auth/auth_log.c

   1 /*
   2
   3    Authentication and authorization logging
   4
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 /*
  22  * Debug log levels for authentication logging (these both map to
  23  * LOG_NOTICE in syslog)
  24  */
  25 #define AUTH_FAILURE_LEVEL 2
  26 #define AUTH_SUCCESS_LEVEL 3
  27 #define AUTHZ_SUCCESS_LEVEL 4
  28
  29 /* 5 is used for both authentication and authorization */
  30 #define AUTH_ANONYMOUS_LEVEL 5
  31 #define AUTHZ_ANONYMOUS_LEVEL 5
  32
  33 #define AUTHZ_JSON_TYPE "Authorization"
  34 #define AUTH_JSON_TYPE  "Authentication"
  35
  36 /*
  37  * JSON message version numbers
  38  *
  39  * If adding a field increment the minor version
  40  * If removing or changing the format/meaning of a field
  41  * increment the major version.
  42  */
  43 #define AUTH_MAJOR 1
  44 #define AUTH_MINOR 0
  45 #define AUTHZ_MAJOR 1
  46 #define AUTHZ_MINOR 1
  47
  48 #include "includes.h"
  49 #include "../lib/tsocket/tsocket.h"
  50 #include "common_auth.h"
  51 #include "lib/util/util_str_escape.h"
  52 #include "libcli/security/dom_sid.h"
  53 #include "libcli/security/security_token.h"
  54 #include "librpc/gen_ndr/server_id.h"
  55 #include "source4/lib/messaging/messaging.h"
  56 #include "source4/lib/messaging/irpc.h"
  57 #include "lib/util/server_id_db.h"
  58 #include "lib/param/param.h"
  59 #include "librpc/ndr/libndr.h"
  60 #include "lib/audit_logging/audit_logging.h"
  61
  62 /*
  63  * Determine the type of the password supplied for the
  64  * authorisation attempt.
  65  *
  66  */
  67 static const char* get_password_type(const struct auth_usersupplied_info *ui);
  68
  69 #ifdef HAVE_JANSSON
  70
  71 #include <jansson.h>
  72 #include "system/time.h"
  73
  74 /*
  75  * Write the json object to the debug logs.
  76  *
  77  */
  78 static void log_json(struct imessaging_context *msg_ctx,
  79                      struct loadparm_context *lp_ctx,
  80                      struct json_object *object,
  81                      int debug_class,
  82                      int debug_level)
  83 {
  84         audit_log_json(object, debug_class, debug_level);
  85         if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
  86                 audit_message_send(msg_ctx,
  87                                    AUTH_EVENT_NAME,
  88                                    MSG_AUTH_LOG,
  89                                    object);
  90         }
  91 }
  92
  93 /*
  94  * Write a machine parsable json formatted authentication log entry.
  95  *
  96  * IF removing or changing the format/meaning of a field please update the
  97  *    major version number AUTH_MAJOR
  98  *
  99  * IF adding a new field please update the minor version number AUTH_MINOR
 100  *
 101  *  To process the resulting log lines from the commend line use jq to
 102  *  parse the json.
