read-Host 'Password for the local Azure VM administrator' -AsSecureString
|
||||
}
|
||||
|
||||
$rootCertificate = [Security.Cryptography.X509Certificates.X509Certificate2]::new(
|
||||
(Resolve-Path -LiteralPath $P2sRootCertificatePath).Path)
|
||||
if (-not ($rootCertificate.Extensions | Where-Object {
|
||||
$_.Oid -and $_.Oid.Value -eq '2.5.29.19' -and $_.Format($false) -match 'CA' })) {
|
||||
throw 'P2sRootCertificatePath must contain a certificate-authority certificate.'
|
||||
}
|
||||
$rootCertificateData = [Convert]::ToBase64String($rootCertificate.RawData)
|
||||
|
||||
$account = & az account show --output json 2>$null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw 'Azure CLI is not signed in. Run az login, then retry.'
|
||||
}
|
||||
& az account set --subscription $SubscriptionId --only-show-errors
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Could not select Azure subscription $SubscriptionId."
|
||||
}
|
||||
|
||||
if ($PSCmdlet.ShouldProcess("$ResourceGroupName in $Location", 'Create Azure VNet, Windows Server 2025 VM, public IP, and P2S VPN Gateway')) {
|
||||
& az group create --name $ResourceGroupName --location $Location --only-show-errors --output none
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Could not create or update resource group $ResourceGroupName."
|
||||
}
|
||||
|
||||
$temporaryRoot = Join-Path ([IO.Path]::GetTempPath()) ("sgu-azure-" + [Guid]::NewGuid().ToString('N'))
|
||||
$parametersPath = Join-Path $temporaryRoot 'parameters.json'
|
||||
$passwordPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($AdministratorPassword)
|
||||
try {
|
||||
New-Item -ItemType Directory -Path $temporaryRoot -Force | Out-Null
|
||||
$acl = Get-Acl -LiteralPath $temporaryRoot
|
||||
$acl.SetAccessRuleProtection($true, $false)
|
||||
$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
|
||||
[Security.Principal.WindowsIdentity]::GetCurrent().User,
|
||||
[Security.AccessControl.FileSystemRights]::FullControl,
|
||||
[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
|
||||
[Security.AccessControl.PropagationFlags]::None,
|
||||
[Security.AccessControl.AccessControlType]::Allow))
|
||||
Set-Acl -LiteralPath $temporaryRoot -AclObject $acl
|
||||
|
||||
$plainPassword = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($passwordPointer)
|
||||
$parameters = [ordered]@{
|
||||
'$schema' = 'https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#'
|
||||
contentVersion = '1.0.0.0'
|
||||
parameters = [ordered]@{
|
||||
deploymentPrefix = @{ value = $DeploymentPrefix }
|
||||
location = @{ value = $Location }
|
||||
administratorUsername = @{ value = $AdministratorUsername }
|
||||
administratorPassword = @{ value = $plainPassword }
|
||||
computerName = @{ value = $ComputerName }
|
||||
vmSize = @{ value = $VmSize }
|
||||
virtualNetworkAddressPrefix = @{ value = $VirtualNetworkAddressPrefix }
|
||||
domainControllerSubnetPrefix = @{ value = $DomainControllerSubnetPrefix }
|
||||
gatewaySubnetPrefix = @{ value = $GatewaySubnetPrefix }
|
||||
domainControllerPrivateIp = @{ value = $DomainControllerPrivateIp.IPAddressToString }
|
||||
vpnClientAddressPoolPrefix = @{ value = $VpnClientAddressPoolPrefix }
|
||||
p2sRootCertificateData = @{ value = $rootCertificateData }
|
||||
administratorSourceAddressPrefix = @{ value = $AdministratorSourceAddressPrefix }
|
||||
}
|
||||
}
|
||||
[IO.File]::WriteAllText(
|
||||
$parametersPath,
|
||||
($parameters | ConvertTo-Json -Depth 8),
|
||||
[Text.UTF8Encoding]::new($false))
|
||||
$plainPassword = $null
|
||||
$parameters.parameters.administratorPassword.value = $null
|
||||
|
||||
$deploymentName = 'sgu-{0}' -f (Get-Date -Format 'yyyyMMdd-HHmmss')
|
||||
$deploymentOutput = & az deployment group create `
|
||||
--name $deploymentName `
|
||||
--resource-group $ResourceGroupName `
|
||||
--template-file (Resolve-Path -LiteralPath $TemplateFile).Path `
|
||||
--parameters "@$parametersPath" `
|
||||
--only-show-errors `
|
||||
--output json
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw 'Azure deployment failed. Review the Azure CLI error above; no bootstrap credential was persisted by this script.'
|
||||
}
|
||||
$deployment = ($deploymentOutput -join [Environment]::NewLine) | ConvertFrom-Json
|
||||
}
|
||||
finally {
|
||||
if ($passwordPointer -ne [IntPtr]::Zero) {
|
||||
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($passwordPointer)
|
||||
}
|
||||
$AdministratorPassword = $null
|
||||
if ($temporaryRoot -and (Test-Path -LiteralPath $temporaryRoot)) {
|
||||
Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
$values = @{}
|
||||
foreach ($property in $deployment.properties.outputs.PSObject.Properties) {
|
||||
$values[$property.Name] = $property.Value.value
|
||||
}
|
||||
[pscustomobject]@{
|
||||
ResourceGroupName = $ResourceGroupName
|
||||
DeploymentName = $deploymentName
|
||||
DomainControllerName = $values.domainControllerName
|
||||
DomainControllerPrivateIp = $values.domainControllerPrivateIp
|
||||
DomainControllerPublicIp = $values.domainControllerPublicIp
|
||||
VpnGatewayName = $values.vpnGatewayName
|
||||
VpnClientAddressPoolPrefix = $values.vpnClientAddressPoolPrefix
|
||||
ServerBootstrapArguments = $values.serverBootstrapArguments
|
||||
}
|
||||
}
|
||||
@@ -22,6 +22,8 @@ param(
|
||||
[string]$NewComputerName,
|
||||
[string]$NetworkInterfaceAlias = 'Ethernet',
|
||||
[string[]]$DomainDnsServerAddresses = @('192.168.50.10'),
|
||||
[ValidateSet('Direct', 'AzureP2S')]
|
||||
[string]$ConnectivityMode = 'Direct',
|
||||
[string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
|
||||
[string]$DotNetRuntimeInstallerPath,
|
||||
[string]$RustDeskServerAddress,
|
||||
@@ -90,9 +92,21 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before jo
|
||||
# The broker uses a domain DNS name even before the machine joins the
|
||||
# domain. Point at AD DNS first so the provider-first health check works on
|
||||
# a completely clean Windows installation.
|
||||
Set-DnsClientServerAddress `
|
||||
-InterfaceAlias $NetworkInterfaceAlias `
|
||||
-ServerAddresses $DomainDnsServerAddresses
|
||||
if ($ConnectivityMode -eq 'Direct') {
|
||||
Set-DnsClientServerAddress `
|
||||
-InterfaceAlias $NetworkInterfaceAlias `
|
||||
-ServerAddresses $DomainDnsServerAddresses
|
||||
}
|
||||
else {
|
||||
$nrptDisplayName = "SGU Azure P2S DNS - $DomainName"
|
||||
$nrptRule = Get-DnsClientNrptRule -ErrorAction SilentlyContinue |
|
||||
Where-Object DisplayName -eq $nrptDisplayName |
|
||||
Select-Object -First 1
|
||||
if (-not $nrptRule -or
|
||||
@($DomainDnsServerAddresses | Where-Object { @($nrptRule.NameServers) -contains $_ }).Count -eq 0) {
|
||||
throw "AzureP2S enrollment requires the managed NRPT rule '$nrptDisplayName'. Run Install-SguAzureP2sClient.ps1 first."
|
||||
}
|
||||
}
|
||||
Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
|
||||
|
||||
& (Join-Path $PSScriptRoot 'Install-CredentialProvider.ps1') @installParams | Out-Null
|
||||
@@ -159,6 +173,7 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before jo
|
||||
[pscustomobject]@{
|
||||
ComputerName = if ($NewComputerName) { $NewComputerName } else { $env:COMPUTERNAME }
|
||||
DomainName = $DomainName
|
||||
ConnectivityMode = $ConnectivityMode
|
||||
ProviderValidatedBeforeJoin = $true
|
||||
RustDesk = $rustDeskResult
|
||||
RestartRequired = [bool]$SkipRestart
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
#Requires -Version 5.1
|
||||
[CmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$SubscriptionId,
|
||||
[Parameter(Mandatory)][string]$ResourceGroupName,
|
||||
[Parameter(Mandatory)][string]$VpnGatewayName,
|
||||
[string]$OutputPath = (Join-Path $PSScriptRoot '..\artifacts\azure-p2s\sgu-azure-vpn-client.zip')
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$ProgressPreference = 'SilentlyContinue'
|
||||
if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
|
||||
throw 'Azure CLI is required.'
|
||||
}
|
||||
& az account set --subscription $SubscriptionId --only-show-errors
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Could not select Azure subscription $SubscriptionId."
|
||||
}
|
||||
|
||||
if ($PSCmdlet.ShouldProcess($OutputPath, 'Generate and download the Azure P2S client package')) {
|
||||
$downloadUriText = & az network vnet-gateway vpn-client generate `
|
||||
--resource-group $ResourceGroupName `
|
||||
--name $VpnGatewayName `
|
||||
--processor-architecture Amd64 `
|
||||
--authentication-method EAPTLS `
|
||||
--only-show-errors `
|
||||
--output tsv
|
||||
$downloadUriText = ($downloadUriText -join '').Trim()
|
||||
if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($downloadUriText)) {
|
||||
throw 'Azure did not generate a P2S client package URL.'
|
||||
}
|
||||
$downloadUri = $null
|
||||
if (-not [uri]::TryCreate($downloadUriText, [UriKind]::Absolute, [ref]$downloadUri) -or
|
||||
$downloadUri.Scheme -ne 'https') {
|
||||
throw 'Azure returned an invalid VPN client package URL.'
|
||||
}
|
||||
$resolvedOutputPath = [IO.Path]::GetFullPath($OutputPath)
|
||||
New-Item -ItemType Directory -Path (Split-Path $resolvedOutputPath -Parent) -Force | Out-Null
|
||||
Invoke-WebRequest -Uri $downloadUri -OutFile $resolvedOutputPath -UseBasicParsing
|
||||
if ((Get-Item -LiteralPath $resolvedOutputPath).Length -lt 1024) {
|
||||
throw 'The downloaded VPN client package is unexpectedly small.'
|
||||
}
|
||||
[pscustomobject]@{
|
||||
PackagePath = $resolvedOutputPath
|
||||
Sha256 = (Get-FileHash -LiteralPath $resolvedOutputPath -Algorithm SHA256).Hash
|
||||
VpnGatewayName = $VpnGatewayName
|
||||
}
|
||||
}
|
||||
@@ -32,6 +32,7 @@ $eventNames = @{
|
||||
1300 = 'DirectorySynchronizationFailure'
|
||||
1301 = 'DirectoryOptionalMetadataFailure'
|
||||
1302 = 'DirectoryGroupMembershipFailure'
|
||||
1303 = 'DirectoryRoleGroupMembershipAdded'
|
||||
}
|
||||
|
||||
# Keep these reads unfiltered. Besides making archived and current logs behave
|
||||
|
||||
@@ -6,6 +6,9 @@ param(
|
||||
[int]$PrefixLength = 24,
|
||||
[string]$NetworkInterfaceAlias,
|
||||
[ipaddress]$DefaultGateway,
|
||||
[ValidateSet('GuestStatic', 'PlatformManaged')]
|
||||
[string]$NetworkConfigurationMode = 'GuestStatic',
|
||||
[string[]]$TrustedClientNetworks = @(),
|
||||
[ipaddress[]]$DnsForwarders = @(),
|
||||
[string]$DomainName = 'lci.lasalle.mx',
|
||||
[string]$DomainNetbios = 'LCI',
|
||||
@@ -69,6 +72,67 @@ function Get-DomainBaseDn {
|
||||
return (($DnsDomainName -split '\.') | ForEach-Object { "DC=$_" }) -join ','
|
||||
}
|
||||
|
||||
function Test-PrivateIPv4Address {
|
||||
param([Parameter(Mandatory)][ipaddress]$Address)
|
||||
|
||||
if ($Address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
||||
return $false
|
||||
}
|
||||
$bytes = $Address.GetAddressBytes()
|
||||
return $bytes[0] -eq 10 -or
|
||||
($bytes[0] -eq 172 -and $bytes[1] -ge 16 -and $bytes[1] -le 31) -or
|
||||
($bytes[0] -eq 192 -and $bytes[1] -eq 168)
|
||||
}
|
||||
|
||||
function ConvertTo-NetworkCidr {
|
||||
param(
|
||||
[Parameter(Mandatory)][ipaddress]$Address,
|
||||
[Parameter(Mandatory)][ValidateRange(1, 32)][int]$NetworkPrefixLength
|
||||
)
|
||||
|
||||
if ($Address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
||||
throw 'Only IPv4 networks are supported by the SGU bootstrap.'
