traffic: new version of model with packet_rate, version number

[samba.git] / python / samba / tests / auth_log.py

diff --git a/python/samba/tests/auth_log.py b/python/samba/tests/auth_log.py
index 2b280bcc3c13bc79a6512434401c54c333f89c21..c0d0aab94aa6d8120abeca31c6bbeac6f876a4e5 100644 (file)
--- a/python/samba/tests/auth_log.py
+++ b/python/samba/tests/auth_log.py
@@ -28,6 +28,13 @@ from samba.credentials import DONT_USE_KERBEROS, MUST_USE_KERBEROS
 from samba import NTSTATUSError
 from subprocess import call
 from ldb import LdbError
+from samba.dcerpc.windows_event_ids import (
+    EVT_ID_SUCCESSFUL_LOGON,
+    EVT_ID_UNSUCCESSFUL_LOGON,
+    EVT_LOGON_NETWORK,
+    EVT_LOGON_INTERACTIVE,
+    EVT_LOGON_NETWORK_CLEAR_TEXT
+)
 import re
 
 
@@ -70,7 +77,8 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
         # Turn "[foo,bar]" into a list ("foo", "bar") to test
         # lambda x: x removes anything that evaluates to False,
         # including empty strings, so we handle "" as well
-        binding_list = list(filter(lambda x: x, re.compile('[\[,\]]').split(binding)))
+        binding_list = \
+            list(filter(lambda x: x, re.compile('[\[,\]]').split(binding)))
 
         # Handle explicit smb2, smb1 or auto negotiation
         if "smb2" in binding_list:
@@ -92,16 +100,20 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
         msg = messages[0]
         self.assertEquals("Authentication", msg["type"])
         self.assertEquals("NT_STATUS_OK", msg["Authentication"]["status"])
-        self._assert_ncacn_np_serviceDescription(binding,
-                                                 msg["Authentication"]["serviceDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
+        self._assert_ncacn_np_serviceDescription(
+            binding, msg["Authentication"]["serviceDescription"])
         self.assertEquals(authTypes[1],
                           msg["Authentication"]["authDescription"])
 
         # Check the second message it should be an Authorization
         msg = messages[1]
         self.assertEquals("Authorization", msg["type"])
-        self._assert_ncacn_np_serviceDescription(binding,
-                                                 msg["Authorization"]["serviceDescription"])
+        self._assert_ncacn_np_serviceDescription(
+            binding, msg["Authorization"]["serviceDescription"])
         self.assertEquals(authTypes[2], msg["Authorization"]["authType"])
         self.assertEquals("SMB", msg["Authorization"]["transportProtection"])
         self.assertTrue(self.is_guid(msg["Authorization"]["sessionId"]))
@@ -121,6 +133,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
 
             self.assertEquals(authTypes[3],
                               msg["Authentication"]["authDescription"])
+            self.assertEquals(
+                EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+            self.assertEquals(
+                EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
     def rpc_ncacn_np_krb5_check(
             self,
@@ -145,6 +161,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals(authTypes[1],
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
         # Check the second message it should be an Authentication
         # This this the TCP Authentication in response to the message too big
@@ -156,12 +176,16 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals(authTypes[2],
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
         # Check the third message it should be an Authorization
         msg = messages[2]
         self.assertEquals("Authorization", msg["type"])
-        self._assert_ncacn_np_serviceDescription(binding,
-                                                 msg["Authorization"]["serviceDescription"])
+        self._assert_ncacn_np_serviceDescription(
+            binding, msg["Authorization"]["serviceDescription"])
         self.assertEquals(authTypes[3], msg["Authorization"]["authType"])
         self.assertEquals("SMB", msg["Authorization"]["transportProtection"])
         self.assertTrue(self.is_guid(msg["Authorization"]["sessionId"]))
@@ -303,6 +327,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals(authTypes[2],
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
     def rpc_ncacn_ip_tcp_krb5_check(self, messages, authTypes, service,
                                     binding, protection):
@@ -329,6 +357,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals(authTypes[2],
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
         # Check the third message it should be an Authentication
         msg = messages[2]
@@ -338,6 +370,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals(authTypes[2],
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
     def test_rpc_ncacn_ip_tcp_ntlm_dns_sign(self):
         creds = self.insta_creds(template=self.get_credentials(),
@@ -441,6 +477,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
         self.assertEquals("ENC-TS Pre-authentication",
                           msg["Authentication"]["authDescription"])
         self.assertTrue(msg["Authentication"]["duration"] > 0)
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
         # Check the second message it should be an Authentication
         msg = messages[1]
@@ -451,6 +491,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
         self.assertEquals("ENC-TS Pre-authentication",
                           msg["Authentication"]["authDescription"])
         self.assertTrue(msg["Authentication"]["duration"] > 0)
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
     def test_ldap_ntlm(self):
 