 103  *
 104  *  grep "^  {" log file |
 105  *  jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
 106  *           \(.Authentication.clientDomain)\t
 107  *           \(.Authentication.clientAccount)
 108  *           \t\(.Authentication.workstation)
 109  *           \t\(.Authentication.remoteAddress)
 110  *           \t\(.Authentication.localAddress)"'
 111  */
 112 static void log_authentication_event_json(
 113         struct imessaging_context *msg_ctx,
 114         struct loadparm_context *lp_ctx,
 115         const struct timeval *start_time,
 116         const struct auth_usersupplied_info *ui,
 117         NTSTATUS status,
 118         const char *domain_name,
 119         const char *account_name,
 120         const char *unix_username,
 121         struct dom_sid *sid,
 122         int debug_level)
 123 {
 124         struct json_object wrapper = json_empty_object;
 125         struct json_object authentication = json_empty_object;
 126         char negotiate_flags[11];
 127         int rc = 0;
 128
 129         authentication = json_new_object();
 130         if (json_is_invalid(&authentication)) {
 131                 goto failure;
 132         }
 133         rc = json_add_version(&authentication, AUTH_MAJOR, AUTH_MINOR);
 134         if (rc != 0) {
 135                 goto failure;
 136         }
 137         rc = json_add_string(&authentication, "status", nt_errstr(status));
 138         if (rc != 0) {
 139                 goto failure;
 140         }
 141         rc = json_add_address(&authentication, "localAddress", ui->local_host);
 142         if (rc != 0) {
 143                 goto failure;
 144         }
 145         rc =
 146             json_add_address(&authentication, "remoteAddress", ui->remote_host);
 147         if (rc != 0) {
 148                 goto failure;
 149         }
 150         rc = json_add_string(
 151             &authentication, "serviceDescription", ui->service_description);
 152         if (rc != 0) {
 153                 goto failure;
 154         }
 155         rc = json_add_string(
 156             &authentication, "authDescription", ui->auth_description);
 157         if (rc != 0) {
 158                 goto failure;
 159         }
 160         rc = json_add_string(
 161             &authentication, "clientDomain", ui->client.domain_name);
 162         if (rc != 0) {
 163                 goto failure;
 164         }
 165         rc = json_add_string(
 166             &authentication, "clientAccount", ui->client.account_name);
 167         if (rc != 0) {
 168                 goto failure;
 169         }
 170         rc = json_add_string(
 171             &authentication, "workstation", ui->workstation_name);
 172         if (rc != 0) {
 173                 goto failure;
 174         }
 175         rc = json_add_string(&authentication, "becameAccount", account_name);
 176         if (rc != 0) {
 177                 goto failure;
 178         }
 179         rc = json_add_string(&authentication, "becameDomain", domain_name);
 180         if (rc != 0) {
 181                 goto failure;
 182         }
 183         rc = json_add_sid(&authentication, "becameSid", sid);
 184         if (rc != 0) {
 185                 goto failure;
 186         }
 187         rc = json_add_string(
 188             &authentication, "mappedAccount", ui->mapped.account_name);
 189         if (rc != 0) {
 190                 goto failure;
 191         }
 192         rc = json_add_string(
 193             &authentication, "mappedDomain", ui->mapped.domain_name);
 194         if (rc != 0) {
 195                 goto failure;
 196         }
 197         rc = json_add_string(&authentication,
 198                              "netlogonComputer",
 199                              ui->netlogon_trust_account.computer_name);
 200         if (rc != 0) {
 201                 goto failure;
 202         }
 203         rc = json_add_string(&authentication,
 204                              "netlogonTrustAccount",
 205                              ui->netlogon_trust_account.account_name);
 206         if (rc != 0) {
 207                 goto failure;
 208         }
 209         snprintf(negotiate_flags,
 210                  sizeof( negotiate_flags),
 211                  "0x%08X",
 212                  ui->netlogon_trust_account.negotiate_flags);
 213         rc = json_add_string(
 214             &authentication, "netlogonNegotiateFlags", negotiate_flags);
 215         if (rc != 0) {
 216                 goto failure;
 217         }
 218         rc = json_add_int(&authentication,
 219                           "netlogonSecureChannelType",
 220                           ui->netlogon_trust_account.secure_channel_type);
 221         if (rc != 0) {
 222                 goto failure;
 223         }
 224         rc = json_add_sid(&authentication,
 225                           "netlogonTrustAccountSid",
 226                           ui->netlogon_trust_account.sid);
 227         if (rc != 0) {
 228                 goto failure;
 229         }
 230         rc = json_add_string(
 231             &authentication, "passwordType", get_password_type(ui));
 232         if (rc != 0) {
 233                 goto failure;
 234         }
 235
 236         wrapper = json_new_object();
 237         if (json_is_invalid(&wrapper)) {
 238                 goto failure;
 239         }
 240         rc = json_add_timestamp(&wrapper);
 241         if (rc != 0) {
 242                 goto failure;
 243         }
 244         rc = json_add_string(&wrapper, "type", AUTH_JSON_TYPE);
 245         if (rc != 0) {
 246                 goto failure;
 247         }
 248         rc = json_add_object(&wrapper, AUTH_JSON_TYPE, &authentication);
 249         if (rc != 0) {
 250                 goto failure;
 251         }
 252
 253         /*
 254          * While not a general-purpose profiling solution this will
 255          * assist some to determine how long NTLM and KDC
 256          * authentication takes once this process can handle it.  This
 257          * covers transactions elsewhere but not (eg) the delay while
 258          * this is waiting unread on the input socket.
