Ebbe BaßandClaude Sonnet 5.5
24de5878ed
Includes the BMAD install config, the initiative ticket tree, the portal context-resources scripts, and the .gitignore change that tracks BMAD files (generated _bmad/render/ is ignored). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt
26 lines
2.3 KiB
Markdown
26 lines
2.3 KiB
Markdown
# Addendum: Technical Context for Downstream Documents
|
|
|
|
## Existing picture pipeline (context-resources/)
|
|
- `AD-ProfilePicture-Sync.ps1` (DC, scheduled task): reads `<sam>.jpg` from the fileshare source folder, falls back to a default image, writes a 96px copy and a 448px copy to a processed folder, and sets `thumbnailPhoto`, `jpegPhoto` and `photo` in AD from the 96px copy (limit 100 KB). It writes MD5 files for change detection but does not yet compare them, so every run reprocesses every user. Target OU in the script: `OU=Organisation,DC=ping-mee,DC=local`.
|
|
- `Set-LocalAccountPicture.ps1` (user logon script): reads `thumbnailPhoto` and builds Windows account-picture sizes (32, 40, 48, 96, 192, 200, 240, 448). Large sizes use the 448px copy from the share. It uses `$roamingDir` before defining it, which is a bug.
|
|
- `Set-AccountPictureRegistry-System.ps1` (startup): applies registry entries from manifests left by the logon script.
|
|
- The portal's job is only to put a correct `<username>.jpg` in the share's source folder. Format, size and naming constraints come from these scripts.
|
|
|
|
## AD write scope
|
|
- Writable OU: `OU=Clients,OU=Organisation,DC=ping-mee,DC=local` (configurable).
|
|
- Attributes: `givenName`, `sn`, `displayName`, `mail`, `telephoneNumber`, `mobile`. Password via the AD password mechanism over LDAPS.
|
|
- Rejected: editing `cn` and `name`. They are the object's RDN and would need ModifyDN renames, which change the DN and risk breaking apps.
|
|
|
|
## Security notes raised during discovery
|
|
- Internet exposure plus LDAP binds can lock AD accounts if an attacker hammers logins. Throttling must sit in front of any bind. OIDC via authentik moves the first factor there.
|
|
- E-mail change feeds announcements and any future reset path. Chain risk: hijacked session, then e-mail change. Mitigated by requiring the current password and a confirmation link.
|
|
- Secrets (service account, SMTP) come from Docker environment variables, not the admin UI.
|
|
|
|
## Integrations
|
|
- IdP: authentik via OIDC. Keep it generic OIDC so other providers work. Not verified: whether authentik can write passwords back to AD. The portal does not rely on it.
|
|
- Mail: configurable SMTP, IONOS in the homelab.
|
|
- Reverse proxy in front terminates TLS.
|
|
|
|
## Design
|
|
- Office 365 (Fluent) look, not OWA 2010 or Windows 7 Aero. Admin can change theme and upload backgrounds.
|