|
||||
}
|
||||
$addressBytes = $Address.GetAddressBytes()
|
||||
$networkBytes = [byte[]]::new(4)
|
||||
$remainingBits = $NetworkPrefixLength
|
||||
for ($index = 0; $index -lt 4; $index++) {
|
||||
$mask = if ($remainingBits -ge 8) {
|
||||
255
|
||||
}
|
||||
elseif ($remainingBits -le 0) {
|
||||
0
|
||||
}
|
||||
else {
|
||||
256 - [Math]::Pow(2, 8 - $remainingBits)
|
||||
}
|
||||
$networkBytes[$index] = [byte]($addressBytes[$index] -band [int]$mask)
|
||||
$remainingBits -= 8
|
||||
}
|
||||
return "$(($networkBytes | ForEach-Object { [string]$_ }) -join '.')/$NetworkPrefixLength"
|
||||
}
|
||||
|
||||
function ConvertTo-PrivateNetworkCidr {
|
||||
param([Parameter(Mandatory)][string]$Cidr)
|
||||
|
||||
if ($Cidr -notmatch '^([^/]+)/(\d{1,2})$') {
|
||||
throw "Trusted client network '$Cidr' must use IPv4 CIDR notation, for example 172.30.0.0/24."
|
||||
}
|
||||
$address = $null
|
||||
if (-not [ipaddress]::TryParse($Matches[1], [ref]$address) -or
|
||||
$address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
||||
throw "Trusted client network '$Cidr' is not a valid IPv4 network."
|
||||
}
|
||||
$networkPrefixLength = [int]$Matches[2]
|
||||
if ($networkPrefixLength -lt 1 -or $networkPrefixLength -gt 32) {
|
||||
throw "Trusted client network '$Cidr' has an invalid prefix length."
|
||||
}
|
||||
if (-not (Test-PrivateIPv4Address -Address $address)) {
|
||||
throw "Trusted client network '$Cidr' is not private RFC1918 space. The bootstrap never exposes AD services to public client addresses."
|
||||
}
|
||||
return ConvertTo-NetworkCidr -Address $address -NetworkPrefixLength $networkPrefixLength
|
||||
}
|
||||
|
||||
function Resolve-PrivateInterfaceAlias {
|
||||
param([string]$RequestedAlias)
|
||||
|
||||
@@ -147,6 +211,27 @@ function Set-StaticDomainAddress {
|
||||
-ServerAddresses $Address.IPAddressToString
|
||||
}
|
||||
|
||||
function Assert-PlatformManagedDomainAddress {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$InterfaceAlias,
|
||||
[Parameter(Mandatory)][ipaddress]$Address,
|
||||
[Parameter(Mandatory)][int]$NetworkPrefixLength
|
||||
)
|
||||
|
||||
$adapter = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop
|
||||
$matchingAddress = Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
||||
-IPAddress $Address.IPAddressToString -ErrorAction SilentlyContinue |
|
||||
Where-Object PrefixLength -eq $NetworkPrefixLength |
|
||||
Select-Object -First 1
|
||||
if (-not $matchingAddress) {
|
||||
$observed = @(Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
||||
-ErrorAction SilentlyContinue |
|
||||
Where-Object PrefixOrigin -ne 'WellKnown' |
|
||||
ForEach-Object { "$($_.IPAddress)/$($_.PrefixLength)" }) -join ', '
|
||||
throw "PlatformManaged mode expected $Address/$NetworkPrefixLength on $InterfaceAlias, but found: $observed. Configure a static private IP on the Azure NIC before running the bootstrap; do not assign it inside Windows."
|
||||
}
|
||||
}
|
||||
|
||||
function Register-ResumeTask {
|
||||
param([Parameter(Mandatory)][string]$ScriptPath)
|
||||
|
||||
@@ -310,6 +395,8 @@ if ($Resume -or (-not $ServerIPv4Address -and $existingState)) {
|
||||
$PrefixLength = [int]$existingState.PrefixLength
|
||||
$NetworkInterfaceAlias = [string]$existingState.NetworkInterfaceAlias
|
||||
$DefaultGateway = if ($existingState.DefaultGateway) { [ipaddress][string]$existingState.DefaultGateway } else { $null }
|
||||
$NetworkConfigurationMode = if ($existingState.NetworkConfigurationMode) { [string]$existingState.NetworkConfigurationMode } else { 'GuestStatic' }
|
||||
$TrustedClientNetworks = if ($existingState.TrustedClientNetworks) { @($existingState.TrustedClientNetworks | ForEach-Object { [string]$_ }) } else { @() }
|
||||
$DnsForwarders = @($existingState.DnsForwarders | ForEach-Object { [ipaddress][string]$_ })
|
||||
$DomainName = [string]$existingState.DomainName
|
||||
$DomainNetbios = [string]$existingState.DomainNetbios
|
||||
@@ -321,6 +408,16 @@ if ($Resume -or (-not $ServerIPv4Address -and $existingState)) {
|
||||
if (-not $ServerIPv4Address) {
|
||||
$ServerIPv4Address = [ipaddress](Read-Host 'Fixed IPv4 address for this domain controller')
|
||||
}
|
||||
if (-not (Test-PrivateIPv4Address -Address $ServerIPv4Address)) {
|
||||
throw 'ServerIPv4Address must be the private address of the domain controller. An Azure public IP is never assigned to AD or published in domain DNS.'
|
||||
}
|
||||
$domainSubnet = ConvertTo-NetworkCidr -Address $ServerIPv4Address `
|
||||
-NetworkPrefixLength $PrefixLength
|
||||
$TrustedClientNetworks = @($TrustedClientNetworks |
|
||||
ForEach-Object { ConvertTo-PrivateNetworkCidr -Cidr $_ } |
|
||||
Where-Object { $_ -ne $domainSubnet } |
|
||||
Select-Object -Unique)
|
||||
$allowedRemoteAddresses = @($domainSubnet) + $TrustedClientNetworks
|
||||
|
||||
$sourceRoot = $PSScriptRoot
|
||||
if (-not $Resume) {
|
||||
@@ -383,6 +480,8 @@ if (-not $existingState) {
|
||||
PrefixLength = $PrefixLength
|
||||
NetworkInterfaceAlias = $NetworkInterfaceAlias
|
||||
DefaultGateway = if ($DefaultGateway) { $DefaultGateway.IPAddressToString } else { $null }
|
||||
NetworkConfigurationMode = $NetworkConfigurationMode
|
||||
TrustedClientNetworks = $TrustedClientNetworks
|
||||
DnsForwarders = @($DnsForwarders | ForEach-Object IPAddressToString)
|
||||
DomainName = $DomainName
|
||||
DomainNetbios = $DomainNetbios
|
||||
@@ -396,9 +495,16 @@ if (-not $existingState) {
|
||||
[Text.UTF8Encoding]::new($false))
|
||||
}
|
||||
|
||||
Write-BootstrapLog "Configuring $NetworkInterfaceAlias as $ServerIPv4Address/$PrefixLength."
|
||||
Set-StaticDomainAddress -InterfaceAlias $NetworkInterfaceAlias `
|
||||
-Address $ServerIPv4Address -NetworkPrefixLength $PrefixLength -Gateway $DefaultGateway
|
||||
if ($NetworkConfigurationMode -eq 'PlatformManaged') {
|
||||
Write-BootstrapLog "Validating platform-managed address $ServerIPv4Address/$PrefixLength on $NetworkInterfaceAlias without changing DHCP, routes, or the Azure NIC."
|
||||
Assert-PlatformManagedDomainAddress -InterfaceAlias $NetworkInterfaceAlias `
|
||||
-Address $ServerIPv4Address -NetworkPrefixLength $PrefixLength
|
||||
}
|
||||
else {
|
||||
Write-BootstrapLog "Configuring $NetworkInterfaceAlias as $ServerIPv4Address/$PrefixLength."
|
||||
Set-StaticDomainAddress -InterfaceAlias $NetworkInterfaceAlias `
|
||||
-Address $ServerIPv4Address -NetworkPrefixLength $PrefixLength -Gateway $DefaultGateway
|
||||
}
|
||||
|
||||
$computer = Get-CimInstance Win32_ComputerSystem
|
||||
if (-not $computer.PartOfDomain) {
|
||||
@@ -472,8 +578,17 @@ Wait-ActiveDirectoryReady -ExpectedBaseDn $baseDn
|
||||
$domainProfile = Get-NetConnectionProfile -InterfaceAlias $NetworkInterfaceAlias `
|
||||
-ErrorAction SilentlyContinue
|
||||
if (-not $domainProfile -or $domainProfile.NetworkCategory -ne 'DomainAuthenticated') {
|
||||
Write-BootstrapLog "Refreshing $NetworkInterfaceAlias so Windows detects the domain network profile."
|
||||
Restart-NetAdapter -Name $NetworkInterfaceAlias -Confirm:$false
|
||||
if ($NetworkConfigurationMode -eq 'GuestStatic') {
|
||||
Write-BootstrapLog "Refreshing $NetworkInterfaceAlias so Windows detects the domain network profile."
|
||||
Restart-NetAdapter -Name $NetworkInterfaceAlias -Confirm:$false
|
||||
}
|
||||
else {
|
||||
# Restarting an Azure NIC from inside the guest can sever the only
|
||||
# management path. Refresh NLA instead; this does not change the
|
||||
# platform-managed address, DHCP lease, route, or link state.
|
||||
Write-BootstrapLog 'Refreshing Network Location Awareness without restarting the Azure adapter.'
|
||||
Restart-Service NlaSvc -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
for ($attempt = 1; $attempt -le 15; $attempt++) {
|
||||
Start-Sleep -Seconds 2
|
||||
$domainProfile = Get-NetConnectionProfile -InterfaceAlias $NetworkInterfaceAlias `
|
||||
@@ -577,7 +692,7 @@ if (Test-Path -LiteralPath $brokerConfigurationPath -PathType Leaf) {
|
||||
-RemoteDesktopGroupDn $remoteDesktopGroup.DistinguishedName `
|
||||
-DefaultCompany 'La Salle' `
|
||||
-FirewallLocalAddress $ServerIPv4Address `
|
||||
-FirewallRemoteAddress "$($ServerIPv4Address.IPAddressToString)/$PrefixLength" `
|
||||
-FirewallRemoteAddress $allowedRemoteAddresses `
|
||||
-CreateMissingOus `
|
||||
-DisableCertificateRevocationCheckForLab | Out-Null
|
||||
|
||||
@@ -591,9 +706,8 @@ foreach ($hostRecord in $hostRecords) {
|
||||
}
|
||||
}
|
||||
|
||||
$privateSubnet = "$($ServerIPv4Address.IPAddressToString)/$PrefixLength"
|
||||
& (Join-Path $scriptsRoot 'Enable-SguServerRemoteManagement.ps1') `
|
||||
-AllowedRemoteAddress $privateSubnet | Out-Null
|
||||
-AllowedRemoteAddress $allowedRemoteAddresses | Out-Null
|
||||
|
||||
$contentPath = Join-Path $bootstrapRoot 'payload\server-content\Packages'
|
||||
if (Test-Path -LiteralPath $contentPath -PathType Container) {
|
||||
@@ -613,7 +727,7 @@ if (-not $packageFirewallRule) {
|
||||
-Protocol TCP `
|
||||
-LocalPort 445 `
|
||||
-LocalAddress $ServerIPv4Address.IPAddressToString `
|
||||
-RemoteAddress $privateSubnet `
|
||||
-RemoteAddress $allowedRemoteAddresses `
|
||||
-Profile Any | Out-Null
|
||||
}
|
||||
else {
|
||||
@@ -621,7 +735,7 @@ else {
|
||||
$packageFirewallRule | Get-NetFirewallAddressFilter |
|
||||
Set-NetFirewallAddressFilter `
|
||||
-LocalAddress $ServerIPv4Address.IPAddressToString `
|
||||
-RemoteAddress $privateSubnet | Out-Null
|
||||
-RemoteAddress $allowedRemoteAddresses | Out-Null
|
||||
}
|
||||
|
||||
$collectorFqdn = "$env:COMPUTERNAME.$DomainName"
|
||||
@@ -642,7 +756,7 @@ $userPolicyParameters = @{
|
||||
|
||||
$rustDeskServer = & (Join-Path $scriptsRoot 'Install-SguRustDeskServer.ps1') `
|
||||
-ServerAddress $rustDeskDnsName `
|
||||
-FirewallRemoteAddress $privateSubnet
|
||||
-FirewallRemoteAddress $allowedRemoteAddresses
|
||||
$rustDeskManagementRoot = Join-Path $env:ProgramData 'SGU\RustDesk'
|
||||
New-Item -ItemType Directory -Path $rustDeskManagementRoot -Force | Out-Null
|
||||
foreach ($scriptName in @(
|
||||
@@ -680,6 +794,9 @@ $validation = [ordered]@{
|
||||
ComputerName = $env:COMPUTERNAME
|
||||
DomainName = $DomainName
|
||||
ServerIPv4Address = $ServerIPv4Address.IPAddressToString
|
||||
NetworkConfigurationMode = $NetworkConfigurationMode
|
||||
TrustedClientNetworks = $TrustedClientNetworks
|
||||
AllowedRemoteAddresses = $allowedRemoteAddresses
|
||||
BrokerDnsName = $brokerDnsName
|
||||
BrokerCertificateThumbprint = $serverCertificate.Thumbprint
|
||||
BrokerService = (Get-Service SGUAuthBroker).Status.ToString()
|
||||
@@ -714,7 +831,8 @@ if ($validation.BrokerService -ne 'Running' -or
|
||||
-not $validation.RustDeskHbbsListening -or
|
||||
-not $validation.RustDeskHbbrListening -or
|
||||
$validation.EventCollector -ne 'Running' -or
|
||||
-not $validation.EventSubscription) {
|
||||
-not $validation.EventSubscription -or
|
||||
$validation.DomainNetworkProfile -ne 'DomainAuthenticated') {
|
||||
throw 'Server finalization did not pass service validation. Review bootstrap.log and re-run the bootstrap.'
