s4:kdc: Add getter functions for authn_audit_info

These functions return various pieces of information about an audit
event that can go into audit logs.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

auth/authn_policy.c

@@ -29,6 +29,12 @@ bool authn_policy_is_enforced(const struct authn_policy *policy)
 
 /* Authentication policies for Kerberos clients. */
 
+/* Is an authentication policy enforced? */
+bool authn_kerberos_client_policy_is_enforced(const struct authn_kerberos_client_policy *policy)
+{
+	return authn_policy_is_enforced(&policy->policy);
+}
+
 /* Get the raw TGT lifetime enforced by an authentication policy. */
 int64_t authn_policy_enforced_tgt_lifetime_raw(const struct authn_kerberos_client_policy *policy)
 {
@@ -83,3 +89,151 @@ NTSTATUS authn_policy_ntlm_apply_device_restriction(const char *client_account_n
 		return NT_STATUS_OK;
 	}
 }
+
+/* Auditing information. */
+
+enum auth_event_id_type authn_audit_info_event_id(const struct authn_audit_info *audit_info)
+{
+	bool is_enforced;
+
+	if (audit_info->event == AUTHN_AUDIT_EVENT_OK) {
+		/* We didn’t get an error. */
+		return AUTH_EVT_ID_NONE;
+	}
+
+	if (audit_info->policy == NULL) {
+		/*
+		 * We got an error, but there’s no policy, so it must have
+		 * stemmed from something else.
+		 */
+		return AUTH_EVT_ID_NONE;
+	}
+
+	is_enforced = authn_policy_is_enforced(audit_info->policy);
+
+	switch (audit_info->event) {
+	case AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION:
+		if (is_enforced) {
+			return AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION;
+		}
+
+		return AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION_AUDIT;
+
+	case AUTHN_AUDIT_EVENT_KERBEROS_SERVER_RESTRICTION:
+		if (is_enforced) {
+			return AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION;
+		}
+
+		return AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION_AUDIT;
+
+	case AUTHN_AUDIT_EVENT_NTLM_DEVICE_RESTRICTION:
+		if (is_enforced) {
+			return AUTH_EVT_ID_NTLM_DEVICE_RESTRICTION;
+		}
+
+		/* No relevant event ID. */
+		break;
+
+	case AUTHN_AUDIT_EVENT_NTLM_SERVER_RESTRICTION:
+	case AUTHN_AUDIT_EVENT_OTHER_ERROR:
+	default:
+		/* No relevant event ID. */
+		break;
+	}
+
+	return AUTH_EVT_ID_NONE;
+}
+
+const char *authn_audit_info_silo_name(const struct authn_audit_info *audit_info)
+{
+	if (audit_info->policy == NULL) {
+		return NULL;
+	}
+
+	return audit_info->policy->silo_name;
+}
+
+const char *authn_audit_info_policy_name(const struct authn_audit_info *audit_info)
+{
+	if (audit_info->policy == NULL) {
+		return NULL;
+	}
+
+	return audit_info->policy->policy_name;
+}
+
+const bool *authn_audit_info_policy_enforced(const struct authn_audit_info *audit_info)
+{
+	if (audit_info->policy == NULL) {
+		return NULL;
+	}
+
+	return &audit_info->policy->enforced;
+}
+
+const struct auth_user_info_dc *authn_audit_info_client_info(const struct authn_audit_info *audit_info)
+{
+	return audit_info->client_info;
+}
+
+const char *authn_audit_info_event(const struct authn_audit_info *audit_info)
+{
+	switch (audit_info->event) {
+	case AUTHN_AUDIT_EVENT_OK:
+		return "OK";
+	case AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION:
+		return "KERBEROS_DEVICE_RESTRICTION";
+	case AUTHN_AUDIT_EVENT_KERBEROS_SERVER_RESTRICTION:
+		return "KERBEROS_SERVER_RESTRICTION";
+	case AUTHN_AUDIT_EVENT_NTLM_DEVICE_RESTRICTION:
+		return "NTLM_DEVICE_RESTRICTION";
+	case AUTHN_AUDIT_EVENT_NTLM_SERVER_RESTRICTION:
+		return "NTLM_SERVER_RESTRICTION";
+	case AUTHN_AUDIT_EVENT_OTHER_ERROR:
+	default:
+		return "OTHER_ERROR";
+	}
+}
+
+const char *authn_audit_info_reason(const struct authn_audit_info *audit_info)
+{
+	switch (audit_info->reason) {
+	case AUTHN_AUDIT_REASON_DESCRIPTOR_INVALID:
+		return "DESCRIPTOR_INVALID";
+	case AUTHN_AUDIT_REASON_DESCRIPTOR_NO_OWNER:
+		return "DESCRIPTOR_NO_OWNER";
+	case AUTHN_AUDIT_REASON_SECURITY_TOKEN_FAILURE:
+		return "SECURITY_TOKEN_FAILURE";
+	case AUTHN_AUDIT_REASON_ACCESS_DENIED:
+		return "ACCESS_DENIED";
+	case AUTHN_AUDIT_REASON_FAST_REQUIRED:
+		return "FAST_REQUIRED";
+	case AUTHN_AUDIT_REASON_NONE:
+	default:
+		return NULL;
+	}
+}
+
+NTSTATUS authn_audit_info_policy_status(const struct authn_audit_info *audit_info)
+{
+	return audit_info->policy_status;
+}
+
+const char *authn_audit_info_location(const struct authn_audit_info *audit_info)
+{
+	return audit_info->location;
+}
+
+struct authn_int64_optional authn_audit_info_policy_tgt_lifetime_mins(const struct authn_audit_info *audit_info)
+{
+	int64_t lifetime;
+
+	if (!audit_info->tgt_lifetime_raw.is_present) {
+		return authn_int64_none();
+	}
+
+	lifetime = audit_info->tgt_lifetime_raw.val;
+	lifetime /= INT64_C(1000) * 1000 * 10 * 60;
+
+	return authn_int64_some(lifetime);
+}