@@ -476,6 +520,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals("NTLMSSP", msg["Authentication"]["authDescription"])
         self.assertTrue(msg["Authentication"]["duration"] > 0)
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK, msg["Authentication"]["logonType"])
 
     def test_ldap_simple_bind(self):
         def isLastExpectedMessage(msg):
@@ -505,6 +553,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals("simple bind",
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(
+            EVT_ID_SUCCESSFUL_LOGON, msg["Authentication"]["eventId"])
+        self.assertEquals(
+            EVT_LOGON_NETWORK_CLEAR_TEXT, msg["Authentication"]["logonType"])
 
     def test_ldap_simple_bind_bad_password(self):
         def isLastExpectedMessage(msg):
@@ -512,7 +564,12 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["serviceDescription"] == "LDAP" and
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_WRONG_PASSWORD") and
-                    msg["Authentication"]["authDescription"] == "simple bind")
+                    (msg["Authentication"]["authDescription"] ==
+                        "simple bind") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK_CLEAR_TEXT))
 
         creds = self.insta_creds(template=self.get_credentials())
         creds.set_password("badPassword")
@@ -539,7 +596,12 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["serviceDescription"] == "LDAP" and
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_NO_SUCH_USER") and
-                    msg["Authentication"]["authDescription"] == "simple bind")
+                    (msg["Authentication"]["authDescription"] ==
+                        "simple bind") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK_CLEAR_TEXT))
 
         creds = self.insta_creds(template=self.get_credentials())
         creds.set_bind_dn("%s\\%s" % (creds.get_domain(), "badUser"))
@@ -564,7 +626,12 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["serviceDescription"] == "LDAP" and
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_NO_SUCH_USER") and
-                    msg["Authentication"]["authDescription"] == "simple bind")
+                    (msg["Authentication"]["authDescription"] ==
+                        "simple bind") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK_CLEAR_TEXT))
 
         creds = self.insta_creds(template=self.get_credentials())
         creds.set_bind_dn("%s\\%s" % (creds.get_domain(), "abdcef"))
@@ -608,7 +675,7 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
     def test_ldap_anonymous_access(self):
         def isLastExpectedMessage(msg):
             return (msg["type"] == "Authorization" and
-                    msg["Authorization"]["serviceDescription"]  == "LDAP" and
+                    msg["Authorization"]["serviceDescription"] == "LDAP" and
                     msg["Authorization"]["transportProtection"] == "TLS" and
                     msg["Authorization"]["account"] == "ANONYMOUS LOGON" and
                     msg["Authorization"]["authType"] == "no bind")
@@ -656,6 +723,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals("ENC-TS Pre-authentication",
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(EVT_ID_SUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
         # Check the second message it should be an Authentication
         msg = messages[1]
@@ -665,6 +736,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["serviceDescription"])
         self.assertEquals("ENC-TS Pre-authentication",
                           msg["Authentication"]["authDescription"])
+        self.assertEquals(EVT_ID_SUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
     def test_smb_bad_password(self):
         def isLastExpectedMessage(msg):
@@ -702,7 +777,11 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_NO_SUCH_USER") and
                     (msg["Authentication"]["authDescription"] ==
-                        "ENC-TS Pre-authentication"))
+                        "ENC-TS Pre-authentication") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
 
         creds = self.insta_creds(template=self.get_credentials())
         creds.set_username("badUser")
@@ -730,7 +809,7 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authorization"]["account"] == "ANONYMOUS LOGON" and
                     msg["Authorization"]["transportProtection"] == "SMB")
 