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,123 @@
|
||||
#Requires -Version 5.1
|
||||
#Requires -RunAsAdministrator
|
||||
[CmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$VpnProfilePackagePath,
|
||||
[Parameter(Mandatory)][string]$ClientCertificatePfxPath,
|
||||
[securestring]$ClientCertificatePfxPassword,
|
||||
[Parameter(Mandatory)][string]$ClientRootCertificatePath,
|
||||
[string]$ConnectionName = 'SGU Azure P2S',
|
||||
[string[]]$AzureNetworkPrefixes = @('10.77.0.0/16'),
|
||||
[ipaddress]$DomainControllerIPv4Address = '10.77.0.4',
|
||||
[string]$DomainName = 'lci.lasalle.mx',
|
||||
[switch]$Connect
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
foreach ($path in @($VpnProfilePackagePath,$ClientCertificatePfxPath,$ClientRootCertificatePath)) {
|
||||
if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
|
||||
throw "Required P2S file not found: $path"
|
||||
}
|
||||
}
|
||||
if (-not $ClientCertificatePfxPassword) {
|
||||
$ClientCertificatePfxPassword = Read-Host 'Password protecting the P2S client PFX' -AsSecureString
|
||||
}
|
||||
|
||||
$temporaryRoot = Join-Path $env:ProgramData ("SGU\AzureP2S\Import-" + [Guid]::NewGuid().ToString('N'))
|
||||
try {
|
||||
Expand-Archive -LiteralPath $VpnProfilePackagePath -DestinationPath $temporaryRoot -Force
|
||||
$vpnSettingsPath = Get-ChildItem -LiteralPath $temporaryRoot -Recurse -Filter VpnSettings.xml -File |
|
||||
Select-Object -First 1 -ExpandProperty FullName
|
||||
if (-not $vpnSettingsPath) {
|
||||
throw 'The Azure package does not contain Generic\VpnSettings.xml. Generate it with IKEv2 enabled.'
|
||||
}
|
||||
[xml]$vpnSettings = Get-Content -LiteralPath $vpnSettingsPath -Raw
|
||||
$vpnServerNode = $vpnSettings.SelectSingleNode('//*[local-name()="VpnServer"]')
|
||||
if (-not $vpnServerNode -or [string]::IsNullOrWhiteSpace($vpnServerNode.InnerText)) {
|
||||
throw 'VpnSettings.xml does not contain the Azure VPN gateway FQDN.'
|
||||
}
|
||||
$vpnServer = $vpnServerNode.InnerText.Trim()
|
||||
|
||||
$serverRootPath = Get-ChildItem -LiteralPath (Split-Path $vpnSettingsPath -Parent) `
|
||||
-Filter VpnServerRoot.cer -File | Select-Object -First 1 -ExpandProperty FullName
|
||||
if ($serverRootPath) {
|
||||
Import-Certificate -FilePath $serverRootPath -CertStoreLocation Cert:\LocalMachine\Root | Out-Null
|
||||
}
|
||||
$clientRoot = Import-Certificate -FilePath $ClientRootCertificatePath `
|
||||
-CertStoreLocation Cert:\LocalMachine\Root | Select-Object -First 1
|
||||
$clientCertificates = @(Import-PfxCertificate -FilePath $ClientCertificatePfxPath `
|
||||
-Password $ClientCertificatePfxPassword -CertStoreLocation Cert:\LocalMachine\My)
|
||||
$clientCertificate = $clientCertificates |
|
||||
Where-Object {
|
||||
$_.HasPrivateKey -and
|
||||
$_.NotAfter -gt (Get-Date) -and
|
||||
@($_.EnhancedKeyUsageList | ForEach-Object ObjectId) -contains '1.3.6.1.5.5.7.3.2'
|
||||
} |
|
||||
Sort-Object NotAfter -Descending |
|
||||
Select-Object -First 1
|
||||
if (-not $clientCertificate) {
|
||||
throw 'The imported PFX does not contain a valid Client Authentication certificate with a private key.'
|
||||
}
|
||||
|
||||
if ($PSCmdlet.ShouldProcess($ConnectionName, 'Install an all-user IKEv2 Azure P2S connection using a machine certificate')) {
|
||||
$existingConnection = Get-VpnConnection -Name $ConnectionName -AllUserConnection `
|
||||
-ErrorAction SilentlyContinue
|
||||
if ($existingConnection) {
|
||||
Remove-VpnConnection -Name $ConnectionName -AllUserConnection -Force
|
||||
}
|
||||
Add-VpnConnection `
|
||||
-Name $ConnectionName `
|
||||
-ServerAddress $vpnServer `
|
||||
-TunnelType Ikev2 `
|
||||
-AuthenticationMethod MachineCertificate `
|
||||
-MachineCertificateIssuerFilter $clientRoot `
|
||||
-MachineCertificateEKUFilter '1.3.6.1.5.5.7.3.2' `
|
||||
-EncryptionLevel Required `
|
||||
-SplitTunneling `
|
||||
-AllUserConnection `
|
||||
-DnsSuffix $DomainName `
|
||||
-Force | Out-Null
|
||||
foreach ($prefix in $AzureNetworkPrefixes) {
|
||||
Add-VpnConnectionRoute -ConnectionName $ConnectionName `
|
||||
-DestinationPrefix $prefix -AllUserConnection -PassThru | Out-Null
|
||||
}
|
||||
|
||||
$nrptDisplayName = "SGU Azure P2S DNS - $DomainName"
|
||||
Get-DnsClientNrptRule -ErrorAction SilentlyContinue |
|
||||
Where-Object DisplayName -eq $nrptDisplayName |
|
||||
Remove-DnsClientNrptRule -Force
|
||||
Add-DnsClientNrptRule `
|
||||
-Namespace ".$DomainName" `
|
||||
-NameServers $DomainControllerIPv4Address.IPAddressToString `
|
||||
-DisplayName $nrptDisplayName `
|
||||
-Comment 'Managed by SGU Azure P2S bootstrap; routes only the AD namespace to the domain controller.' | Out-Null
|
||||
}
|
||||
|
||||
if ($Connect) {
|
||||
& "$env:SystemRoot\System32\rasdial.exe" $ConnectionName
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Windows could not connect $ConnectionName. Verify UDP 500/4500 (IKEv2) or use the Azure-generated SSTP profile when the local network blocks IKEv2."
|
||||
}
|
||||
}
|
||||
|
||||
$connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection
|
||||
[pscustomobject]@{
|
||||
ConnectionName = $connection.Name
|
||||
ServerAddress = $connection.ServerAddress
|
||||
TunnelType = $connection.TunnelType
|
||||
AllUserConnection = $true
|
||||
AuthenticationMethod = $connection.AuthenticationMethod
|
||||
ConnectionStatus = $connection.ConnectionStatus
|
||||
ClientCertificateThumbprint = $clientCertificate.Thumbprint
|
||||
DomainControllerIPv4Address = $DomainControllerIPv4Address.IPAddressToString
|
||||
DomainDnsNamespace = ".$DomainName"
|
||||
AzureNetworkPrefixes = $AzureNetworkPrefixes
|
||||
AvailableBeforeLogon = $true
|
||||
}
|
||||
}
|
||||
finally {
|
||||
$ClientCertificatePfxPassword = $null
|
||||
if (Test-Path -LiteralPath $temporaryRoot) {
|
||||
Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
@@ -6,7 +6,8 @@ param(
|
||||
|
||||
[string]$InstallRoot = "$env:ProgramFiles\SGU\RustDeskServer",
|
||||
[string]$DataRoot = "$env:ProgramData\SGU\RustDesk\Server",
|
||||
[string]$FirewallRemoteAddress = '192.168.50.0/24',
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[string[]]$FirewallRemoteAddress = @('192.168.50.0/24'),
|
||||
[uri]$DownloadUri = 'https://github.com/rustdesk/rustdesk-server/releases/download/1.1.16/rustdesk-server-windows-x86_64-unsigned.zip',
|
||||
[ValidatePattern('^[A-Fa-f0-9]{64}$')]
|
||||
[string]$ExpectedSha256 = 'B865A3A62FC8755B45480C508F1C4871C3338590408DDA8C58C7E9C373B7ADB0'
|
||||
|
||||
@@ -8,6 +8,14 @@ param(
|
||||
[string]$DomainNetbios = 'LCI',
|
||||
[string]$ComputerOuDn,
|
||||
[string]$NewComputerName,
|
||||
[ValidateSet('Direct', 'AzureP2S')]
|
||||
[string]$ConnectivityMode = 'Direct',
|
||||
[string]$VpnConnectionName = 'SGU Azure P2S',
|
||||
[string]$VpnProfilePackagePath,
|
||||
[string]$VpnClientCertificatePfxPath,
|
||||
[securestring]$VpnClientCertificatePfxPassword,
|
||||
[string]$VpnClientRootCertificatePath,
|
||||
[string[]]$AzureNetworkPrefixes = @('10.77.0.0/16'),
|
||||
[switch]$SkipRestart
|
||||
)
|
||||
|
||||
@@ -95,6 +103,30 @@ function Test-TcpPort {
|
||||
}
|
||||
}
|
||||
|
||||
function Connect-SguAzureP2s {
|
||||
param([Parameter(Mandatory)][string]$ConnectionName)
|
||||
|
||||
$connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection `
|
||||
-ErrorAction SilentlyContinue
|
||||
if (-not $connection) {
|
||||
throw "The all-user VPN connection '$ConnectionName' is not installed. Run Install-SguAzureP2sClient.ps1 in this VM first."
|
||||
}
|
||||
if ($connection.TunnelType -notcontains 'Ikev2' -and $connection.TunnelType -ne 'Ikev2') {
|
||||
throw "The VPN connection '$ConnectionName' is not configured for IKEv2."
|
||||
}
|
||||
if ($connection.ConnectionStatus -ne 'Connected') {
|
||||
& "$env:SystemRoot\System32\rasdial.exe" $ConnectionName
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Could not connect the Azure P2S profile '$ConnectionName'. Verify the machine certificate and that UDP 500/4500 is permitted by the local network."
|
||||
}
|
||||
}
|
||||
$connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection
|
||||
if ($connection.ConnectionStatus -ne 'Connected') {
|
||||
throw "The Azure P2S profile '$ConnectionName' did not reach Connected state."
|
||||
}
|
||||
return $connection
|
||||
}
|
||||
|
||||
Assert-Administrator
|
||||
$operatingSystem = Get-CimInstance Win32_OperatingSystem
|
||||
if ([int]$operatingSystem.ProductType -ne 1) {
|
||||
@@ -135,9 +167,52 @@ if (-not $runtimeInstaller) {
|
||||
throw 'The offline Microsoft .NET 10 x64 runtime installer is missing from the client package.'
|
||||
}
|
||||
|
||||
$NetworkInterfaceAlias = Resolve-ClientInterfaceAlias -RequestedAlias $NetworkInterfaceAlias
|
||||
Set-DnsClientServerAddress -InterfaceAlias $NetworkInterfaceAlias `
|
||||
-ServerAddresses $DomainControllerIPv4Address.IPAddressToString
|
||||
if ($ConnectivityMode -eq 'AzureP2S') {
|
||||
$existingVpnConnection = Get-VpnConnection -Name $VpnConnectionName -AllUserConnection `
|
||||
-ErrorAction SilentlyContinue
|
||||
if (-not $existingVpnConnection) {
|
||||
$installerPath = Join-Path $packageRoot 'Install-SguAzureP2sClient.ps1'
|
||||
if (-not (Test-Path -LiteralPath $installerPath -PathType Leaf)) {
|
||||
throw 'Install-SguAzureP2sClient.ps1 is missing from the client bootstrap package.'
|
||||
}
|
||||
foreach ($vpnInput in @(
|
||||
@{ Name = 'VpnProfilePackagePath'; Value = $VpnProfilePackagePath },
|
||||
@{ Name = 'VpnClientCertificatePfxPath'; Value = $VpnClientCertificatePfxPath },
|
||||
@{ Name = 'VpnClientRootCertificatePath'; Value = $VpnClientRootCertificatePath })) {
|
||||
if ([string]::IsNullOrWhiteSpace([string]$vpnInput.Value)) {
|
||||
throw "$($vpnInput.Name) is required the first time an Azure P2S client is enrolled."
|
||||
}
|
||||
}
|
||||
$vpnInstallParameters = @{
|
||||
VpnProfilePackagePath = $VpnProfilePackagePath
|
||||
ClientCertificatePfxPath = $VpnClientCertificatePfxPath
|
||||
ClientRootCertificatePath = $VpnClientRootCertificatePath
|
||||
ConnectionName = $VpnConnectionName
|
||||
AzureNetworkPrefixes = $AzureNetworkPrefixes
|
||||
DomainControllerIPv4Address = $DomainControllerIPv4Address
|
||||
DomainName = $DomainName
|
||||
}
|
||||
if ($VpnClientCertificatePfxPassword) {
|
||||
$vpnInstallParameters.ClientCertificatePfxPassword = $VpnClientCertificatePfxPassword
|
||||
}
|
||||
& $installerPath @vpnInstallParameters | Out-Null
|
||||
}
|
||||
$vpnConnection = Connect-SguAzureP2s -ConnectionName $VpnConnectionName
|
||||
$nrptDisplayName = "SGU Azure P2S DNS - $DomainName"
|
||||
$nrptRule = Get-DnsClientNrptRule -ErrorAction SilentlyContinue |
|
||||
Where-Object DisplayName -eq $nrptDisplayName |
|
||||
Select-Object -First 1
|
||||
if (-not $nrptRule -or
|
||||
@($nrptRule.NameServers) -notcontains $DomainControllerIPv4Address.IPAddressToString) {
|
||||
throw "The SGU NRPT rule for $DomainName is missing or does not point to $DomainControllerIPv4Address. Re-run Install-SguAzureP2sClient.ps1."
