DreadGOAD console and cloud operations

.gitignore

@@ -17,6 +17,15 @@ dreadgoad
 .dreadgoad/
 coverage.out
 
+# Web app build artifacts
+console/frontend/node_modules/
+console/frontend/dist/
+console/frontend/*.tsbuildinfo
+
+# Generated ADCS template archives (main tracks the sources, not the zips)
+ansible/roles/adcs_templates/files/ADCSTemplate.zip
+ansible/roles/vulns_adcs_templates/files/ADCSTemplate.zip
+
 # Root environment inventories are local runtime state.
 /*-inventory
 /*-inventory.bak.*

.pre-commit-config.yaml

@@ -31,15 +31,15 @@ repos:
     hooks:
       - id: codespell
         entry: codespell -q 3 -f -S ".git,.github,README.md" -L "mot,fonction,connexion"
-        exclude: '(go\.sum|\.min\.css\.map|\.css\.map|\.min\.map|\.min\.js|sysmonconfig-export\.xml|jquery\.validate\.(min\.)?js|jquery-3\.4\.1(\.slim)?\.js|modernizr-[\d\.]+\.js)$'
+        exclude: '(go\.sum|package-lock\.json|\.min\.css\.map|\.css\.map|\.min\.map|\.min\.js|sysmonconfig-export\.xml|jquery\.validate\.(min\.)?js|jquery-3\.4\.1(\.slim)?\.js|modernizr-[\d\.]+\.js)$'
 
   - repo: https://github.com/jumanjihouse/pre-commit-hooks
     rev: 3.0.0
     hooks:
       - id: script-must-have-extension
         name: Ensure shell scripts end with .sh
         types: [shell]
-        exclude: '\.sh\.tpl$'
+        exclude: '(^dreadgoad-console$|\.sh\.tpl$)'
       - id: shellcheck
         exclude: '\.sh\.tpl$'
       - id: shfmt

ad/GOAD-Light/scripts/constrained_delegation_kerb_only.ps1

@@ -14,5 +14,5 @@ if ($computer.ServicePrincipalNames -notcontains $spn) {
 
 $missing = @($delegateTo | Where-Object { $computer.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }

ad/GOAD-Light/scripts/constrained_delegation_use_any.ps1

@@ -16,5 +16,5 @@ Set-ADAccountControl -Identity $identity -TrustedToAuthForDelegation $true
 
 $missing = @($delegateTo | Where-Object { $user.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }

ad/GOAD/scripts/constrained_delegation_kerb_only.ps1

@@ -14,5 +14,5 @@ if ($computer.ServicePrincipalNames -notcontains $spn) {
 
 $missing = @($delegateTo | Where-Object { $computer.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }

ad/GOAD/scripts/constrained_delegation_use_any.ps1

@@ -15,5 +15,5 @@ Set-ADAccountControl -Identity $identity -TrustedToAuthForDelegation $true
 
 $missing = @($delegateTo | Where-Object { $user.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }

ansible/plugins/modules/win_ad_object.ps1

@@ -97,9 +97,10 @@ if ($null -eq $existing_obj) {
 
 # Now set the mayContain attributes, we do a last check on existing_obj in case we are in check mode
 if ($null -ne $may_contain -and $null -ne $existing_obj) {
+    $current_may_contain = @($existing_obj.mayContain | Where-Object { $_ -ne $null })
     foreach ($may_contain_entry in $may_contain) {
-        if (-not $existing_obj.mayContain.Contains($may_contain_entry)) {
-            Set-ADObject -Identity $existing_obj.ObjectGuid -Add @{ mayContain = $may_contain_entry } @common_params > $null
+        if ($may_contain_entry -notin $current_may_contain) {
+            Set-ADObject -Identity $existing_obj.ObjectGuid -Add @{ mayContain = [string]$may_contain_entry } @common_params > $null
             $result.changed = $true
         }
     }

ansible/roles/child_domain/README.md

@@ -23,9 +23,11 @@ Promote a Windows server as a child domain controller
 - **Configure DNS listener addresses** (ansible.windows.win_powershell) - Conditional
 - **Enable TLS 1.2 permanently via registry** (ansible.windows.win_regedit)
 - **Check if xDnsServer exists** (ansible.windows.win_shell)
+- **Unblock module DLLs before xDnsServer install** (ansible.windows.win_shell) - Conditional
 - **Install xDnsServer only if needed** (community.windows.win_psmodule) - Conditional
 - **Configure DNS Forwarders** (ansible.windows.win_dsc)
 - **Check if ActiveDirectoryDSC exists** (ansible.windows.win_shell)
+- **Unblock module DLLs before ActiveDirectoryDSC install** (ansible.windows.win_shell) - Conditional
 - **Install ActiveDirectoryDSC only if needed** (community.windows.win_psmodule) - Conditional
 - **Enable the Active Directory Web Services** (ansible.windows.win_service)