 259          */
 260         if (start_time != NULL) {
 261                 struct timeval current_time = timeval_current();
 262                 uint64_t duration =  usec_time_diff(&current_time,
 263                                                     start_time);
 264                 rc = json_add_int(&authentication, "duration", duration);
 265                 if (rc != 0) {
 266                         goto failure;
 267                 }
 268         }
 269
 270         log_json(msg_ctx,
 271                  lp_ctx,
 272                  &wrapper,
 273                  DBGC_AUTH_AUDIT_JSON,
 274                  debug_level);
 275         json_free(&wrapper);
 276         return;
 277 failure:
 278         /*
 279          * On a failure authentication will not have been added to wrapper so it
 280          * needs to be freed to avoid a leak.
 281          *
 282          */
 283         json_free(&authentication);
 284         json_free(&wrapper);
 285         DBG_ERR("Failed to write authentication event JSON log message\n");
 286 }
 287
 288 /*
 289  * Log details of a successful authorization to a service,
 290  * in a machine parsable json format
 291  *
 292  * IF removing or changing the format/meaning of a field please update the
 293  *    major version number AUTHZ_MAJOR
 294  *
 295  * IF adding a new field please update the minor version number AUTHZ_MINOR
 296  *
 297  *  To process the resulting log lines from the commend line use jq to
 298  *  parse the json.
 299  *
 300  *  grep "^  {" log_file |\
 301  *  jq -rc '"\(.timestamp)\t
 302  *           \(.Authorization.domain)\t
 303  *           \(.Authorization.account)\t
 304  *           \(.Authorization.remoteAddress)"'
 305  *
 306  */
 307 static void log_successful_authz_event_json(
 308         struct imessaging_context *msg_ctx,
 309         struct loadparm_context *lp_ctx,
 310         const struct tsocket_address *remote,
 311         const struct tsocket_address *local,
 312         const char *service_description,
 313         const char *auth_type,
 314         const char *transport_protection,
 315         struct auth_session_info *session_info,
 316         int debug_level)
 317 {
 318         struct json_object wrapper = json_empty_object;
 319         struct json_object authorization = json_empty_object;
 320         char account_flags[11];
 321         int rc = 0;
 322
 323         authorization = json_new_object();
 324         if (json_is_invalid(&authorization)) {
 325                 goto failure;
 326         }
 327         rc = json_add_version(&authorization, AUTHZ_MAJOR, AUTHZ_MINOR);
 328         if (rc != 0) {
 329                 goto failure;
 330         }
 331         rc = json_add_address(&authorization, "localAddress", local);
 332         if (rc != 0) {
 333                 goto failure;
 334         }
 335         rc = json_add_address(&authorization, "remoteAddress", remote);
 336         if (rc != 0) {
 337                 goto failure;
 338         }
 339         rc = json_add_string(
 340             &authorization, "serviceDescription", service_description);
 341         if (rc != 0) {
 342                 goto failure;
 343         }
 344         rc = json_add_string(&authorization, "authType", auth_type);
 345         if (rc != 0) {
 346                 goto failure;
 347         }
 348         rc = json_add_string(
 349             &authorization, "domain", session_info->info->domain_name);
 350         if (rc != 0) {
 351                 goto failure;
 352         }
 353         rc = json_add_string(
 354             &authorization, "account", session_info->info->account_name);
 355         if (rc != 0) {
 356                 goto failure;
 357         }
 358         rc = json_add_sid(
 359             &authorization, "sid", &session_info->security_token->sids[0]);
 360         if (rc != 0) {
 361                 goto failure;
 362         }
 363         rc = json_add_guid(
 364             &authorization, "sessionId", &session_info->unique_session_token);
 365         if (rc != 0) {
 366                 goto failure;
 367         }
 368         rc = json_add_string(
 369             &authorization, "logonServer", session_info->info->logon_server);
 370         if (rc != 0) {
 371                 goto failure;
 372         }
 373         rc = json_add_string(
 374             &authorization, "transportProtection", transport_protection);
 375         if (rc != 0) {
 376                 goto failure;
 377         }
 378
 379         snprintf(account_flags,
 380                  sizeof(account_flags),
 381                  "0x%08X",
 382                  session_info->info->acct_flags);
 383         rc = json_add_string(&authorization, "accountFlags", account_flags);
 384         if (rc != 0) {
 385                 goto failure;
 386         }
 387
 388         wrapper = json_new_object();
 389         if (json_is_invalid(&wrapper)) {
 390                 goto failure;
 391         }
 392         rc = json_add_timestamp(&wrapper);
 393         if (rc != 0) {
 394                 goto failure;
 395         }
 396         rc = json_add_string(&wrapper, "type", AUTHZ_JSON_TYPE);
 397         if (rc != 0) {
 398                 goto failure;
 399         }
 400         rc = json_add_object(&wrapper, AUTHZ_JSON_TYPE, &authorization);
 401         if (rc != 0) {
 402                 goto failure;
 403         }
 404
 405         log_json(msg_ctx,
 406                  lp_ctx,
 407                  &wrapper,
 408                  DBGC_AUTH_AUDIT_JSON,
 409                  debug_level);
 410         json_free(&wrapper);
 411         return;
 412 failure:
 413         /*
 414          * On a failure authorization will not have been added to wrapper so it
 415          * needs to be freed to avoid a leak.
