fix: Align ADCSESC3 creation and composition requirements BED-9336

[JonasBK]

Description

Fixes remaining ADCSESC3 creation/composition mismatches and restores the required publisher context for EnrollOnBehalfOf.

This PR is based on BED-9336-adcs-host-validation (PR3). It relies on that PR’s shared HostsCAService eligibility logic; it does not add new graph kinds or properties.

ESC3 certificate-template requirements

Aligns CT1 and CT2 signature validation across ESC3 post-processing and composition:

• CT1 schema version 1 is valid without checking AuthorizedSignatures.
• CT1 schema version 2+ requires AuthorizedSignatures = 0.
• CT2 schema version 1 has no AuthorizedSignatures requirement.
• CT2 schema version 2+ requires AuthorizedSignatures = 1.
• Invalid or missing required template properties fail closed where required.

Enrollment-agent restrictions

Treats missing or uncollected enrollment-agent restriction data as unrestricted.

DelegatedEnrollmentAgent is only required when restrictions were successfully collected and the Enterprise CA explicitly reports restrictions.

EnrollOnBehalfOf publisher requirements

EnrollOnBehalfOf is no longer created from globally compatible templates alone. For a CT1/CT2 pair, their selected publishers must satisfy the same target-domain requirements:

(ct1:CertTemplate)-[:PublishedTo]->(eca1:EnterpriseCA)
(ct2:CertTemplate)-[:PublishedTo]->(eca2:EnterpriseCA)

(eca1)-[:IssuedSignedBy|EnterpriseCAFor*1..]->(:RootCA)-[:RootCAFor]->(d:Domain)
(eca1)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(d)
(eca1)<-[:HostsCAService]-(:Computer {enabled: true})

(eca2)-[:IssuedSignedBy|EnterpriseCAFor*1..]->(:RootCA)-[:RootCAFor]->(d)
(eca2)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(d)
(eca2)<-[:HostsCAService]-(:Computer {enabled: true})

eca1 and eca2 may be the same CA. The host qualification follows the shared PR3 rules, including in-forest validation when the CA forest is resolvable.

The EOB relationship remains template-to-template and therefore does not store CA provenance. ESC3 creation and composition consequently revalidate the exact selected CT1 and CT2 publisher CAs before producing or returning an ESC3 path. This prevents an EOB relationship justified by one CA pairing from being reused with another incompatible pairing.

Tests

Added or updated coverage for:

• CT1/CT2 schema-version and authorized-signature combinations.
• Missing enrollment-agent restriction properties and uncollected restriction data.
• EOB creation when CT1 and CT2 share a valid hosted CA chain.
• EOB rejection when a publisher lacks a host, lacks NTAuth trust, or only chains to a different domain.
• ESC3 creation and composition selecting only publishers that have both RootCA and NTAuth paths to the target domain.

Stack

• Base: BED-9336-adcs-host-validation
• Head: BED-9336-fix-esc3
• This is PR 4 of 4.
• After PR 3 merges, retarget this PR to main.

Motivation and Context

Resolves BED-9336.

Before these changes, ESC3 could produce an edge that composition could not reconstruct, or composition could accept a publisher/CA pairing that was not valid for the edge’s target domain. EnrollOnBehalfOf could also connect templates from isolated or incompatible PKI contexts because it did not require the selected publishers to share a valid, hosted target-domain chain.

This PR makes the EOB precondition and concrete ESC3 selection agree on the required CA trust, host, and domain context.

How Has This Been Tested?

• just prepare-for-codereview
• go test ./packages/go/analysis/ad -count=1
• go test -tags=integration ./packages/go/analysis/ad -run '^$' -count=1
  The integration test package compiles successfully. The database-backed integration suite was not run in this environment.

Screenshots

N/A

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README #672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 47c12f78-8d8d-4cba-9f60-ad3bdd57fa0e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}