22 lines
1.2 KiB
PowerShell
22 lines
1.2 KiB
PowerShell
$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
|
|
$synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs'
|
|
$deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1'
|
|
$synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw
|
|
$deploy = Get-Content -LiteralPath $deployPath -Raw
|
|
|
|
Describe 'SGU Auth Broker password authority' {
|
|
It 'denies the Change Password extended right to SELF and Everyone before SetPassword' {
|
|
$synchronizer | Should Match 'AB721A53-1E2F-11D0-9819-00AA0040529B'
|
|
$synchronizer | Should Match 'WellKnownSidType\.WorldSid'
|
|
$synchronizer | Should Match 'WellKnownSidType\.SelfSid'
|
|
$synchronizer | Should Match 'AccessControlType\.Deny'
|
|
$synchronizer.IndexOf('EnsureCannotChangePassword(user', [StringComparison]::Ordinal) |
|
|
Should BeLessThan $synchronizer.IndexOf('user.Invoke("SetPassword"', [StringComparison]::Ordinal)
|
|
}
|
|
|
|
It 'repairs every existing account below Usuarios-SGU during broker deployment' {
|
|
$deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree'
|
|
$deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true'
|
|
}
|
|
}
|