auth: auth-policy - Add new variable fail_type

This variables indicates reason why the request has failed:

The values are:

 - internal = Failure was due to dovecot internal processing
 - credentials = Invalid credentials were provided
 - expired = Credentials or user account has expired
 - account = Account is unknown
 - disabled = Account is disabled
 - policy = Failure was due to policy refusal

diff --git a/src/auth/auth-policy.c b/src/auth/auth-policy.c
index 46688b04f0154dc11c9f301c7a48cd82588d91ea..0a7d85a7935e2dfe540d05bb3b517ae961eade50 100644 (file)
--- a/src/auth/auth-policy.c
+++ b/src/auth/auth-policy.c
@@ -2,6 +2,7 @@
 
 #include "lib.h"
 #include "net.h"
+#include "passdb.h"
 #include "str.h"
 #include "istream.h"
 #include "ioloop.h"
@@ -460,12 +461,40 @@ const char *auth_policy_escape_function(const char *string,
        return str_c(tmp);
 }
 
+static
+const char* auth_policy_fail_type(struct auth_request *request)
+{
+       if (request->policy_refusal)
+               return "policy";
+       /* wait until it's finished */
+       if (request->state != AUTH_REQUEST_STATE_FINISHED)
+               return "";
+       switch (request->passdb_result) {
+       case PASSDB_RESULT_OK:
+       case PASSDB_RESULT_NEXT:
+               return "";
+       case PASSDB_RESULT_SCHEME_NOT_AVAILABLE:
+       case PASSDB_RESULT_INTERNAL_FAILURE:
+               return "internal";
+       case PASSDB_RESULT_PASSWORD_MISMATCH:
+               return "credentials";
+       case PASSDB_RESULT_PASS_EXPIRED:
+               return "expired";
+       case PASSDB_RESULT_USER_DISABLED:
+               return "disabled";
+       case PASSDB_RESULT_USER_UNKNOWN:
+               return "account";
+       }
+       i_unreached();
+}
+
+
 static
 const struct var_expand_table *policy_get_var_expand_table(struct auth_request *auth_request,
        const char *hashed_password, const char *requested_username)
 {
        struct var_expand_table *table;
-       unsigned int count = 2;
+       unsigned int count = 3;
 
        table = auth_request_get_var_expand_table_full(auth_request,
                auth_request->fields.user, auth_policy_escape_function, &count);
@@ -475,6 +504,9 @@ const struct var_expand_table *policy_get_var_expand_table(struct auth_request *
        table[1].key = '\0';
        table[1].long_key = "requested_username";
        table[1].value = requested_username;
+       table[2].key = '\0';
+       table[2].long_key = "fail_type";
+       table[2].value = auth_policy_fail_type(auth_request);
        if (table[0].value != NULL)
                table[0].value = auth_policy_escape_function(table[0].value, auth_request);
        if (table[1].value != NULL)