|
||||
}
|
||||
$NetworkInterfaceAlias = $vpnConnection.Name
|
||||
}
|
||||
else {
|
||||
$NetworkInterfaceAlias = Resolve-ClientInterfaceAlias -RequestedAlias $NetworkInterfaceAlias
|
||||
Set-DnsClientServerAddress -InterfaceAlias $NetworkInterfaceAlias `
|
||||
-ServerAddresses $DomainControllerIPv4Address.IPAddressToString
|
||||
}
|
||||
|
||||
if (-not (Test-TcpPort -Address $DomainControllerIPv4Address -Port 5985)) {
|
||||
throw "The domain controller at $DomainControllerIPv4Address is not accepting WinRM on TCP 5985. Run the server bootstrap first and verify the selected IP."
|
||||
@@ -292,6 +367,7 @@ try {
|
||||
ComputerOuDn = $ComputerOuDn
|
||||
NetworkInterfaceAlias = $NetworkInterfaceAlias
|
||||
DomainDnsServerAddresses = @($DomainControllerIPv4Address.IPAddressToString)
|
||||
ConnectivityMode = $ConnectivityMode
|
||||
RemoteDesktopPrincipal = "$DomainNetbios\SG-Laboratorio-Usuarios-RDP"
|
||||
DotNetRuntimeInstallerPath = $runtimeInstaller.FullName
|
||||
RustDeskServerAddress = $serverIdentity.RustDeskServerAddress
|
||||
@@ -356,6 +432,7 @@ finally {
|
||||
}
|
||||
Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue
|
||||
$DomainCredential = $null
|
||||
$VpnClientCertificatePfxPassword = $null
|
||||
}
|
||||
|
||||
if ($SkipRestart) {
|
||||
@@ -365,6 +442,8 @@ if ($SkipRestart) {
|
||||
ProviderInstalled = $true
|
||||
ClientCertificateRegistered = $true
|
||||
BrokerEndpoint = $brokerEndpoint
|
||||
ConnectivityMode = $ConnectivityMode
|
||||
VpnConnectionName = if ($ConnectivityMode -eq 'AzureP2S') { $VpnConnectionName } else { $null }
|
||||
RestartRequired = $true
|
||||
RustDesk = if ($result) { $result.RustDesk } else { $null }
|
||||
EnrollmentResult = $result
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
#Requires -Version 5.1
|
||||
[CmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[ValidatePattern('^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$')]
|
||||
[string]$ClientName,
|
||||
[string]$OutputDirectory = (Join-Path $PSScriptRoot '..\artifacts\azure-p2s'),
|
||||
[securestring]$ClientPfxPassword,
|
||||
[string]$RootSubject = 'CN=SGU Azure P2S Root',
|
||||
[ValidateRange(1, 10)]
|
||||
[int]$ClientValidityYears = 2,
|
||||
[switch]$Force
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$resolvedOutputDirectory = [IO.Path]::GetFullPath($OutputDirectory)
|
||||
New-Item -ItemType Directory -Path $resolvedOutputDirectory -Force | Out-Null
|
||||
$rootCertificatePath = Join-Path $resolvedOutputDirectory 'sgu-azure-p2s-root.cer'
|
||||
$clientCertificatePath = Join-Path $resolvedOutputDirectory "sgu-azure-p2s-$ClientName.pfx"
|
||||
if ((Test-Path -LiteralPath $clientCertificatePath -PathType Leaf) -and -not $Force) {
|
||||
throw "$clientCertificatePath already exists. Use -Force only when you intend to replace that exported client credential."
|
||||
}
|
||||
|
||||
if (-not $ClientPfxPassword) {
|
||||
$ClientPfxPassword = Read-Host 'Password that will protect the exported P2S client certificate' -AsSecureString
|
||||
}
|
||||
|
||||
$rootCertificate = Get-ChildItem Cert:\CurrentUser\My |
|
||||
Where-Object {
|
||||
$_.Subject -eq $RootSubject -and
|
||||
$_.HasPrivateKey -and
|
||||
$_.NotAfter -gt (Get-Date).AddYears($ClientValidityYears)
|
||||
} |
|
||||
Sort-Object NotAfter -Descending |
|
||||
Select-Object -First 1
|
||||
|
||||
if (-not $rootCertificate) {
|
||||
if (-not $PSCmdlet.ShouldProcess($RootSubject, 'Create a non-exportable Azure P2S root certificate authority')) {
|
||||
return
|
||||
}
|
||||
$rootCertificate = New-SelfSignedCertificate `
|
||||
-Type Custom `
|
||||
-Subject $RootSubject `
|
||||
-CertStoreLocation Cert:\CurrentUser\My `
|
||||
-KeyAlgorithm RSA `
|
||||
-KeyLength 4096 `
|
||||
-HashAlgorithm SHA256 `
|
||||
-KeySpec Signature `
|
||||
-KeyExportPolicy NonExportable `
|
||||
-KeyUsage CertSign,CRLSign,DigitalSignature `
|
||||
-NotAfter (Get-Date).AddYears(10) `
|
||||
-TextExtension @('2.5.29.19={critical}{text}ca=1&pathlength=1')
|
||||
}
|
||||
|
||||
if (-not $PSCmdlet.ShouldProcess($ClientName, 'Issue and export an Azure P2S machine certificate')) {
|
||||
return
|
||||
}
|
||||
|
||||
$clientSubject = "CN=SGU Azure P2S $ClientName"
|
||||
$clientCertificate = New-SelfSignedCertificate `
|
||||
-Type Custom `
|
||||
-Subject $clientSubject `
|
||||
-DnsName "sgu-p2s-$ClientName" `
|
||||
-Signer $rootCertificate `
|
||||
-CertStoreLocation Cert:\CurrentUser\My `
|
||||
-KeyAlgorithm RSA `
|
||||
-KeyLength 3072 `
|
||||
-HashAlgorithm SHA256 `
|
||||
-KeySpec Signature `
|
||||
-KeyExportPolicy Exportable `
|
||||
-KeyUsage DigitalSignature `
|
||||
-NotAfter (Get-Date).AddYears($ClientValidityYears) `
|
||||
-TextExtension @('2.5.29.37={text}1.3.6.1.5.5.7.3.2')
|
||||
|
||||
Export-Certificate -Cert $rootCertificate -FilePath $rootCertificatePath -Force | Out-Null
|
||||
Export-PfxCertificate -Cert $clientCertificate -FilePath $clientCertificatePath `
|
||||
-Password $ClientPfxPassword -ChainOption BuildChain -CryptoAlgorithmOption AES256_SHA256 `
|
||||
-Force | Out-Null
|
||||
|
||||
[pscustomobject]@{
|
||||
RootCertificatePath = $rootCertificatePath
|
||||
RootCertificateThumbprint = $rootCertificate.Thumbprint
|
||||
RootCertificateData = [Convert]::ToBase64String($rootCertificate.RawData)
|
||||
ClientName = $ClientName
|
||||
ClientCertificatePath = $clientCertificatePath
|
||||
ClientCertificateThumbprint = $clientCertificate.Thumbprint
|
||||
ClientCertificateExpires = $clientCertificate.NotAfter
|
||||
RootPrivateKeyExportable = $false
|
||||
}
|
||||
@@ -81,16 +81,18 @@ New-Item -ItemType Directory -Path $resolvedOutputRoot -Force | Out-Null
|
||||
$clientRoot = Join-Path $resolvedOutputRoot "sgu-client-bootstrap-$Version"
|
||||
$serverRoot = Join-Path $resolvedOutputRoot "sgu-server-bootstrap-$Version"
|
||||
$linuxClientRoot = Join-Path $resolvedOutputRoot "sgu-linux-client-bootstrap-$Version"
|
||||
$azureRoot = Join-Path $resolvedOutputRoot "sgu-azure-infrastructure-$Version"
|
||||
$clientZip = "$clientRoot.zip"
|
||||
$serverZip = "$serverRoot.zip"
|
||||
$linuxClientZip = "$linuxClientRoot.zip"
|
||||
foreach ($target in @($clientRoot,$serverRoot,$linuxClientRoot,$clientZip,$serverZip,$linuxClientZip)) {
|
||||
$azureZip = "$azureRoot.zip"
|
||||
foreach ($target in @($clientRoot,$serverRoot,$linuxClientRoot,$azureRoot,$clientZip,$serverZip,$linuxClientZip,$azureZip)) {
|
||||
if (Test-Path -LiteralPath $target) {
|
||||
throw "Release target already exists: $target"
|
||||
}
|
||||
}
|
||||
|
||||
New-Item -ItemType Directory -Path $clientRoot,$serverRoot,$linuxClientRoot -Force | Out-Null
|
||||
New-Item -ItemType Directory -Path $clientRoot,$serverRoot,$linuxClientRoot,$azureRoot -Force | Out-Null
|
||||
$welcomeFontNames = @(
|
||||
'IndivisaTextSans-Regular.otf',
|
||||
'IndivisaTextSans-Bold.otf',
|
||||
@@ -103,6 +105,10 @@ Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Invoke-SguClientBootstrap.ps
|
||||
-Destination (Join-Path $clientRoot 'Invoke-SguClientBootstrap.ps1')
|
||||
Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Start-SguClientEnrollment.cmd') `
|
||||
-Destination (Join-Path $clientRoot 'Start-SguClientEnrollment.cmd')
|
||||
Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Start-SguAzureClientEnrollment.cmd') `
|
||||
-Destination (Join-Path $clientRoot 'Start-SguAzureClientEnrollment.cmd')
|
||||
Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Install-SguAzureP2sClient.ps1') `
|
||||
-Destination (Join-Path $clientRoot 'Install-SguAzureP2sClient.ps1')
|
||||
$clientScripts = @(
|
||||
'Enable-LabRemoteAccess.ps1',
|
||||
'Enable-SguClientMonitoring.ps1',
|
||||
@@ -163,6 +169,8 @@ Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Initialize-SguDomainControll
|
||||
-Destination (Join-Path $serverRoot 'Initialize-SguDomainController.ps1')
|
||||
Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Start-SguServerBootstrap.cmd') `
|
||||
-Destination (Join-Path $serverRoot 'Start-SguServerBootstrap.cmd')
|
||||
Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Start-SguAzureServerBootstrap.cmd') `
|
||||
-Destination (Join-Path $serverRoot 'Start-SguAzureServerBootstrap.cmd')
|
||||
$serverScripts = @(
|
||||
'Deploy-AuthBroker.ps1',
|
||||
'Enable-SguServerRemoteManagement.ps1',
|
||||
@@ -211,10 +219,32 @@ Write-PackageManifest -PackageRoot $serverRoot -PackageVersion $Version -Package