-        server   = os.environ["SERVER"]
+        server = os.environ["SERVER"]
 
         path = "//%s/IPC$" % server
         auth = "-N"
@@ -752,6 +831,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["authDescription"])
         self.assertEquals("No-Password",
                           msg["Authentication"]["passwordType"])
+        self.assertEquals(EVT_ID_UNSUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
         # Check the second message it should be an Authentication
         msg = messages[1]
@@ -766,6 +849,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["passwordType"])
         self.assertEquals("ANONYMOUS LOGON",
                           msg["Authentication"]["becameAccount"])
+        self.assertEquals(EVT_ID_SUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
     def test_smb2_anonymous(self):
         def isLastExpectedMessage(msg):
@@ -775,7 +862,7 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authorization"]["account"] == "ANONYMOUS LOGON" and
                     msg["Authorization"]["transportProtection"] == "SMB")
 
-        server   = os.environ["SERVER"]
+        server = os.environ["SERVER"]
 
         path = "//%s/IPC$" % server
         auth = "-N"
@@ -797,6 +884,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["authDescription"])
         self.assertEquals("No-Password",
                           msg["Authentication"]["passwordType"])
+        self.assertEquals(EVT_ID_UNSUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
         # Check the second message it should be an Authentication
         msg = messages[1]
@@ -811,6 +902,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["passwordType"])
         self.assertEquals("ANONYMOUS LOGON",
                           msg["Authentication"]["becameAccount"])
+        self.assertEquals(EVT_ID_SUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
     def test_smb_no_krb_spnego(self):
         def isLastExpectedMessage(msg):
@@ -840,6 +935,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["authDescription"])
         self.assertEquals("NTLMv2",
                           msg["Authentication"]["passwordType"])
+        self.assertEquals(EVT_ID_SUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
     def test_smb_no_krb_spnego_bad_password(self):
         def isLastExpectedMessage(msg):
@@ -848,7 +947,11 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["authDescription"] == "NTLMSSP" and
                     msg["Authentication"]["passwordType"] == "NTLMv2" and
                     (msg["Authentication"]["status"] ==
-                        "NT_STATUS_WRONG_PASSWORD"))
+                        "NT_STATUS_WRONG_PASSWORD") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
 
         creds = self.insta_creds(template=self.get_credentials(),
                                  kerberos_state=DONT_USE_KERBEROS)
@@ -876,7 +979,11 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["authDescription"] == "NTLMSSP" and
                     msg["Authentication"]["passwordType"] == "NTLMv2" and
                     (msg["Authentication"]["status"] ==
-                        "NT_STATUS_NO_SUCH_USER"))
+                        "NT_STATUS_NO_SUCH_USER") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
 
         creds = self.insta_creds(template=self.get_credentials(),
                                  kerberos_state=DONT_USE_KERBEROS)
@@ -927,6 +1034,10 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                           msg["Authentication"]["authDescription"])
         self.assertEquals("NTLMv1",
                           msg["Authentication"]["passwordType"])
+        self.assertEquals(EVT_ID_SUCCESSFUL_LOGON,
+                          msg["Authentication"]["eventId"])
+        self.assertEquals(EVT_LOGON_NETWORK,
+                          msg["Authentication"]["logonType"])
 
     def test_smb_no_krb_no_spnego_no_ntlmv2_bad_password(self):
         def isLastExpectedMessage(msg):
@@ -935,7 +1046,11 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["authDescription"] == "bare-NTLM" and
                     msg["Authentication"]["passwordType"] == "NTLMv1" and
                     (msg["Authentication"]["status"] ==
-                        "NT_STATUS_WRONG_PASSWORD"))
+                        "NT_STATUS_WRONG_PASSWORD") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
 
         creds = self.insta_creds(template=self.get_credentials(),
                                  kerberos_state=DONT_USE_KERBEROS)
@@ -965,7 +1080,11 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["authDescription"] == "bare-NTLM" and
                     msg["Authentication"]["passwordType"] == "NTLMv1" and
                     (msg["Authentication"]["status"] ==
-                        "NT_STATUS_NO_SUCH_USER"))
+                        "NT_STATUS_NO_SUCH_USER") and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
 
         creds = self.insta_creds(template=self.get_credentials(),
                                  kerberos_state=DONT_USE_KERBEROS)
@@ -1000,10 +1119,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                         "interactive") and
                     msg["Authentication"]["status"] == "NT_STATUS_OK" and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_SUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_INTERACTIVE))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = os.environ["PASSWORD"]
         samlogon = "samlogon %s %s %s %d" % (user, password, workstation, 1)
 