 416          *
 417          */
 418         json_free(&authorization);
 419         json_free(&wrapper);
 420         DBG_ERR("Unable to log Authentication event JSON audit message\n");
 421 }
 422
 423 #else
 424
 425 static void log_no_json(struct imessaging_context *msg_ctx,
 426                         struct loadparm_context *lp_ctx)
 427 {
 428         if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
 429                 static bool auth_event_logged = false;
 430                 if (auth_event_logged == false) {
 431                         auth_event_logged = true;
 432                         DBG_ERR("auth event notification = true but Samba was "
 433                                 "not compiled with jansson\n");
 434                 }
 435         } else {
 436                 static bool json_logged = false;
 437                 if (json_logged == false) {
 438                         json_logged = true;
 439                         DBG_NOTICE("JSON auth logs not available unless "
 440                                    "compiled with jansson\n");
 441                 }
 442         }
 443
 444         return;
 445 }
 446
 447 static void log_authentication_event_json(
 448         struct imessaging_context *msg_ctx,
 449         struct loadparm_context *lp_ctx,
 450         const struct timeval *start_time,
 451         const struct auth_usersupplied_info *ui,
 452         NTSTATUS status,
 453         const char *domain_name,
 454         const char *account_name,
 455         const char *unix_username,
 456         struct dom_sid *sid,
 457         int debug_level)
 458 {
 459         log_no_json(msg_ctx, lp_ctx);
 460         return;
 461 }
 462
 463 static void log_successful_authz_event_json(
 464         struct imessaging_context *msg_ctx,
 465         struct loadparm_context *lp_ctx,
 466         const struct tsocket_address *remote,
 467         const struct tsocket_address *local,
 468         const char *service_description,
 469         const char *auth_type,
 470         const char *transport_protection,
 471         struct auth_session_info *session_info,
 472         int debug_level)
 473 {
 474         log_no_json(msg_ctx, lp_ctx);
 475         return;
 476 }
 477
 478 #endif
 479
 480 /*
 481  * Determine the type of the password supplied for the
 482  * authorisation attempt.
 483  *
 484  */
 485 static const char* get_password_type(const struct auth_usersupplied_info *ui)
 486 {
 487
 488         const char *password_type = NULL;
 489
 490         if (ui->password_type != NULL) {
 491                 password_type = ui->password_type;
 492         } else if (ui->auth_description != NULL &&
 493                    strncmp("ServerAuthenticate", ui->auth_description, 18) == 0)
 494         {
 495                 if (ui->netlogon_trust_account.negotiate_flags
 496                     & NETLOGON_NEG_SUPPORTS_AES) {
 497                         password_type = "HMAC-SHA256";
 498                 } else if (ui->netlogon_trust_account.negotiate_flags
 499                            & NETLOGON_NEG_STRONG_KEYS) {
 500                         password_type = "HMAC-MD5";
 501                 } else {
 502                         password_type = "DES";
 503                 }
 504         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE &&
 505                    (ui->logon_parameters & MSV1_0_ALLOW_MSVCHAPV2) &&
 506                    ui->password.response.nt.length == 24) {
 507                 password_type = "MSCHAPv2";
 508         } else if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
 509                    || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
 510                 password_type = "Plaintext";
 511         } else if (ui->password_state == AUTH_PASSWORD_HASH) {
 512                 password_type = "Supplied-NT-Hash";
 513         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 514                    && ui->password.response.nt.length > 24) {
 515                 password_type = "NTLMv2";
 516         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 517                    && ui->password.response.nt.length == 24) {
 518                 password_type = "NTLMv1";
 519         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 520                    && ui->password.response.lanman.length == 24) {
 521                 password_type = "LANMan";
 522         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 523                    && ui->password.response.nt.length == 0
 524                    && ui->password.response.lanman.length == 0) {
 525                 password_type = "No-Password";
 526         }
 527         return password_type;
 528 }
 529
 530 /*
 531  * Write a human readable authentication log entry.