auth/authn_policy.h

@@ -29,6 +29,9 @@
 
 struct authn_kerberos_client_policy;
 
+/* Is an authentication policy enforced? */
+bool authn_kerberos_client_policy_is_enforced(const struct authn_kerberos_client_policy *policy);
+
 /* Get the raw TGT lifetime enforced by an authentication policy. */
 int64_t authn_policy_enforced_tgt_lifetime_raw(const struct authn_kerberos_client_policy *policy);
 
@@ -41,8 +44,11 @@ NTSTATUS authn_policy_ntlm_apply_device_restriction(const char *client_account_n
 						    const char *device_account_name,
 						    const struct authn_ntlm_client_policy *client_policy);
 
+/* Auditing information. */
+
 struct authn_audit_info;
 
+/* This enum should be kept in sync with authn_audit_info_event(). */
 enum authn_audit_event {
 	AUTHN_AUDIT_EVENT_OK = 0,
 	AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION,
@@ -52,6 +58,7 @@ enum authn_audit_event {
 	AUTHN_AUDIT_EVENT_OTHER_ERROR,
 };
 
+/* This enum should be kept in sync with authn_audit_info_reason(). */
 enum authn_audit_reason {
 	AUTHN_AUDIT_REASON_NONE = 0,
 	AUTHN_AUDIT_REASON_DESCRIPTOR_INVALID,
@@ -61,9 +68,29 @@ enum authn_audit_reason {
 	AUTHN_AUDIT_REASON_FAST_REQUIRED,
 };
 
+enum auth_event_id_type authn_audit_info_event_id(const struct authn_audit_info *audit_info);
+
+const char *authn_audit_info_silo_name(const struct authn_audit_info *audit_info);
+
+const char *authn_audit_info_policy_name(const struct authn_audit_info *audit_info);
+
+const bool *authn_audit_info_policy_enforced(const struct authn_audit_info *audit_info);
+
+const struct auth_user_info_dc *authn_audit_info_client_info(const struct authn_audit_info *audit_info);
+
+const char *authn_audit_info_event(const struct authn_audit_info *audit_info);
+
+const char *authn_audit_info_reason(const struct authn_audit_info *audit_info);
+
+NTSTATUS authn_audit_info_policy_status(const struct authn_audit_info *audit_info);
+
+const char *authn_audit_info_location(const struct authn_audit_info *audit_info);
+
 struct authn_int64_optional {
 	bool is_present;
 	int64_t val;
 };
 
+struct authn_int64_optional authn_audit_info_policy_tgt_lifetime_mins(const struct authn_audit_info *audit_info);
+
 #endif