sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code

s4:kdc: Add getter functions for authn_audit_info

Browse Source 
These functions return various pieces of information about an audit
event that can go into audit logs.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2023-06-15 10:37:03 +12:00 committed by Andrew Bartlett
parent a3063fb4f5
commit f47631b360
2 changed files with 181 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

154
auth/authn_policy.c
View File

@ -29,6 +29,12 @@ bool authn_policy_is_enforced(const struct authn_policy *policy)
/* Authentication policies for Kerberos clients. */
/* Is an authentication policy enforced? */
bool authn_kerberos_client_policy_is_enforced(const struct authn_kerberos_client_policy *policy)
{
return authn_policy_is_enforced(&policy->policy);
}
/* Get the raw TGT lifetime enforced by an authentication policy. */
int64_t authn_policy_enforced_tgt_lifetime_raw(const struct authn_kerberos_client_policy *policy)
{
@ -83,3 +89,151 @@ NTSTATUS authn_policy_ntlm_apply_device_restriction(const char *client_account_n
return NT_STATUS_OK;
}
}
/* Auditing information. */
enum auth_event_id_type authn_audit_info_event_id(const struct authn_audit_info *audit_info)
{
bool is_enforced;
if (audit_info->event == AUTHN_AUDIT_EVENT_OK) {
/* We didn’t get an error. */
return AUTH_EVT_ID_NONE;
}
if (audit_info->policy == NULL) {
/*
* We got an error, but there’s no policy, so it must have
* stemmed from something else.
*/
return AUTH_EVT_ID_NONE;
}
is_enforced = authn_policy_is_enforced(audit_info->policy);
switch (audit_info->event) {
case AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION:
if (is_enforced) {
return AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION;
}
return AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION_AUDIT;
case AUTHN_AUDIT_EVENT_KERBEROS_SERVER_RESTRICTION:
if (is_enforced) {
return AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION;
}
return AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION_AUDIT;
case AUTHN_AUDIT_EVENT_NTLM_DEVICE_RESTRICTION:
if (is_enforced) {
return AUTH_EVT_ID_NTLM_DEVICE_RESTRICTION;
}
/* No relevant event ID. */
break;
case AUTHN_AUDIT_EVENT_NTLM_SERVER_RESTRICTION:
case AUTHN_AUDIT_EVENT_OTHER_ERROR:
default:
/* No relevant event ID. */
break;
}
return AUTH_EVT_ID_NONE;
}
const char *authn_audit_info_silo_name(const struct authn_audit_info *audit_info)
{
if (audit_info->policy == NULL) {
return NULL;
}
return audit_info->policy->silo_name;
}
const char *authn_audit_info_policy_name(const struct authn_audit_info *audit_info)
{
if (audit_info->policy == NULL) {
return NULL;
}
return audit_info->policy->policy_name;
}
const bool *authn_audit_info_policy_enforced(const struct authn_audit_info *audit_info)
{
if (audit_info->policy == NULL) {
return NULL;
}
return &audit_info->policy->enforced;
}
const struct auth_user_info_dc *authn_audit_info_client_info(const struct authn_audit_info *audit_info)
{
return audit_info->client_info;
}
const char *authn_audit_info_event(const struct authn_audit_info *audit_info)
{
switch (audit_info->event) {
case AUTHN_AUDIT_EVENT_OK:
return "OK";
case AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION:
return "KERBEROS_DEVICE_RESTRICTION";
case AUTHN_AUDIT_EVENT_KERBEROS_SERVER_RESTRICTION:
return "KERBEROS_SERVER_RESTRICTION";
case AUTHN_AUDIT_EVENT_NTLM_DEVICE_RESTRICTION:
return "NTLM_DEVICE_RESTRICTION";
case AUTHN_AUDIT_EVENT_NTLM_SERVER_RESTRICTION:
return "NTLM_SERVER_RESTRICTION";
case AUTHN_AUDIT_EVENT_OTHER_ERROR:
default:
return "OTHER_ERROR";
}
}
const char *authn_audit_info_reason(const struct authn_audit_info *audit_info)
{
switch (audit_info->reason) {
case AUTHN_AUDIT_REASON_DESCRIPTOR_INVALID:
return "DESCRIPTOR_INVALID";
case AUTHN_AUDIT_REASON_DESCRIPTOR_NO_OWNER:
return "DESCRIPTOR_NO_OWNER";
case AUTHN_AUDIT_REASON_SECURITY_TOKEN_FAILURE:
return "SECURITY_TOKEN_FAILURE";
case AUTHN_AUDIT_REASON_ACCESS_DENIED:
return "ACCESS_DENIED";
case AUTHN_AUDIT_REASON_FAST_REQUIRED:
return "FAST_REQUIRED";
case AUTHN_AUDIT_REASON_NONE:
default:
return NULL;
}
}
NTSTATUS authn_audit_info_policy_status(const struct authn_audit_info *audit_info)
{
return audit_info->policy_status;
}
const char *authn_audit_info_location(const struct authn_audit_info *audit_info)
{
return audit_info->location;
}
struct authn_int64_optional authn_audit_info_policy_tgt_lifetime_mins(const struct authn_audit_info *audit_info)
{
int64_t lifetime;
if (!audit_info->tgt_lifetime_raw.is_present) {
return authn_int64_none();
}
lifetime = audit_info->tgt_lifetime_raw.val;
lifetime /= INT64_C(1000) * 1000 * 10 * 60;
return authn_int64_some(lifetime);
}