 532  *
 533  */
 534 static void log_authentication_event_human_readable(
 535         const struct auth_usersupplied_info *ui,
 536         NTSTATUS status,
 537         const char *domain_name,
 538         const char *account_name,
 539         const char *unix_username,
 540         struct dom_sid *sid,
 541         int debug_level)
 542 {
 543         TALLOC_CTX *frame = NULL;
 544
 545         const char *ts = NULL;             /* formatted current time      */
 546         char *remote = NULL;               /* formatted remote host       */
 547         char *local = NULL;                /* formatted local host        */
 548         char *nl = NULL;                   /* NETLOGON details if present */
 549         char *trust_computer_name = NULL;
 550         char *trust_account_name = NULL;
 551         char *logon_line = NULL;
 552         const char *password_type = NULL;
 553
 554         frame = talloc_stackframe();
 555
 556         password_type = get_password_type(ui);
 557         /* Get the current time */
 558         ts = audit_get_timestamp(frame);
 559
 560         /* Only log the NETLOGON details if they are present */
 561         if (ui->netlogon_trust_account.computer_name ||
 562             ui->netlogon_trust_account.account_name) {
 563                 trust_computer_name = log_escape(frame,
 564                         ui->netlogon_trust_account.computer_name);
 565                 trust_account_name  = log_escape(frame,
 566                         ui->netlogon_trust_account.account_name);
 567                 nl = talloc_asprintf(frame,
 568                         " NETLOGON computer [%s] trust account [%s]",
 569                         trust_computer_name, trust_account_name);
 570         }
 571
 572         remote = tsocket_address_string(ui->remote_host, frame);
 573         local = tsocket_address_string(ui->local_host, frame);
 574
 575         if (NT_STATUS_IS_OK(status)) {
 576                 struct dom_sid_buf sid_buf;
 577
 578                 logon_line = talloc_asprintf(frame,
 579                                              " became [%s]\\[%s] [%s].",
 580                                              log_escape(frame, domain_name),
 581                                              log_escape(frame, account_name),
 582                                              dom_sid_str_buf(sid, &sid_buf));
 583         } else {
 584                 logon_line = talloc_asprintf(
 585                                 frame,
 586                                 " mapped to [%s]\\[%s].",
 587                                 log_escape(frame, ui->mapped.domain_name),
 588                                 log_escape(frame, ui->mapped.account_name));
 589         }
 590
 591         DEBUGC(DBGC_AUTH_AUDIT, debug_level,
 592                ("Auth: [%s,%s] user [%s]\\[%s]"
 593                 " at [%s] with [%s] status [%s]"
 594                 " workstation [%s] remote host [%s]"
 595                 "%s local host [%s]"
 596                 " %s\n",
 597                 ui->service_description,
 598                 ui->auth_description,
 599                 log_escape(frame, ui->client.domain_name),
 600                 log_escape(frame, ui->client.account_name),
 601                 ts,
 602                 password_type,
 603                 nt_errstr(status),
 604                 log_escape(frame, ui->workstation_name),
 605                 remote,
 606                 logon_line,
 607                 local,
 608                 nl ? nl : ""
 609         ));
 610
 611         talloc_free(frame);
 612 }
 613
 614 /*
 615  * Log details of an authentication attempt.
 616  * Successful and unsuccessful attempts are logged.
 617  *
 618  * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
 619  * authentication events over the message bus.
