#
# Cookbook Name:: mu-utility
# Recipe:: rdp_gateway
#
# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
#
# Licensed under the BSD-3 license (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License in the root of the project or at
#
#     http://egt-labs.com/mu/LICENSE.html
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

if !platform_family?("windows")
  Chef::Log.info "I don't know how to enable RDP gateway behavior on a non-Windows host"
else

  powershell_script "Install Remote Desktop Gateway services" do
    guard_interpreter :powershell_script
    not_if "Import-Module RemoteDesktopServices"
    code <<-EOH
			Add-WindowsFeature -Name RDS-Gateway -IncludeAllSubFeature
    EOH
  end

  powershell_script "Configure Remote Desktop Gateway services" do
    guard_interpreter :powershell_script
    code <<-EOH
			Import-Module RemoteDesktopServices
			cd RDS:\\GatewayServer\\CAP
			New-Item -Name StandardAccess -UserGroups 'Remote Desktop Users@BUILTIN' -AuthMethod 1
			New-Item -Name AdminAccess -UserGroups 'Administrators@BUILTIN' -AuthMethod 1
			cd RDS:\\GatewayServer\\RAP
			New-Item -Name StandardAccess -UserGroups 'Remote Desktop Users@BUILTIN' -ComputerGroupType 2
			New-Item -Name AdminAccess -UserGroups 'Administrators@BUILTIN' -ComputerGroupType 2

			# This bleeding horror lifted from: http://blogs.technet.com/b/vishalagarwal/archive/2009/08/22/generating-a-certificate-self-signed-using-powershell-and-certenroll-interfaces.aspx
			$name = new-object -com "X509Enrollment.CX500DistinguishedName.1"
			$name.Encode("CN=RDS", 0)

			$key = new-object -com "X509Enrollment.CX509PrivateKey.1"
			$key.ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
			$key.KeySpec = 1
			$key.Length = 1024
			$key.SecurityDescriptor = "D:PAI(A;;0xd01f01ff;;;SY)(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)"
			$key.MachineContext = 1
			$key.Create()

			$serverauthoid = new-object -com "X509Enrollment.CObjectId.1"
			$serverauthoid.InitializeFromValue("1.3.6.1.5.5.7.3.1")
			$ekuoids = new-object -com "X509Enrollment.CObjectIds.1"
			$ekuoids.add($serverauthoid)
			$ekuext = new-object -com "X509Enrollment.CX509ExtensionEnhancedKeyUsage.1"
			$ekuext.InitializeEncode($ekuoids)

			$cert = new-object -com "X509Enrollment.CX509CertificateRequestCertificate.1"
			$cert.InitializeFromPrivateKey(2, $key, "")
			$cert.Subject = $name
			$cert.Issuer = $cert.Subject
			$cert.NotBefore = get-date
			$cert.NotAfter = $cert.NotBefore.AddDays(3650)
			$cert.X509Extensions.Add($ekuext)
			$cert.Encode()

			$enrollment = new-object -com "X509Enrollment.CX509Enrollment.1"
			$enrollment.InitializeFromRequest($cert)
			$certdata = $enrollment.CreateRequest(0)
			$enrollment.InstallResponse(2, $certdata, 0, "")

			# Thumbprint bit: http://www.frontiertown.co.uk/jclouds/activate-winrm.ps1
			$thumbprints = Get-Childitem -path cert:\\LocalMachine\\My | Where-Object { $_.Subject -eq "CN=RDS" } | Select-Object -Property Thumbprint
			$thumbprint = @($thumbprints)[0].Thumbprint
			Set-Item -Path RDS:\\GatewayServer\\SSLCertificate\\Thumbprint -Value $thumbprint

			Restart-Service TSGateway
    EOH
  end
end