27
auth/authn_policy.h
View File

@ -29,6 +29,9 @@
struct authn_kerberos_client_policy;
/* Is an authentication policy enforced? */
bool authn_kerberos_client_policy_is_enforced(const struct authn_kerberos_client_policy *policy);
/* Get the raw TGT lifetime enforced by an authentication policy. */
int64_t authn_policy_enforced_tgt_lifetime_raw(const struct authn_kerberos_client_policy *policy);
@ -41,8 +44,11 @@ NTSTATUS authn_policy_ntlm_apply_device_restriction(const char *client_account_n
const char *device_account_name,
const struct authn_ntlm_client_policy *client_policy);
/* Auditing information. */
struct authn_audit_info;
/* This enum should be kept in sync with authn_audit_info_event(). */
enum authn_audit_event {
AUTHN_AUDIT_EVENT_OK = 0,
AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION,
@ -52,6 +58,7 @@ enum authn_audit_event {
AUTHN_AUDIT_EVENT_OTHER_ERROR,
};
/* This enum should be kept in sync with authn_audit_info_reason(). */
enum authn_audit_reason {
AUTHN_AUDIT_REASON_NONE = 0,
AUTHN_AUDIT_REASON_DESCRIPTOR_INVALID,
@ -61,9 +68,29 @@ enum authn_audit_reason {
AUTHN_AUDIT_REASON_FAST_REQUIRED,
};
enum auth_event_id_type authn_audit_info_event_id(const struct authn_audit_info *audit_info);
const char *authn_audit_info_silo_name(const struct authn_audit_info *audit_info);
const char *authn_audit_info_policy_name(const struct authn_audit_info *audit_info);
const bool *authn_audit_info_policy_enforced(const struct authn_audit_info *audit_info);
const struct auth_user_info_dc *authn_audit_info_client_info(const struct authn_audit_info *audit_info);
const char *authn_audit_info_event(const struct authn_audit_info *audit_info);
const char *authn_audit_info_reason(const struct authn_audit_info *audit_info);
NTSTATUS authn_audit_info_policy_status(const struct authn_audit_info *audit_info);
const char *authn_audit_info_location(const struct authn_audit_info *audit_info);
struct authn_int64_optional {
bool is_present;
int64_t val;
};
struct authn_int64_optional authn_audit_info_policy_tgt_lifetime_mins(const struct authn_audit_info *audit_info);
#endif