*-login: Log more precise reasons for some auth failures.

--HG--
branch : HEAD

diff --git a/src/login-common/client-common.c b/src/login-common/client-common.c
index bfc04386e6fe9bea8d6b856956916cea34e4b40f..80ed789201522154b723cdf524fbb7f57c4e3435 100644 (file)
--- a/src/login-common/client-common.c
+++ b/src/login-common/client-common.c
@@ -521,6 +521,12 @@ const char *client_get_extra_disconnect_reason(struct client *client)
                return "(tried to use disabled plaintext auth)";
        if (client->set->ssl_require_client_cert)
                return "(cert required, client didn't start TLS)";
+       if (client->auth_tried_unsupported_mech)
+               return "(tried to use unsupported auth mechanism)";
+       if (client->auth_request != NULL && client->auth_attempts == 1)
+               return "(disconnected while authenticating)";
+       if (client->auth_try_aborted && client->auth_attempts == 1)
+               return "(aborted authentication)";
 
        return t_strdup_printf("(auth failed, %u attempts)",
                               client->auth_attempts);

diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h
index 0eedca2ffdc2ac7cc98c362e511e8324ab7963c8..22fe9fbfc7ea5a2b601729f017d4c90caef84ddd 100644 (file)
--- a/src/login-common/client-common.h
+++ b/src/login-common/client-common.h
@@ -117,6 +117,8 @@ struct client {
        unsigned int trusted:1;
        unsigned int authenticating:1;
        unsigned int auth_tried_disabled_plaintext:1;
+       unsigned int auth_tried_unsupported_mech:1;
+       unsigned int auth_try_aborted:1;
        unsigned int auth_initializing:1;
        /* ... */
 };

diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-server.c
index 460ee6913c4c33472fcefb022c47de4dbe4c0a8b..92b3c0e3d582d7f8c994a3b207a3a344c3cd6885 100644 (file)
--- a/src/login-common/sasl-server.c
+++ b/src/login-common/sasl-server.c
@@ -247,6 +247,7 @@ void sasl_server_auth_begin(struct client *client,
 
        mech = auth_client_find_mech(auth_client, mech_name);
        if (mech == NULL) {
+               client->auth_tried_unsupported_mech = TRUE;
                sasl_server_auth_failed(client,
                        "Unsupported authentication mechanism.");
                return;
@@ -254,6 +255,7 @@ void sasl_server_auth_begin(struct client *client,
 
        if (!client->secured && client->set->disable_plaintext_auth &&
            (mech->flags & MECH_SEC_PLAINTEXT) != 0) {
+               client->auth_tried_disabled_plaintext = TRUE;
                sasl_server_auth_failed(client,
                        "Plaintext authentication disabled.");
                return;
@@ -308,5 +310,6 @@ void sasl_server_auth_failed(struct client *client, const char *reason)
 
 void sasl_server_auth_abort(struct client *client)
 {
+       client->auth_try_aborted = TRUE;
        sasl_server_auth_cancel(client, NULL, SASL_SERVER_REPLY_AUTH_ABORTED);
 }