|
||||
Compress-Archive -Path (Join-Path $serverRoot '*') -DestinationPath $serverZip `
|
||||
-CompressionLevel Optimal
|
||||
|
||||
# Azure infrastructure is packaged separately because it runs on the trusted
|
||||
# administrator workstation, not inside the domain controller or a client.
|
||||
$azureScriptsRoot = Join-Path $azureRoot 'scripts'
|
||||
$azureInfrastructureRoot = Join-Path $azureRoot 'infra\azure'
|
||||
New-Item -ItemType Directory -Path $azureScriptsRoot,$azureInfrastructureRoot -Force | Out-Null
|
||||
Copy-RequiredFile -Source (Join-Path $repositoryRoot 'infra\azure\main.bicep') `
|
||||
-Destination (Join-Path $azureInfrastructureRoot 'main.bicep')
|
||||
foreach ($scriptName in @(
|
||||
'New-SguAzureP2sCertificates.ps1',
|
||||
'Deploy-SguAzureInfrastructure.ps1',
|
||||
'Get-SguAzureP2sPackage.ps1',
|
||||
'Install-SguAzureP2sClient.ps1')) {
|
||||
Copy-RequiredFile -Source (Join-Path $PSScriptRoot $scriptName) `
|
||||
-Destination (Join-Path $azureScriptsRoot $scriptName)
|
||||
}
|
||||
Copy-RequiredFile -Source (Join-Path $repositoryRoot 'docs\azure-vpn-deployment.md') `
|
||||
-Destination (Join-Path $azureRoot 'README.md')
|
||||
Write-PackageManifest -PackageRoot $azureRoot -PackageVersion $Version -PackageKind AzureInfrastructure
|
||||
Compress-Archive -Path (Join-Path $azureRoot '*') -DestinationPath $azureZip `
|
||||
-CompressionLevel Optimal
|
||||
|
||||
$checksums = @(
|
||||
("{0} {1}" -f (Get-FileHash -LiteralPath $clientZip -Algorithm SHA256).Hash, (Split-Path $clientZip -Leaf))
|
||||
("{0} {1}" -f (Get-FileHash -LiteralPath $serverZip -Algorithm SHA256).Hash, (Split-Path $serverZip -Leaf))
|
||||
("{0} {1}" -f (Get-FileHash -LiteralPath $linuxClientZip -Algorithm SHA256).Hash, (Split-Path $linuxClientZip -Leaf))
|
||||
("{0} {1}" -f (Get-FileHash -LiteralPath $azureZip -Algorithm SHA256).Hash, (Split-Path $azureZip -Leaf))
|
||||
)
|
||||
$checksumsPath = Join-Path $resolvedOutputRoot "SHA256SUMS-$Version.txt"
|
||||
[IO.File]::WriteAllLines($checksumsPath, $checksums, [Text.UTF8Encoding]::new($false))
|
||||
@@ -227,6 +257,8 @@ $checksumsPath = Join-Path $resolvedOutputRoot "SHA256SUMS-$Version.txt"
|
||||
LinuxClientSha256 = (Get-FileHash -LiteralPath $linuxClientZip -Algorithm SHA256).Hash
|
||||
ServerPackage = $serverZip
|
||||
ServerSha256 = (Get-FileHash -LiteralPath $serverZip -Algorithm SHA256).Hash
|
||||
AzureInfrastructurePackage = $azureZip
|
||||
AzureInfrastructureSha256 = (Get-FileHash -LiteralPath $azureZip -Algorithm SHA256).Hash
|
||||
Checksums = $checksumsPath
|
||||
RuntimeInstaller = $runtimeInstaller.Name
|
||||
}
|
||||
|
||||
@@ -18,6 +18,7 @@ $assetPaths = @(
|
||||
(Join-Path $ReleaseDirectory "sgu-client-bootstrap-$Version.zip"),
|
||||
(Join-Path $ReleaseDirectory "sgu-server-bootstrap-$Version.zip"),
|
||||
(Join-Path $ReleaseDirectory "sgu-linux-client-bootstrap-$Version.zip"),
|
||||
(Join-Path $ReleaseDirectory "sgu-azure-infrastructure-$Version.zip"),
|
||||
(Join-Path $ReleaseDirectory "SHA256SUMS-$Version.txt")
|
||||
)
|
||||
foreach ($assetPath in $assetPaths) {
|
||||
@@ -27,7 +28,9 @@ foreach ($assetPath in $assetPaths) {
|
||||
}
|
||||
|
||||
$token = $env:GITEA_TOKEN
|
||||
if (-not $token) {
|
||||
$authorizationScheme = 'token'
|
||||
$authorizationParameter = $token
|
||||
if (-not $authorizationParameter) {
|
||||
$credentialInput = "protocol=$($GiteaBaseUri.Scheme)`nhost=$($GiteaBaseUri.Host)`n`n"
|
||||
$credentialOutput = $credentialInput | & git credential fill
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
@@ -40,17 +43,25 @@ if (-not $token) {
|
||||
$credentialValues[$parts[0]] = $parts[1]
|
||||
}
|
||||
}
|
||||
$token = $credentialValues.password
|
||||
if ($credentialValues.username -and $credentialValues.password) {
|
||||
$authorizationScheme = 'Basic'
|
||||
$basicCredential = '{0}:{1}' -f $credentialValues.username,$credentialValues.password
|
||||
$authorizationParameter = [Convert]::ToBase64String(
|
||||
[Text.Encoding]::UTF8.GetBytes($basicCredential))
|
||||
$basicCredential = $null
|
||||
}
|
||||
}
|
||||
if (-not $token) {
|
||||
throw 'No Gitea token is available. Set GITEA_TOKEN for this process or sign in through Git Credential Manager.'
|
||||
if (-not $authorizationParameter) {
|
||||
throw 'No Gitea credential is available. Set GITEA_TOKEN for this process or sign in through Git Credential Manager.'
|
||||
}
|
||||
|
||||
Add-Type -AssemblyName System.Net.Http
|
||||
$handler = [Net.Http.HttpClientHandler]::new()
|
||||
$client = [Net.Http.HttpClient]::new($handler)
|
||||
$client.BaseAddress = [uri]($GiteaBaseUri.AbsoluteUri.TrimEnd('/') + '/')
|
||||
$client.DefaultRequestHeaders.Authorization = [Net.Http.Headers.AuthenticationHeaderValue]::new('token', $token)
|
||||
$client.DefaultRequestHeaders.Authorization = [Net.Http.Headers.AuthenticationHeaderValue]::new(
|
||||
$authorizationScheme,
|
||||
$authorizationParameter)
|
||||
$client.DefaultRequestHeaders.UserAgent.ParseAdd('SGU-CredentialProvider-Release/1.0')
|
||||
|
||||
function Invoke-GiteaJson {
|
||||
@@ -102,6 +113,11 @@ Bootstrap reproducible para el laboratorio SGU.
|
||||
- `sgu-server-bootstrap-$Version.zip`: crea el bosque AD/DNS, OUs, grupo RDP, GPO, recurso `Packages`, broker mTLS y administración remota; se reanuda solo después del reinicio.
|
||||
- `sgu-client-bootstrap-$Version.zip`: registra un certificado mTLS único, instala y valida el Credential Provider antes de unir el equipo al dominio, habilita RDP/WinRM y se repara al arranque.
|
||||
- `sgu-linux-client-bootstrap-$Version.zip`: une clientes Debian/Ubuntu o RHEL/Fedora/Rocky/AlmaLinux con realmd, Kerberos y SSSD. Solicita interactivamente la contraseña de unión y no instala el Credential Provider de Windows.
|
||||
- `sgu-azure-infrastructure-$Version.zip`: despliega mediante Bicep una VM Windows Server 2025, red privada, IP pública protegida por NSG y Azure VPN Gateway P2S; también genera certificados por equipo y descarga el perfil de cliente.
|
||||
- El bootstrap Azure conserva la IP privada administrada por la NIC de Azure, autoriza el pool P2S en los firewalls SGU y nunca publica LDAP, Kerberos, SMB, RPC, WinRM ni el Auth Broker directamente a Internet.
|
||||
- Los Windows 11 Pro pueden instalar un perfil IKEv2 de todos los usuarios con certificado de máquina, DNS dividido para `lci.lasalle.mx` y ejecutarlo desde la pantalla de inicio de sesión antes de autenticar una cuenta de dominio nueva.
|
||||
- El Auth Broker clasifica sin tareas programadas cada cuenta autenticada: `AL` se agrega a `SGU-Alumnos`, `AD` a `SGU-Administrativos` y `DO` a `SGU-Docentes`; el bootstrap crea cada grupo dentro de la OU de su rol y migra idempotentemente cualquier grupo heredado sin cambiar su SID.
|
||||
- El enriquecimiento obtiene el sexo de los módulos SGU de personal/alumnos, lo conserva como la línea administrada `SGU-Gender: Male|Female` en Notas de AD y adapta el fondo de Windows/Linux; cuando falta utiliza redacción neutral.
|
||||
- El servidor configura WEF/WEC para registrar sesiones y fallos, inventariar el estado alcanzable de las máquinas cada cinco minutos y conservar durante 183 días tanto esos eventos como el diagnóstico estructurado del Auth Broker.
|
||||
- Windows Home se detecta y se rechaza con una explicación, ya que no admite unión a Active Directory ni RDP host.
|
||||
|
||||
@@ -154,6 +170,8 @@ Las contraseñas se solicitan de forma interactiva y no se escriben en archivos
|
||||
}
|
||||
finally {
|
||||
$token = $null
|
||||
$authorizationParameter = $null
|
||||
$credentialValues = $null
|
||||
$client.Dispose()
|
||||
$handler.Dispose()
|
||||
}
|
||||
|
||||
@@ -8,6 +8,8 @@ param(
|
||||
[string]$ComputerName = $env:COMPUTERNAME,
|
||||
[string]$Location,
|
||||
[string]$OrganizationalUnit,
|
||||
[ValidateSet('Male', 'Female')]
|
||||
[string]$Gender,
|
||||
[ValidateRange(640, 16384)]
|
||||
[int]$CanvasWidth,
|
||||
[ValidateRange(480, 16384)]
|
||||
@@ -67,6 +69,22 @@ function Get-ImmediateOrganizationalUnit {
|
||||
return $null
|
||||
}
|
||||
|
||||
function Get-SguGenderFromInfo {
|
||||
param([string]$Info)
|
||||
|
||||
if (-not $Info) {
|
||||
return $null
|
||||
}
|
||||
|
||||
foreach ($line in $Info -split '\r?\n') {
|
||||
if ($line -match '^\s*SGU-Gender:\s*(Male|Female)\s*$') {
|
||||
return [Globalization.CultureInfo]::InvariantCulture.TextInfo.ToTitleCase(
|
||||
$Matches[1].ToLowerInvariant())
|
||||
}
|
||||
}
|
||||
return $null
|
||||
}
|
||||
|
||||
function Get-DirectoryWelcomeMetadata {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$UserName,
|
||||
@@ -93,6 +111,7 @@ function Get-DirectoryWelcomeMetadata {
|
||||
$userSearcher.Filter = '(&(objectCategory=person)(objectClass=user)(sAMAccountName={0}))' -f `
|
||||
(ConvertTo-LdapFilterValue -Value $UserName)
|
||||
[void]$userSearcher.PropertiesToLoad.Add('displayName')
|
||||
[void]$userSearcher.PropertiesToLoad.Add('info')
|
||||
$userResult = $userSearcher.FindOne()
|
||||
$directoryDisplayName = if ($userResult -and $userResult.Properties['displayname'].Count) {
|
||||
[string]$userResult.Properties['displayname'][0]
|
||||
@@ -100,6 +119,12 @@ function Get-DirectoryWelcomeMetadata {
|
||||
else {
|
||||
$null
|
||||
}
|
||||
$directoryGender = if ($userResult -and $userResult.Properties['info'].Count) {
|
||||
Get-SguGenderFromInfo -Info ([string]$userResult.Properties['info'][0])
|
||||
}
|
||||
else {
|
||||
$null
|
||||
}
|
||||
}
|
||||
finally {
|
||||
$userSearcher.Dispose()
|
||||
@@ -136,6 +161,7 @@ function Get-DirectoryWelcomeMetadata {
|
||||
|
||||
[pscustomobject]@{
|
||||
DisplayName = $directoryDisplayName
|
||||
Gender = $directoryGender
|
||||
Location = $directoryLocation
|
||||
OrganizationalUnit = Get-ImmediateOrganizationalUnit -DistinguishedName $computerDn
|
||||
}
|
||||
@@ -156,11 +182,20 @@ function Get-SpanishArticle {
|
||||
function Get-WelcomeLocationText {
|
||||
param(
|
||||
[string]$Room,
|
||||
[string]$OuName
|
||||
[string]$OuName,
|
||||
[string]$Gender
|
||||
)
|
||||
|
||||
$located = 'Est{0}s ubicado en' -f [char]0x00E1
|
||||
$engineeringLab = 'Bienvenido al Laboratorio de C{0}mputo de Ingenier{1}a.' -f [char]0x00F3,[char]0x00ED
|
||||
$located = switch ($Gender) {
|
||||
'Male' { 'Est{0}s ubicado en' -f [char]0x00E1 }
|
||||
'Female' { 'Est{0}s ubicada en' -f [char]0x00E1 }
|
||||
default { 'Ubicaci{0}n:' -f [char]0x00F3 }
|
||||
}
|
||||
$engineeringLab = switch ($Gender) {
|
||||
'Male' { 'Bienvenido al Laboratorio de C{0}mputo de Ingenier{1}a.' -f [char]0x00F3,[char]0x00ED }
|
||||
'Female' { 'Bienvenida al Laboratorio de C{0}mputo de Ingenier{1}a.' -f [char]0x00F3,[char]0x00ED }
|
||||
default { 'Acceso al Laboratorio de C{0}mputo de Ingenier{1}a.' -f [char]0x00F3,[char]0x00ED }
|
||||
}
|
||||
$Room = if ($Room) { $Room.Trim() } else { $null }
|
||||
$OuName = if ($OuName) { $OuName.Trim() } else { $null }
|
||||
|
||||
@@ -184,6 +219,16 @@ function Get-WelcomeLocationText {
|
||||
return $engineeringLab
|
||||
}
|
||||
|
||||
function Get-WelcomeHeading {
|
||||
param([string]$Gender)
|
||||
|
||||
switch ($Gender) {
|
||||
'Male' { return 'Bienvenido,' }
|
||||
'Female' { return 'Bienvenida,' }
|
||||
default { return 'Te damos la bienvenida,' }
|
||||
}
|
||||
}
|
||||
|
||||
function Get-AvailableFontFamily {
|
||||
param(
|
||||
[Parameter(Mandatory)][string[]]$Candidates,
|
||||
@@ -270,10 +315,15 @@ if (-not $DisplayName) {
|
||||
if (-not $PSBoundParameters.ContainsKey('Location') -and $metadata) {
|
||||
$Location = $metadata.Location
|
||||
}
|
||||
$genderWasProvided = $PSBoundParameters.ContainsKey('Gender')
|
||||
if (-not $genderWasProvided -and $metadata) {
|
||||
$Gender = $metadata.Gender
|
||||
}
|
||||
$welcomeHeading = Get-WelcomeHeading -Gender $Gender
|
||||
if (-not $PSBoundParameters.ContainsKey('OrganizationalUnit') -and $metadata) {
|
||||
$OrganizationalUnit = $metadata.OrganizationalUnit
|
||||
}
|
||||
$locationText = Get-WelcomeLocationText -Room $Location -OuName $OrganizationalUnit
|
||||
$locationText = Get-WelcomeLocationText -Room $Location -OuName $OrganizationalUnit -Gender $Gender
|
||||
|
||||
if (-not $CanvasWidth -or -not $CanvasHeight) {
|
||||
try {
|
||||
@@ -366,7 +416,7 @@ try {
|
||||
$format.Trimming = [Drawing.StringTrimming]::EllipsisWord
|
||||
try {
|
||||
$graphics.FillRectangle($panelBrush, $panelX, $panelY, $panelWidth, $panelHeight)
|
||||
Draw-CenteredText -Graphics $graphics -Text 'Bienvenido,' -Font $welcomeFont `
|
||||
Draw-CenteredText -Graphics $graphics -Text $welcomeHeading -Font $welcomeFont `
|
||||
-Brush $accentBrush -Bounds ([Drawing.RectangleF]::new($panelX, $panelY + 24*$scale, $panelWidth, 50*$scale)) -Format $format
|
||||
Draw-CenteredText -Graphics $graphics -Text $DisplayName -Font $nameFont `
|
||||
-Brush $whiteBrush -Bounds ([Drawing.RectangleF]::new($panelX + 30*$scale, $panelY + 64*$scale, $panelWidth - 60*$scale, 105*$scale)) -Format $format
|
||||
@@ -433,12 +483,15 @@ namespace Sgu {
|
||||
}
|
||||
}
|
||||
|
||||
Write-WelcomeLog -Message ("OK computer={0}; location={1}; ou={2}; output={3}" -f $ComputerName,[bool]$Location,[bool]$OrganizationalUnit,$OutputPath)
|
||||
$genderLogValue = if ($Gender) { $Gender } else { 'Neutral' }
|
||||
Write-WelcomeLog -Message ("OK computer={0}; gender={1}; location={2}; ou={3}; output={4}" -f $ComputerName,$genderLogValue,[bool]$Location,[bool]$OrganizationalUnit,$OutputPath)
|
||||
[pscustomobject]@{
|
||||
DisplayName = $DisplayName
|
||||
ComputerName = $ComputerName
|
||||
Location = $Location
|
||||
OrganizationalUnit = $OrganizationalUnit
|
||||
Gender = $Gender
|
||||
WelcomeHeading = $welcomeHeading
|
||||
LocationText = $locationText
|
||||
OutputPath = $OutputPath
|
||||
Applied = -not $SkipApply
|
||||
|
||||
@@ -53,6 +53,7 @@ computer_name=${computer_name^^}
|
||||
location=''
|
||||
distinguished_name=''
|
||||
organizational_unit=''
|
||||
gender=''
|
||||
|
||||
read_ldif_value() {
|
||||
local attribute=$1
|
||||
@@ -108,9 +109,18 @@ if [[ -n $DOMAIN_CONTROLLER && -n $BASE_DN ]] &&
|
||||
user_result=$(ldapsearch -LLL -N -o ldif-wrap=no -Y GSSAPI \
|
||||
-H "ldap://${ldap_server}" -b "$BASE_DN" \
|
||||
"(&(objectCategory=person)(objectClass=user)(sAMAccountName=${account_name}))" \
|
||||
displayName 2>/dev/null || true)
|
||||
displayName info 2>/dev/null || true)
|
||||
directory_display_name=$(read_ldif_value displayName "$user_result")
|
||||
[[ -n $directory_display_name ]] && display_name=$directory_display_name
|
||||
directory_info=$(read_ldif_value info "$user_result")
|
||||
gender=$(printf '%s\n' "$directory_info" | awk -F: '
|
||||
tolower($1) ~ /^[[:space:]]*sgu-gender[[:space:]]*$/ {
|
||||
value=tolower($2); gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
|
||||
if (value == "male") print "Male"
|
||||
else if (value == "female") print "Female"
|
||||
exit
|
||||
}
|
||||
')
|
||||
fi
|
||||
else
|
||||
log_message 'WARN AD metadata query skipped because Kerberos or LDAP session data was unavailable.'
