auth: Generate a human readable Authentication log message.

[nivanova/samba-autobuild/.git] / auth / common_auth.h

diff --git a/auth/common_auth.h b/auth/common_auth.h
index c0fd6b6d603c905524d1d3c1e1554b5286edc29a..c2ba846de54dd2ef7ba137b5de84164edccd85ff 100644 (file)
--- a/auth/common_auth.h
+++ b/auth/common_auth.h
@@ -25,7 +25,9 @@
 #define USER_INFO_CASE_INSENSITIVE_USERNAME 0x01 /* username may be in any case */
 #define USER_INFO_CASE_INSENSITIVE_PASSWORD 0x02 /* password may be in any case */
 #define USER_INFO_DONT_CHECK_UNIX_ACCOUNT   0x04 /* don't check unix account status */
-#define USER_INFO_INTERACTIVE_LOGON         0x08 /* don't check unix account status */
+#define USER_INFO_INTERACTIVE_LOGON         0x08 /* Interactive logon */
+/*unused #define USER_INFO_LOCAL_SAM_ONLY   0x10    Only authenticate against the local SAM, do not map missing passwords to NO_SUCH_USER */
+#define USER_INFO_INFO3_AND_NO_AUTHZ        0x20 /* Only fill in server_info->info3 and do not do any authorization steps */
 
 enum auth_password_state {
        AUTH_PASSWORD_PLAIN = 1,
@@ -37,11 +39,13 @@ enum auth_password_state {
 #define AUTH_SESSION_INFO_AUTHENTICATED      0x02 /* Add the user to the 'authenticated users' group */
 #define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES  0x04 /* Use a trivial map between users and privilages, rather than a DB */
 #define AUTH_SESSION_INFO_UNIX_TOKEN         0x08 /* The returned token must have the unix_token and unix_info elements provided */
+#define AUTH_SESSION_INFO_NTLM               0x10 /* The returned token must have authenticated-with-NTLM flag set */
 
 struct auth_usersupplied_info
 {
        const char *workstation_name;
        const struct tsocket_address *remote_host;
+       const struct tsocket_address *local_host;
 
        uint32_t logon_parameters;
 
@@ -68,6 +72,17 @@ struct auth_usersupplied_info
                char *plaintext;
        } password;
        uint32_t flags;
+
+       struct {
+               uint32_t negotiate_flags;
+               enum netr_SchannelType secure_channel_type;
+               const char *computer_name; /* [charset(UTF8)] */
+               const char *account_name; /* [charset(UTF8)] */
+               struct dom_sid *sid; /* [unique] */
+       } netlogon_trust_account;
+
+       const char *service_description;
+       const char *auth_description;
 };
 
 struct auth_method_context;
@@ -82,8 +97,6 @@ struct auth4_context {
                /* Who set this up in the first place? */
                const char *set_by;
 
-               bool may_be_modified;
-
                DATA_BLOB data;
        } challenge;
 
@@ -105,17 +118,16 @@ struct auth4_context {
        /* Private data for the callbacks on this auth context */
        void *private_data;
 
-       NTSTATUS (*check_password)(struct auth4_context *auth_ctx,
-                                  TALLOC_CTX *mem_ctx,
-                                  const struct auth_usersupplied_info *user_info,
-                                  void **server_returned_info,
-                                  DATA_BLOB *nt_session_key, DATA_BLOB *lm_session_key);
-
-       NTSTATUS (*get_challenge)(struct auth4_context *auth_ctx, uint8_t chal[8]);
+       NTSTATUS (*check_ntlm_password)(struct auth4_context *auth_ctx,
+                                       TALLOC_CTX *mem_ctx,
+                                       const struct auth_usersupplied_info *user_info,
+                                       uint8_t *pauthoritative,
+                                       void **server_returned_info,
+                                       DATA_BLOB *nt_session_key, DATA_BLOB *lm_session_key);
 
-       bool (*challenge_may_be_modified)(struct auth4_context *auth_ctx);
+       NTSTATUS (*get_ntlm_challenge)(struct auth4_context *auth_ctx, uint8_t chal[8]);
 
-       NTSTATUS (*set_challenge)(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by);
+       NTSTATUS (*set_ntlm_challenge)(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by);
 
        NTSTATUS (*generate_session_info)(struct auth4_context *auth_context,
                                          TALLOC_CTX *mem_ctx,
@@ -134,4 +146,10 @@ struct auth4_context {
                                              struct auth_session_info **session_info);
 };
 
+void log_authentication_event(const struct auth_usersupplied_info *ui,
+                             NTSTATUS status,
+                             const char *account_name,
+                             const char *domain_name,
+                             const char *unix_username,
+                             struct dom_sid *sid);
 #endif