fix: Scope ADCS host validation to exact Enterprise CAs BED-9336

[JonasBK]

Description

This PR makes Enterprise CA host validation equivalent in ADCS edge creation and composition, and correlates every host with the exact Enterprise CA selected by a candidate path.

A qualifying host must:

• Be a Computer connected to the selected EnterpriseCA by HostsCAService.
• Have enabled = true.
• Belong to the Enterprise CA’s forest when that forest can be resolved from the CA’s domainsid.
• Have a resolvable host domain within that forest.
• Fall back to forest-agnostic handling only when collected metadata cannot identify the CA’s forest.
• Propagate database and traversal failures instead of treating operational errors as an unresolved-forest fallback.

Composition candidates are staged by Enterprise CA. A candidate is added only when that exact CA has a qualifying host, and only qualifying HostsCAService paths for that CA are returned.

This prevents a valid host for CA A from preserving composition paths belonging to an unhosted, disabled-hosted, or cross-forest-hosted CA B.

The behavior applies to ESC1, ESC3, ESC4, ESC6, existing ESC9 composition, ESC10, ESC13, ADCS NTLM relay, and GoldenCert creation and composition. ESC3 requires qualifying hosts for both its CT1 publisher CA and target CA.

Stack

• Base: BED-9336-adcs-trust-paths
• Head: BED-9336-adcs-host-validation
• This is PR 3 of 4.
• After PR 2 merges, retarget this PR to main.

Commit review order

1. fix: include HostsCAService paths in ADCS compositions BED-9336

   • Makes the required host relationship visible in affected composition graphs.
   • Updates existing composition expectations.

2. fix: require qualifying hosts for ESC3 CAs BED-9336

   • Introduces shared enabled/in-forest host eligibility.
   • Requires qualifying hosts for both ESC3 Enterprise CAs.

3. fix: scope ADCS host validation to exact CAs BED-9336

   • Reuses one host qualification operation in cache construction and composition.
   • Filters composition candidates by exact CA.
   • Adds eligibility, fallback, error-propagation, and multi-CA tests.

4. refactor: share ADCS CA enrollment traversal BED-9336

   • Consolidates the repeated CA enrollment and NTAuth traversal used by several compositions.
   • This commit is mechanical and does not change intended requirements.

5. fix: validate GoldenCert hosts consistently BED-9336

   • Applies the same host predicate to GoldenCert creation.
   • Returns only qualifying host paths from GoldenCert composition.
   • Adds mixed valid/invalid host coverage.

Motivation and Context

Resolves BED-9336

Creation required an enabled and, when resolvable, in-forest CA host. Composition previously accepted any Computer-[:HostsCAService]->EnterpriseCA relationship and validated all materialized CA alternatives collectively.

One valid hosted CA could therefore keep the composition nonempty while it still contained alternatives through invalid CAs. Composition also omitted a relationship required by creation.

This PR establishes the invariant that every returned CA candidate is justified by a qualifying host path for that same CA.

How Has This Been Tested?

The final stack passed:

• just prepare-for-codereview

Focused coverage includes enabled, disabled, cross-forest, unresolved-domain, and mixed-host scenarios; the unresolved-CA-forest fallback; error propagation; multi-CA composition isolation; GoldenCert host filtering; and affected ADCS compositions requiring HostsCAService.

Screenshots (optional):

N/A — backend graph analysis only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README #672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Essentials

Run ID: aa8afb25-f0e8-4ed4-a76e-b05daab62a27

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}