 620  */
 621 void log_authentication_event(
 622         struct imessaging_context *msg_ctx,
 623         struct loadparm_context *lp_ctx,
 624         const struct timeval *start_time,
 625         const struct auth_usersupplied_info *ui,
 626         NTSTATUS status,
 627         const char *domain_name,
 628         const char *account_name,
 629         const char *unix_username,
 630         struct dom_sid *sid)
 631 {
 632         /* set the log level */
 633         int debug_level = AUTH_FAILURE_LEVEL;
 634
 635         if (NT_STATUS_IS_OK(status)) {
 636                 debug_level = AUTH_SUCCESS_LEVEL;
 637                 if (dom_sid_equal(sid, &global_sid_Anonymous)) {
 638                         debug_level = AUTH_ANONYMOUS_LEVEL;
 639                 }
 640         }
 641
 642         if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT, debug_level)) {
 643                 log_authentication_event_human_readable(ui,
 644                                                         status,
 645                                                         domain_name,
 646                                                         account_name,
 647                                                         unix_username,
 648                                                         sid,
 649                                                         debug_level);
 650         }
 651         if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON, debug_level) ||
 652             (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx))) {
 653                 log_authentication_event_json(msg_ctx,
 654                                               lp_ctx,
 655                                               start_time,
 656                                               ui,
 657                                               status,
 658                                               domain_name,
 659                                               account_name,
 660                                               unix_username,
 661                                               sid,
 662                                               debug_level);
 663         }
 664 }
 665
 666
 667
 668 /*
 669  * Log details of a successful authorization to a service,
 670  * in a human readable format.
 671  *
 672  */
 673 static void log_successful_authz_event_human_readable(
 674         const struct tsocket_address *remote,
 675         const struct tsocket_address *local,
 676         const char *service_description,
 677         const char *auth_type,
 678         const char *transport_protection,
 679         struct auth_session_info *session_info,
 680         int debug_level)
 681 {
 682         TALLOC_CTX *frame = NULL;
 683
 684         const char *ts = NULL;       /* formatted current time      */
 685         char *remote_str = NULL;     /* formatted remote host       */
 686         char *local_str = NULL;      /* formatted local host        */
 687         struct dom_sid_buf sid_buf;
 688
 689         frame = talloc_stackframe();
 690
 691         /* Get the current time */
 692         ts = audit_get_timestamp(frame);
 693
 694         remote_str = tsocket_address_string(remote, frame);
 695         local_str = tsocket_address_string(local, frame);
 696
 697         DEBUGC(DBGC_AUTH_AUDIT, debug_level,
 698                ("Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
 699                 " at [%s]"
 700                 " Remote host [%s]"
 701                 " local host [%s]\n",
 702                 service_description,
 703                 auth_type,
 704                 log_escape(frame, session_info->info->domain_name),
 705                 log_escape(frame, session_info->info->account_name),
 706                 dom_sid_str_buf(&session_info->security_token->sids[0],
 707                                 &sid_buf),
 708                 ts,
 709                 remote_str,
 710                 local_str));
 711
 712         talloc_free(frame);
 713 }
 714
 715 /*
 716  * Log details of a successful authorization to a service.
 717  *
 718  * Only successful authorizations are logged.  For clarity:
 719  * - NTLM bad passwords will be recorded by log_authentication_event
 720  * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
 721  *
 722  * The service may later refuse authorization due to an ACL.
 723  *
 724  * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
 725  * authentication events over the message bus.
 726  */
 727 void log_successful_authz_event(
 728         struct imessaging_context *msg_ctx,
 729         struct loadparm_context *lp_ctx,
 730         const struct tsocket_address *remote,
 731         const struct tsocket_address *local,
 732         const char *service_description,
 733         const char *auth_type,
 734         const char *transport_protection,
 735         struct auth_session_info *session_info)
 736 {
 737         int debug_level = AUTHZ_SUCCESS_LEVEL;
 738
 739         /* set the log level */
 740         if (security_token_is_anonymous(session_info->security_token)) {
 741                 debug_level = AUTH_ANONYMOUS_LEVEL;
 742         }
 743
 744         if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT, debug_level)) {
 745                 log_successful_authz_event_human_readable(remote,
 746                                                           local,
 747                                                           service_description,
 748                                                           auth_type,
 749                                                           transport_protection,
 750                                                           session_info,
 751                                                           debug_level);
 752         }
 753         if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON, debug_level) ||
 754             (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx))) {
 755                 log_successful_authz_event_json(msg_ctx, lp_ctx,
 756                                                 remote,
 757                                                 local,
 758                                                 service_description,
 759                                                 auth_type,
 760                                                 transport_protection,
 761                                                 session_info,
 762                                                 debug_level);
 763         }
 764 }