|
||||
@@ -136,6 +146,24 @@ with_article() {
|
||||
fi
|
||||
}
|
||||
|
||||
case "$gender" in
|
||||
Male)
|
||||
welcome_text='Bienvenido,'
|
||||
located_text='Estás ubicado en'
|
||||
engineering_lab_text='Bienvenido al Laboratorio de Cómputo de Ingeniería.'
|
||||
;;
|
||||
Female)
|
||||
welcome_text='Bienvenida,'
|
||||
located_text='Estás ubicada en'
|
||||
engineering_lab_text='Bienvenida al Laboratorio de Cómputo de Ingeniería.'
|
||||
;;
|
||||
*)
|
||||
welcome_text='Te damos la bienvenida,'
|
||||
located_text='Ubicación:'
|
||||
engineering_lab_text='Acceso al Laboratorio de Cómputo de Ingeniería.'
|
||||
;;
|
||||
esac
|
||||
|
||||
if [[ -n $location && -n $organizational_unit ]]; then
|
||||
room_phrase=$(with_article "$location")
|
||||
ou_article=$(article_for "$organizational_unit")
|
||||
@@ -146,13 +174,13 @@ if [[ -n $location && -n $organizational_unit ]]; then
|
||||
else
|
||||
ou_phrase="de ${organizational_unit}"
|
||||
fi
|
||||
location_text="Estás ubicado en ${room_phrase} ${ou_phrase}."
|
||||
location_text="${located_text} ${room_phrase} ${ou_phrase}."
|
||||
elif [[ -n $location ]]; then
|
||||
location_text="Estás ubicado en $(with_article "$location")."
|
||||
location_text="${located_text} $(with_article "$location")."
|
||||
elif [[ -n $organizational_unit ]]; then
|
||||
location_text="Estás ubicado en $(with_article "$organizational_unit")."
|
||||
location_text="${located_text} $(with_article "$organizational_unit")."
|
||||
else
|
||||
location_text='Bienvenido al Laboratorio de Cómputo de Ingeniería.'
|
||||
location_text=$engineering_lab_text
|
||||
fi
|
||||
|
||||
width=1600
|
||||
@@ -210,7 +238,7 @@ if ! "${image_command[@]}" "$BASE_IMAGE" \
|
||||
-gravity center \
|
||||
-font "$sans_font" -weight 700 -style Normal -pointsize "$welcome_size" \
|
||||
-fill '#D3E2FF' -stroke 'rgba(0,0,0,0.48)' -strokewidth 1 \
|
||||
-annotate "+0-$(( 92 * scale / 100 ))" 'Bienvenido,' \
|
||||
-annotate "+0-$(( 92 * scale / 100 ))" "$welcome_text" \
|
||||
-font "$serif_font" -weight 700 -style Italic -pointsize "$name_size" \
|
||||
-fill white -annotate "+0-$(( 22 * scale / 100 ))" "$display_name" \
|
||||
-font "$sans_font" -weight 400 -style Normal -pointsize "$location_size" \
|
||||
@@ -242,7 +270,7 @@ if [[ $applied == false ]] && command -v xfconf-query >/dev/null 2>&1; then
|
||||
fi
|
||||
|
||||
if [[ $applied == true ]]; then
|
||||
log_message "OK computer=${computer_name}; location=$([[ -n $location ]] && printf true || printf false); ou=$([[ -n $organizational_unit ]] && printf true || printf false); output=${output_path}"
|
||||
log_message "OK computer=${computer_name}; gender=${gender:-Neutral}; location=$([[ -n $location ]] && printf true || printf false); ou=$([[ -n $organizational_unit ]] && printf true || printf false); output=${output_path}"
|
||||
else
|
||||
log_message 'WARN Wallpaper rendered, but no supported desktop background API was found.'
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
@echo off
|
||||
setlocal
|
||||
set "SGU_BOOTSTRAP_IP=%~1"
|
||||
set "SGU_VPN_PACKAGE=%~2"
|
||||
set "SGU_VPN_PFX=%~3"
|
||||
set "SGU_VPN_ROOT=%~4"
|
||||
powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$script = Join-Path '%~dp0' 'Invoke-SguClientBootstrap.ps1'; $arguments = @('-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',('"' + $script + '"'),'-ConnectivityMode','AzureP2S'); if ($env:SGU_BOOTSTRAP_IP) { $arguments += @('-DomainControllerIPv4Address',('"' + $env:SGU_BOOTSTRAP_IP + '"')) }; if ($env:SGU_VPN_PACKAGE) { $arguments += @('-VpnProfilePackagePath',('"' + [IO.Path]::GetFullPath($env:SGU_VPN_PACKAGE) + '"')) }; if ($env:SGU_VPN_PFX) { $arguments += @('-VpnClientCertificatePfxPath',('"' + [IO.Path]::GetFullPath($env:SGU_VPN_PFX) + '"')) }; if ($env:SGU_VPN_ROOT) { $arguments += @('-VpnClientRootCertificatePath',('"' + [IO.Path]::GetFullPath($env:SGU_VPN_ROOT) + '"')) }; $process = Start-Process -FilePath powershell.exe -Verb RunAs -ArgumentList $arguments -Wait -PassThru; exit $process.ExitCode"
|
||||
exit /b %errorlevel%
|
||||
@@ -0,0 +1,7 @@
|
||||
@echo off
|
||||
setlocal
|
||||
set "SGU_BOOTSTRAP_IP=%~1"
|
||||
set "SGU_VPN_POOL=%~2"
|
||||
if "%SGU_VPN_POOL%"=="" set "SGU_VPN_POOL=172.30.0.0/24"
|
||||
powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$script = Join-Path '%~dp0' 'Initialize-SguDomainController.ps1'; $arguments = @('-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',('"' + $script + '"'),'-NetworkConfigurationMode','PlatformManaged','-TrustedClientNetworks',$env:SGU_VPN_POOL,'-DnsForwarders','168.63.129.16'); if ($env:SGU_BOOTSTRAP_IP) { $arguments += @('-ServerIPv4Address',$env:SGU_BOOTSTRAP_IP) }; $process = Start-Process -FilePath powershell.exe -Verb RunAs -ArgumentList $arguments -Wait -PassThru; exit $process.ExitCode"
|
||||
exit /b %errorlevel%
|
||||
@@ -0,0 +1,7 @@
|
||||
namespace SGU.AuthBroker.Core.Profiles;
|
||||
|
||||
public enum InstitutionalGender
|
||||
{
|
||||
Male,
|
||||
Female
|
||||
}
|
||||
@@ -12,7 +12,8 @@ public sealed record InstitutionalProfile(
|
||||
string? StreetAddress = null,
|
||||
string? City = null,
|
||||
string? State = null,
|
||||
string? PostalCode = null)
|
||||
string? PostalCode = null,
|
||||
InstitutionalGender? Gender = null)
|
||||
{
|
||||
public bool HasValues =>
|
||||
EmployeeNumber is not null ||
|
||||
@@ -26,7 +27,8 @@ public sealed record InstitutionalProfile(
|
||||
StreetAddress is not null ||
|
||||
City is not null ||
|
||||
State is not null ||
|
||||
PostalCode is not null;
|
||||
PostalCode is not null ||
|
||||
Gender is not null;
|
||||
|
||||
public InstitutionalProfile Overlay(InstitutionalProfile? values) =>
|
||||
values is null
|
||||
@@ -44,6 +46,7 @@ public sealed record InstitutionalProfile(
|
||||
StreetAddress = values.StreetAddress ?? StreetAddress,
|
||||
City = values.City ?? City,
|
||||
State = values.State ?? State,
|
||||
PostalCode = values.PostalCode ?? PostalCode
|
||||
PostalCode = values.PostalCode ?? PostalCode,
|
||||
Gender = values.Gender ?? Gender
|
||||
};
|
||||
}
|
||||
|
||||
@@ -14,6 +14,8 @@ public static class SguProfileParser
|
||||
private const string AdministrativeGivenNameId = "ctl00_contenedor_txtNombre";
|
||||
private const string AdministrativePaternalSurnameId = "ctl00_contenedor_txtApaterno";
|
||||
private const string AdministrativeMaternalSurnameId = "ctl00_contenedor_txtAmaterno";
|
||||
private const string AdministrativeGenderId = "ctl00_contenedor_ddlsexo";
|
||||
private const string AdministrativeGenderName = "ctl00$contenedor$ddlsexo";
|
||||
private const string AdministrativeStreetId = "ctl00_contenedor_txtCalle";
|
||||
private const string AdministrativeExteriorNumberId = "ctl00_contenedor_txtNoExt";
|
||||
private const string AdministrativeInteriorNumberId = "ctl00_contenedor_txtNoInt";
|
||||
@@ -34,6 +36,7 @@ public static class SguProfileParser
|
||||
private const string StudentCityId = "ctl00_contenedor_HistorialAlumno1_lblCiudadAlumnoHP";
|
||||
private const string StudentMunicipalityId = "ctl00_contenedor_HistorialAlumno1_lblDeloMunAlumnoHP";
|
||||
private const string StudentPostalCodeId = "ctl00_contenedor_HistorialAlumno1_lblCPAlumnoHP";
|
||||
private const string StudentGenderId = "ctl00_contenedor_HistorialAlumno1_lblSexoAlumnoHP";
|
||||
|
||||
public static InstitutionalProfile? ParseAdministrative(string html, string expectedEmployeeNumber)
|
||||
=> ParseStaffHeader(html, expectedEmployeeNumber);
|
||||
@@ -91,7 +94,11 @@ public static class SguProfileParser
|
||||
InstitutionalProfile profile = new(
|
||||
DisplayName: displayName,
|
||||
GivenName: givenName,
|
||||
Surname: surname);
|
||||
Surname: surname,
|
||||
Gender: ParseStaffGender(ExtractSelectedOptionValue(
|
||||
html,
|
||||
AdministrativeGenderId,
|
||||
AdministrativeGenderName)));
|
||||
return profile.HasValues ? profile : null;
|
||||
}
|
||||
|
||||
@@ -151,7 +158,8 @@ public static class SguProfileParser
|
||||
StreetAddress: streetAddress,
|
||||
City: city ?? municipality,
|
||||
State: NormalizeTitle(ExtractSpanText(html, StudentStateId), 128),
|
||||
PostalCode: NormalizePostalCode(ExtractSpanText(html, StudentPostalCodeId)));
|
||||
PostalCode: NormalizePostalCode(ExtractSpanText(html, StudentPostalCodeId)),
|
||||
Gender: ParseStudentGender(ExtractSpanText(html, StudentGenderId)));
|
||||
return profile.HasValues ? profile : null;
|
||||
}
|
||||
|
||||
@@ -292,11 +300,68 @@ public static class SguProfileParser
|
||||
return nonPlaceholderOptions.Count == 1 ? nonPlaceholderOptions[0] : null;
|
||||
}
|
||||
|
||||
private static string? ExtractSelectedOptionValue(string html, string id, string name)
|
||||
{
|
||||
string? openingTag = FindOpeningTag(html, "select", id) ??
