SGU Windows Credential Provider

Windows Credential Provider and ASP.NET Core authentication broker for the lci.lasalle.mx Active Directory laboratory.

The repository starts from the current Lithnet Windows Credential Provider source and adds an SGU-specific provider, an mTLS-protected broker, Active Directory synchronization, deployment scripts, and tests.

Authentication contract

The Windows tile collects a DO, AL, or AD institutional key and a password.
It sends that exact password over mutually authenticated TLS to the broker.
The broker validates the same key/password pair against the configured SGU NTLM endpoint.
On success, the broker creates or moves the AD user and sets the AD password to the exact submitted password.
The Credential Provider serializes the original SecureString to Windows.

No derived password is created. Passwords are not written to a database, file, event log, application log, command line, or response.

Prefix	Role	Default OU
`DO`	Professor / docente	`OU=Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx`
`AL`	Student / alumno	`OU=Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx`
`AD`	Administrative	`OU=Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx`

If the broker or institutional NTLM authority is unavailable, the provider submits the unchanged credentials to Windows for normal AD/cached-domain validation. This is not an unauthenticated bypass: Windows LSA must still accept the last password registered in AD. An explicit NTLM 401 is rejected and is not treated as an outage.

Projects

src/SGU.CredentialProvider — x64 .NET 10 COM Credential Provider based on Lithnet.
src/SGU.AuthBroker — Windows-hosted ASP.NET Core broker with mTLS, NTLM validation, and Active Directory provisioning.
src/SGU.AuthBroker.Core — testable authentication workflow and prefix classifier.
tests — exact-password, role mapping, rejection, and outage-fallback tests.
scripts — publishing, certificate, server deployment, client installation, broker testing, and rollback.

Build

Prerequisites are captured in .vsconfig; the pinned SDK is .NET 10.0.400.

dotnet restore .\SGU-CredentialProvider.sln
dotnet build .\SGU-CredentialProvider.sln -c Release --no-restore
dotnet test .\SGU-CredentialProvider.sln -c Release --no-build --no-restore
.\scripts\Publish-Lab.ps1

The provider's .NET COM host is framework-dependent, so the Windows client needs the latest .NET 10 x64 runtime. The broker is published self-contained.

Deployment and test

Follow docs/lab-runbook.md. Review docs/security.md before production deployment and docs/architecture.md for the component contract.

Never disable the built-in Microsoft password Credential Provider. It is the supported recovery path if a third-party provider fails to load.

Upstream license

The Lithnet source remains under its MIT license in LICENSE. Project additions are distributed under the same license.

3.1 KiB Raw Blame History