@@ -1029,10 +1152,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_WRONG_PASSWORD") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_INTERACTIVE))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = "badPassword"
         samlogon = "samlogon %s %s %s %d" % (user, password, workstation, 1)
 
@@ -1058,10 +1185,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_NO_SUCH_USER") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = "badUser"
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_INTERACTIVE))
+
+        server = os.environ["SERVER"]
+        user = "badUser"
         password = os.environ["PASSWORD"]
         samlogon = "samlogon %s %s %s %d" % (user, password, workstation, 1)
 
@@ -1085,10 +1216,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     msg["Authentication"]["authDescription"] == "network" and
                     msg["Authentication"]["status"] == "NT_STATUS_OK" and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_SUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = os.environ["PASSWORD"]
         samlogon = "samlogon %s %s %s %d" % (user, password, workstation, 2)
 
@@ -1113,10 +1248,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_WRONG_PASSWORD") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = "badPassword"
         samlogon = "samlogon %s %s %s %d" % (user, password, workstation, 2)
 
@@ -1141,10 +1280,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["status"] ==
                         "NT_STATUS_NO_SUCH_USER") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = "badUser"
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = "badUser"
         password = os.environ["PASSWORD"]
         samlogon = "samlogon %s %s %s %d" % (user, password, workstation, 2)
 
@@ -1169,10 +1312,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["status"] == "NT_STATUS_OK") and
                     (msg["Authentication"]["passwordType"] == "MSCHAPv2") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_SUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = os.environ["PASSWORD"]
         samlogon = "samlogon %s %s %s %d 0x00010000" % (
             user, password, workstation, 2)
@@ -1199,10 +1346,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                         "NT_STATUS_WRONG_PASSWORD") and
                     (msg["Authentication"]["passwordType"] == "MSCHAPv2") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = "badPassword"
         samlogon = "samlogon %s %s %s %d 0x00010000" % (
             user, password, workstation, 2)
@@ -1229,10 +1380,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                         "NT_STATUS_NO_SUCH_USER") and
                     (msg["Authentication"]["passwordType"] == "MSCHAPv2") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = "badUser"
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_UNSUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = "badUser"
         password = os.environ["PASSWORD"]
         samlogon = "samlogon %s %s %s %d 0x00010000" % (
             user, password, workstation, 2)
@@ -1257,10 +1412,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["authDescription"] == "network") and
                     (msg["Authentication"]["status"] == "NT_STATUS_OK") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_SUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = os.environ["PASSWORD"]
         samlogon = "schannel;samlogon %s %s %s" % (user, password, workstation)
 
@@ -1295,10 +1454,14 @@ class AuthLogTests(samba.tests.auth_log_base.AuthLogTestBase):
                     (msg["Authentication"]["authDescription"] == "network") and
                     (msg["Authentication"]["status"] == "NT_STATUS_OK") and
                     (msg["Authentication"]["workstation"] ==
-                        r"\\%s" % workstation))
-
-        server   = os.environ["SERVER"]
-        user     = os.environ["USERNAME"]
+                        r"\\%s" % workstation) and
+                    (msg["Authentication"]["eventId"] ==
+                        EVT_ID_SUCCESSFUL_LOGON) and
+                    (msg["Authentication"]["logonType"] ==
+                        EVT_LOGON_NETWORK))
+
+        server = os.environ["SERVER"]
+        user = os.environ["USERNAME"]
         password = os.environ["PASSWORD"]
         samlogon = "schannelsign;samlogon %s %s %s" % (
             user, password, workstation)