|
||||
FindOpeningTagByAttribute(html, "select", "name", name);
|
||||
if (openingTag is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
int openingTagIndex = html.IndexOf(openingTag, StringComparison.OrdinalIgnoreCase);
|
||||
int contentStart = openingTagIndex + openingTag.Length;
|
||||
int contentEnd = html.IndexOf("</select", contentStart, StringComparison.OrdinalIgnoreCase);
|
||||
if (openingTagIndex < 0 || contentEnd < 0)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
string? selectedValue = ExtractAttributeValue(openingTag, "value");
|
||||
string optionsHtml = html[contentStart..contentEnd];
|
||||
int searchFrom = 0;
|
||||
while (searchFrom < optionsHtml.Length)
|
||||
{
|
||||
int optionStart = optionsHtml.IndexOf("<option", searchFrom, StringComparison.OrdinalIgnoreCase);
|
||||
if (optionStart < 0)
|
||||
{
|
||||
break;
|
||||
}
|
||||
|
||||
int optionTagEnd = optionsHtml.IndexOf('>', optionStart);
|
||||
if (optionTagEnd < 0)
|
||||
{
|
||||
break;
|
||||
}
|
||||
|
||||
string optionTag = optionsHtml[optionStart..(optionTagEnd + 1)];
|
||||
string? optionValue = ExtractAttributeValue(optionTag, "value");
|
||||
if (optionValue is not null &&
|
||||
(HasAttribute(optionTag, "selected") ||
|
||||
(selectedValue is not null &&
|
||||
string.Equals(optionValue, selectedValue, StringComparison.Ordinal))))
|
||||
{
|
||||
return NormalizeText(optionValue);
|
||||
}
|
||||
|
||||
searchFrom = optionTagEnd + 1;
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static string? FindOpeningTag(string html, string tagName, string id)
|
||||
=> FindOpeningTagByAttribute(html, tagName, "id", id);
|
||||
|
||||
private static string? FindOpeningTagByAttribute(
|
||||
string html,
|
||||
string tagName,
|
||||
string attributeName,
|
||||
string attributeValue)
|
||||
{
|
||||
foreach (char quote in new[] { '"', '\'' })
|
||||
{
|
||||
string marker = $"id={quote}{id}{quote}";
|
||||
string marker = $"{attributeName}={quote}{attributeValue}{quote}";
|
||||
int searchFrom = 0;
|
||||
while (searchFrom < html.Length)
|
||||
{
|
||||
@@ -324,6 +389,20 @@ public static class SguProfileParser
|
||||
return null;
|
||||
}
|
||||
|
||||
private static InstitutionalGender? ParseStaffGender(string? value) => value?.Trim() switch
|
||||
{
|
||||
"1" => InstitutionalGender.Male,
|
||||
"2" => InstitutionalGender.Female,
|
||||
_ => null
|
||||
};
|
||||
|
||||
private static InstitutionalGender? ParseStudentGender(string? value) => value?.Trim().ToUpperInvariant() switch
|
||||
{
|
||||
"M" => InstitutionalGender.Male,
|
||||
"F" => InstitutionalGender.Female,
|
||||
_ => null
|
||||
};
|
||||
|
||||
private static string? ExtractAttributeValue(string openingTag, string attributeName)
|
||||
{
|
||||
foreach (char quote in new[] { '"', '\'' })
|
||||
|
||||
@@ -21,4 +21,5 @@ internal static class BrokerEventIds
|
||||
internal static readonly EventId DirectorySynchronizationFailure = new(1300, nameof(DirectorySynchronizationFailure));
|
||||
internal static readonly EventId DirectoryOptionalMetadataFailure = new(1301, nameof(DirectoryOptionalMetadataFailure));
|
||||
internal static readonly EventId DirectoryGroupMembershipFailure = new(1302, nameof(DirectoryGroupMembershipFailure));
|
||||
internal static readonly EventId DirectoryRoleGroupMembershipAdded = new(1303, nameof(DirectoryRoleGroupMembershipAdded));
|
||||
}
|
||||
|
||||
@@ -87,6 +87,14 @@ public sealed class BrokerOptions
|
||||
{
|
||||
throw new InvalidOperationException($"The OU mapping for {role} must be beneath BaseDn.");
|
||||
}
|
||||
|
||||
string groupDn = Directory.GetGroupDn(role);
|
||||
if (string.IsNullOrWhiteSpace(groupDn) ||
|
||||
!groupDn.StartsWith("CN=", StringComparison.OrdinalIgnoreCase) ||
|
||||
!groupDn.EndsWith($",{Directory.BaseDn}", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
throw new InvalidOperationException($"The security-group mapping for {role} must identify a group beneath BaseDn.");
|
||||
}
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(Directory.RemoteDesktopGroupDn) &&
|
||||
@@ -168,6 +176,12 @@ public sealed class ActiveDirectoryOptions
|
||||
|
||||
public string AdministrativeOuDn { get; init; } = "OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx";
|
||||
|
||||
public string ProfessorGroupDn { get; init; } = "CN=SGU-Docentes,OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx";
|
||||
|
||||
public string StudentGroupDn { get; init; } = "CN=SGU-Alumnos,OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx";
|
||||
|
||||
public string AdministrativeGroupDn { get; init; } = "CN=SGU-Administrativos,OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx";
|
||||
|
||||
public string RemoteDesktopGroupDn { get; init; } = string.Empty;
|
||||
|
||||
public string DefaultCompany { get; init; } = "La Salle";
|
||||
@@ -181,4 +195,12 @@ public sealed class ActiveDirectoryOptions
|
||||
InstitutionalRole.Administrative => AdministrativeOuDn,
|
||||
_ => throw new ArgumentOutOfRangeException(nameof(role), role, null)
|
||||
};
|
||||
|
||||
public string GetGroupDn(InstitutionalRole role) => role switch
|
||||
{
|
||||
InstitutionalRole.Professor => ProfessorGroupDn,
|
||||
InstitutionalRole.Student => StudentGroupDn,
|
||||
InstitutionalRole.Administrative => AdministrativeGroupDn,
|
||||
_ => throw new ArgumentOutOfRangeException(nameof(role), role, null)
|
||||
};
|
||||
}
|
||||
|
||||
@@ -11,6 +11,8 @@ public sealed class ActiveDirectorySynchronizer(
|
||||
BrokerOptions options,
|
||||
ILogger<ActiveDirectorySynchronizer> logger) : IActiveDirectorySynchronizer
|
||||
{
|
||||
private const string GenderMetadataPrefix = "SGU-Gender:";
|
||||
private const int InfoAttributeMaximumLength = 1024;
|
||||
private const int AccountDisabled = 0x0002;
|
||||
private const int NormalAccount = 0x0200;
|
||||
private static readonly AuthenticationTypes BindFlags =
|
||||
@@ -109,6 +111,12 @@ public sealed class ActiveDirectorySynchronizer(
|
||||
user.CommitChanges();
|
||||
}
|
||||
|
||||
// Role membership is part of account provisioning, not optional
|
||||
// enrichment. Do it before changing the password so a missing or
|
||||
// inaccessible authorization group cannot leave a newly usable
|
||||
// account without its required classification.
|
||||
EnsureRoleGroupMembership(user, identity);
|
||||
|
||||
// The exact institutional password received by the broker is passed to AD.
|
||||
// It is not derived, transformed, written to disk, or included in logs.
|
||||
user.Invoke("SetPassword", [password]);
|
||||
@@ -158,6 +166,7 @@ public sealed class ActiveDirectorySynchronizer(
|
||||
SetOptionalProperty(user, "l", profile.City);
|
||||
SetOptionalProperty(user, "st", profile.State);
|
||||
SetOptionalProperty(user, "postalCode", profile.PostalCode);
|
||||
SetGenderMetadata(user, profile.Gender, identity.UserName, logger);
|
||||
if (string.Equals(profile.EmployeeNumber, identity.NumericId, StringComparison.Ordinal))
|
||||
{
|
||||
SetOptionalProperty(user, "employeeID", profile.EmployeeNumber);
|
||||
@@ -195,6 +204,83 @@ public sealed class ActiveDirectorySynchronizer(
|
||||
}
|
||||
}
|
||||
|
||||
private static void SetGenderMetadata(
|
||||
DirectoryEntry entry,
|
||||
InstitutionalGender? gender,
|
||||
string institutionalUser,
|
||||
ILogger logger)
|
||||
{
|
||||
if (gender is null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
string existing = Convert.ToString(entry.Properties["info"].Value) ?? string.Empty;
|
||||
string? updated = MergeGenderMetadata(existing, gender);
|
||||
if (updated is null)
|
||||
{
|
||||
logger.LogWarning(
|
||||
BrokerEventIds.DirectoryOptionalMetadataFailure,
|
||||
"Gender metadata was not written for {InstitutionalUser} because the Active Directory info attribute has no remaining capacity.",
|
||||
institutionalUser);
|
||||
return;
|
||||
}
|
||||
|
||||
entry.Properties["info"].Value = updated;
|
||||
}
|
||||
|
||||
internal static string? MergeGenderMetadata(
|
||||
string? existing,
|
||||
InstitutionalGender? gender)
|
||||
{
|
||||
if (gender is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
string managedLine = $"{GenderMetadataPrefix} {gender}";
|
||||
string normalizedExisting = (existing ?? string.Empty)
|
||||
.Replace("\r\n", "\n", StringComparison.Ordinal)
|
||||
.Replace('\r', '\n');
|
||||
string[] preservedLines = string.IsNullOrEmpty(normalizedExisting)
|
||||
? []
|
||||
: normalizedExisting
|
||||
.Split('\n')
|
||||
.Where(line => !line.TrimStart().StartsWith(
|
||||
GenderMetadataPrefix,
|
||||
StringComparison.OrdinalIgnoreCase))
|
||||
.ToArray();
|
||||
string updated = string.Join("\r\n", preservedLines.Append(managedLine));
|
||||
return updated.Length <= InfoAttributeMaximumLength ? updated : null;
|
||||
}
|
||||
|
||||
private void EnsureRoleGroupMembership(DirectoryEntry user, UserIdentity identity)
|
||||
{
|
||||
user.RefreshCache(["distinguishedName"]);
|
||||
string? userDn = Convert.ToString(user.Properties["distinguishedName"].Value);
|
||||
if (string.IsNullOrWhiteSpace(userDn))
|
||||
{
|
||||
throw new InvalidOperationException($"Active Directory did not return a distinguished name for {identity.UserName}.");
|
||||
}
|
||||
|
||||
string groupDn = options.GetGroupDn(identity.Role);
|
||||
using DirectoryEntry group = Bind(groupDn);
|
||||
_ = group.NativeObject;
|
||||
if (group.Properties["member"].Contains(userDn))
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
group.Properties["member"].Add(userDn);
|
||||
group.CommitChanges();
|
||||
logger.LogInformation(
|
||||
BrokerEventIds.DirectoryRoleGroupMembershipAdded,
|
||||
"Added {InstitutionalUser} with role {Role} to Active Directory security group {GroupDn}.",
|
||||
identity.UserName,
|
||||
identity.Role,
|
||||
groupDn);
|
||||
}
|
||||
|
||||
private void TryEnsureRemoteDesktopGroupMembership(DirectoryEntry user, string institutionalUser)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(options.RemoteDesktopGroupDn))
|
||||
|
||||
@@ -50,6 +50,9 @@
|
||||
"ProfessorOuDn": "OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx",
|
||||
"StudentOuDn": "OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx",
|
||||
"AdministrativeOuDn": "OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx",
|
||||
"ProfessorGroupDn": "CN=SGU-Docentes,OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx",
|
||||
"StudentGroupDn": "CN=SGU-Alumnos,OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx",
|
||||
"AdministrativeGroupDn": "CN=SGU-Administrativos,OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx",
|
||||
"RemoteDesktopGroupDn": "",
|
||||
"DefaultCompany": "La Salle",
|
||||
"CreateMissingOus": false
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
|
||||
$serverBootstrapPath = Join-Path $repositoryRoot 'scripts\Initialize-SguDomainController.ps1'
|
||||
$clientBootstrapPath = Join-Path $repositoryRoot 'scripts\Invoke-SguClientBootstrap.ps1'
|
||||
$azureClientPath = Join-Path $repositoryRoot 'scripts\Install-SguAzureP2sClient.ps1'
|
||||
$bicepPath = Join-Path $repositoryRoot 'infra\azure\main.bicep'
|
||||
|
||||
$tokens = $null
|
||||
$parseErrors = $null
|
||||
$serverAst = [Management.Automation.Language.Parser]::ParseFile(
|
||||
$serverBootstrapPath,
|
||||
[ref]$tokens,
|
||||
[ref]$parseErrors)
|
||||
if ($parseErrors.Count -gt 0) {
|
||||
throw ($parseErrors -join [Environment]::NewLine)
|
||||
}
|
||||
$networkFunctionNames = @(
|
||||
'Test-PrivateIPv4Address',
|
||||
'ConvertTo-NetworkCidr',
|
||||
'ConvertTo-PrivateNetworkCidr'
|
||||
)
|
||||
$networkFunctions = $serverAst.FindAll({
|
||||
param($node)
|
||||
$node -is [Management.Automation.Language.FunctionDefinitionAst] -and
|
||||
$networkFunctionNames -contains $node.Name
|
||||
}, $true)
|
||||
Invoke-Expression (($networkFunctions | ForEach-Object { $_.Extent.Text }) -join [Environment]::NewLine)
|
||||
|
||||
Describe 'SGU public-cloud network safety' {
|
||||
It 'canonicalizes a host address to its IPv4 network' {
|
||||
ConvertTo-NetworkCidr -Address ([ipaddress]'10.77.0.4') `
|
||||
-NetworkPrefixLength 24 | Should Be '10.77.0.0/24'
|
||||
}
|
||||
|
||||
It 'canonicalizes the trusted P2S pool' {
|
||||
ConvertTo-PrivateNetworkCidr -Cidr '172.30.4.19/16' |
|
||||
Should Be '172.30.0.0/16'
|
||||
}
|
||||
|
||||
It 'rejects a public trusted-client CIDR' {
|
||||
$wasRejected = $false
|
||||
try {
|
||||
ConvertTo-PrivateNetworkCidr -Cidr '8.8.8.0/24' | Out-Null
|
||||
}
|
||||
catch {
|
||||
$wasRejected = $true
|
||||
}
|
||||
$wasRejected | Should Be $true
|
||||
}
|
||||
|
||||
It 'exposes explicit Azure modes on both bootstraps' {
|
||||
((Get-Command $serverBootstrapPath).Parameters.Keys -contains
|
||||
'NetworkConfigurationMode') | Should Be $true
|
||||
((Get-Command $serverBootstrapPath).Parameters.Keys -contains
|
||||
'TrustedClientNetworks') | Should Be $true
|
||||
((Get-Command $clientBootstrapPath).Parameters.Keys -contains
|
||||
'ConnectivityMode') | Should Be $true
|
||||
((Get-Command $clientBootstrapPath).Parameters.Keys -contains
|
||||
'VpnProfilePackagePath') | Should Be $true
|
||||
}
|
||||
|
||||
It 'uses an all-user machine-certificate VPN profile' {
|
||||
$source = Get-Content -LiteralPath $azureClientPath -Raw
|
||||
$source | Should Match '-AuthenticationMethod MachineCertificate'
|
||||
$source | Should Match '-AllUserConnection'
|
||||
$source | Should Match 'Add-DnsClientNrptRule'
|
||||
}
|
||||
|
||||
It 'limits optional public administration to RDP' {
|
||||
$template = Get-Content -LiteralPath $bicepPath -Raw
|
||||
$template | Should Match "name: 'Allow-RDP-from-administrator'"
|
||||
$template | Should Match "destinationPortRange: '3389'"
|
||||
$template | Should Not Match "sourceAddressPrefix: '0\.0\.0\.0/0'"
|
||||
}
|
||||
}
|
||||
@@ -133,6 +133,64 @@ public sealed class SguProfileParserTests
|
||||
Assert.Null(profile.Email);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("ctl00_contenedor_ddlsexo", "ctl00$contenedor$ddlsexo", "1", InstitutionalGender.Male)]
|
||||
[InlineData("alternate-id", "ctl00$contenedor$ddlsexo", "2", InstitutionalGender.Female)]
|
||||
public void ParsesStaffGenderFromTheSelectedPersonalDataOption(
|
||||
string id,
|
||||
string name,
|
||||
string selectedValue,
|
||||
InstitutionalGender expected)
|
||||
{
|
||||
string html = $"""
|
||||
<select id="{id}" name="{name}">
|
||||
<option value="">Seleccione...</option>
|
||||
<option value="1"{(selectedValue == "1" ? " selected=\"selected\"" : string.Empty)}>Masculino</option>
|
||||
<option value="2"{(selectedValue == "2" ? " selected=\"selected\"" : string.Empty)}>Femenino</option>
|
||||
</select>
|
||||
""";
|
||||
|
||||
InstitutionalProfile? profile = SguProfileParser.ParseAdministrativePersonal(html);
|
||||
|
||||
Assert.NotNull(profile);
|
||||
Assert.Equal(expected, profile.Gender);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("M", InstitutionalGender.Male)]
|
||||
[InlineData("f", InstitutionalGender.Female)]
|
||||
public void ParsesStudentGenderFromTheInformationSpan(
|
||||
string source,
|
||||
InstitutionalGender expected)
|
||||
{
|
||||
string html = $"""
|
||||
<span id="ctl00_contenedor_HistorialAlumno1_lblClaveAlumnoHP">123456</span>
|
||||
<span id="ctl00_contenedor_HistorialAlumno1_lblSexoAlumnoHP">{source}</span>
|
||||
""";
|
||||
|
||||
InstitutionalProfile? profile = SguProfileParser.ParseStudent(html, "123456");
|
||||
|
||||
Assert.NotNull(profile);
|
||||
Assert.Equal(expected, profile.Gender);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void IgnoresUnknownGenderValuesWithoutFailingProfileParsing()
|
||||
{
|
||||
const string html = """
|
||||
<input id="ctl00_contenedor_txtNombre" value="PERSONA" />
|
||||
<select id="ctl00_contenedor_ddlsexo">
|
||||
<option selected="selected" value="9">SIN CLASIFICAR</option>
|
||||
</select>
|
||||
""";
|
||||
|
||||
InstitutionalProfile? profile = SguProfileParser.ParseAdministrativePersonal(html);
|
||||
|
||||
Assert.NotNull(profile);
|
||||
Assert.Equal("Persona", profile.DisplayName);
|
||||
Assert.Null(profile.Gender);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ParsesAdministrativeAddressFromInputsAndSelectedOptions()
|
||||
{
|
||||
@@ -182,7 +240,8 @@ public sealed class SguProfileParserTests
|
||||
InstitutionalProfile personal = new(
|
||||
DisplayName: "María del Carmen de la Fuente",
|
||||
GivenName: "María del Carmen",
|
||||
Surname: "de la Fuente");
|
||||
Surname: "de la Fuente",
|
||||
Gender: InstitutionalGender.Female);
|
||||
InstitutionalProfile location = new(
|
||||
StreetAddress: "Calle Uno 10",
|
||||
City: "Ciudad de México",
|
||||
@@ -200,6 +259,7 @@ public sealed class SguProfileParserTests
|
||||
Assert.Equal("Ingeniería", combined.Department);
|
||||
Assert.Equal("Calle Uno 10", combined.StreetAddress);
|
||||
Assert.Equal("01000", combined.PostalCode);
|
||||
Assert.Equal(InstitutionalGender.Female, combined.Gender);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
@@ -215,6 +275,7 @@ public sealed class SguProfileParserTests
|
||||
<span id="ctl00_contenedor_HistorialAlumno1_lblCorreoAlumnoHP">
|
||||
<a href="mailto:alumna@lasalle.mx">ALUMNA@LASALLE.MX</a>
|
||||
</span>
|
||||
<span id="ctl00_contenedor_HistorialAlumno1_lblSexoAlumnoHP">F</span>
|
||||
<span id="ctl00_contenedor_HistorialAlumno1_lblCURPAlumnoHP">
|
||||
DATO-SENSIBLE-QUE-NO-DEBE-EXTRAERSE
|
||||
</span>
|
||||
@@ -262,6 +323,7 @@ public sealed class SguProfileParserTests
|
||||
Assert.Equal("Ciudad de México", profile.City);
|
||||
Assert.Equal("Ciudad de México", profile.State);
|
||||
Assert.Equal("08500", profile.PostalCode);
|
||||
Assert.Equal(InstitutionalGender.Female, profile.Gender);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
using SGU.AuthBroker.Core.Profiles;
|
||||
using SGU.AuthBroker.Services;
|
||||
using Xunit;
|
||||
|
||||
namespace SGU.AuthBroker.Tests;
|
||||
|
||||
public sealed class ActiveDirectorySynchronizerTests
|
||||
{
|
||||
[Fact]
|
||||
public void GenderMetadataPreservesUnmanagedNotesAndReplacesItsManagedLine()
|
||||
{
|
||||
const string existing = " Responsable de laboratorio \r\n\r\nSGU-Gender: Male\r\nTurno vespertino";
|
||||
|
||||
string? updated = ActiveDirectorySynchronizer.MergeGenderMetadata(
|
||||
existing,
|
||||
InstitutionalGender.Female);
|
||||
|
||||
Assert.Equal(
|
||||
" Responsable de laboratorio \r\n\r\nTurno vespertino\r\nSGU-Gender: Female",
|
||||
updated);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void GenderMetadataDoesNotTruncateAnExistingFullNotesField()
|
||||
{
|
||||
string existing = new('x', 1024);
|
||||
|
||||
string? updated = ActiveDirectorySynchronizer.MergeGenderMetadata(
|
||||
existing,
|
||||
InstitutionalGender.Male);
|
||||
|
||||
Assert.Null(updated);
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,5 @@
|
||||
using SGU.AuthBroker.Options;
|
||||
using SGU.AuthBroker.Core.Identity;
|
||||
using Xunit;
|
||||
|
||||
namespace SGU.AuthBroker.Tests;
|
||||
@@ -28,4 +29,31 @@ public sealed class BrokerOptionsTests
|
||||
|
||||
Assert.Contains("thumbprint", exception.Message, StringComparison.OrdinalIgnoreCase);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(InstitutionalRole.Student, "CN=SGU-Alumnos,OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
|
||||
[InlineData(InstitutionalRole.Administrative, "CN=SGU-Administrativos,OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
|
||||
[InlineData(InstitutionalRole.Professor, "CN=SGU-Docentes,OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
|
||||
public void DefaultRoleGroupMappingsMatchInstitutionalPrefixes(InstitutionalRole role, string expectedGroupDn)
|
||||
{
|
||||
ActiveDirectoryOptions options = new();
|
||||
|
||||
Assert.Equal(expectedGroupDn, options.GetGroupDn(role));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateRejectsARoleGroupOutsideTheConfiguredDirectoryBase()
|
||||
{
|
||||
BrokerOptions options = new()
|
||||
{
|
||||
Directory = new ActiveDirectoryOptions
|
||||
{
|
||||
StudentGroupDn = "CN=SGU-Alumnos,DC=example,DC=invalid"
|
||||
}
|
||||
};
|
||||
|
||||
InvalidOperationException exception = Assert.Throws<InvalidOperationException>(options.Validate);
|
||||
|
||||
Assert.Contains("security-group", exception.Message, StringComparison.OrdinalIgnoreCase);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,6 +3,7 @@ using System.Net.Http.Headers;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using SGU.AuthBroker.Core.Authentication;
|
||||
using SGU.AuthBroker.Core.Identity;
|
||||
using SGU.AuthBroker.Core.Profiles;
|
||||
using SGU.AuthBroker.Options;
|
||||
using SGU.AuthBroker.Services;
|
||||
using Xunit;
|
||||
@@ -132,6 +133,10 @@ public sealed class NtlmCredentialValidatorTests
|
||||
<input id="ctl00_contenedor_txtNombre" value="MARÍA DEL CARMEN" />
|
||||
<input id="ctl00_contenedor_txtApaterno" value="DE LA FUENTE" />
|
||||
<input id="ctl00_contenedor_txtAmaterno" value="O'CONNOR" />
|
||||
<select name="ctl00$contenedor$ddlsexo">
|
||||
<option value="1">Masculino</option>
|
||||
<option selected="selected" value="2">Femenino</option>
|
||||
</select>
|
||||
"""),
|
||||
Response(
|
||||
HttpStatusCode.OK,
|
||||
@@ -168,6 +173,7 @@ public sealed class NtlmCredentialValidatorTests
|
||||
Assert.Equal("Álvaro Obregón", result.Profile.City);
|
||||
Assert.Equal("Ciudad de México", result.Profile.State);
|
||||
Assert.Equal("01000", result.Profile.PostalCode);
|
||||
Assert.Equal(InstitutionalGender.Female, result.Profile.Gender);
|
||||
Assert.Equal(
|
||||
[
|
||||
"/psulsa/",
|
||||
@@ -224,6 +230,10 @@ public sealed class NtlmCredentialValidatorTests
|
||||
<input id="ctl00_contenedor_txtNombre" value="MARÍA DEL CARMEN" />
|
||||
<input id="ctl00_contenedor_txtApaterno" value="DE LA FUENTE" />
|
||||
<input id="ctl00_contenedor_txtAmaterno" value="O'CONNOR" />
|
||||
<select id="ctl00_contenedor_ddlsexo">
|
||||
<option selected="selected" value="1">Masculino</option>
|
||||
<option value="2">Femenino</option>
|
||||
</select>
|
||||
"""),
|
||||
Response(
|
||||
HttpStatusCode.OK,
|
||||
@@ -262,6 +272,7 @@ public sealed class NtlmCredentialValidatorTests
|
||||
Assert.Equal("Álvaro Obregón", result.Profile.City);
|
||||
Assert.Equal("Ciudad de México", result.Profile.State);
|
||||
Assert.Equal("01000", result.Profile.PostalCode);
|
||||
Assert.Equal(InstitutionalGender.Male, result.Profile.Gender);
|
||||
Assert.Equal(
|
||||
[
|
||||
"/psulsa/",
|
||||
|
||||
Reference in New Issue
Block a user