' ########################################################################################
' Microsoft Windows
' File: authz.inc
' Contents: Authorization framework APIs
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
#IF NOT %DEF(PBX_AuthZ_PBI)
#DEFINE PBX_AuthZ_PBI
%EQUATE `AUTHZ_INC = 1
#INCLUDE ONCE "Core/Windows.inc"
#INCLUDE ONCE "Legacy/System/AdtGen.inc"
'//
'// Flags which may be used at the time of client context creation using a sid.
'//
%EQUATE `AUTHZ_SKIP_TOKEN_GROUPS = &H2
%EQUATE `AUTHZ_REQUIRE_S4U_LOGON = &H4
%EQUATE `AUTHZ_COMPUTE_PRIVILEGES = &H8
'DECLARE_HANDLE(AUTHZ_ACCESS_CHECK_RESULTS_HANDLE);
'DECLARE_HANDLE(AUTHZ_CLIENT_CONTEXT_HANDLE);
'DECLARE_HANDLE(AUTHZ_RESOURCE_MANAGER_HANDLE);
'DECLARE_HANDLE(AUTHZ_AUDIT_EVENT_HANDLE);
'DECLARE_HANDLE(AUTHZ_AUDIT_EVENT_TYPE_HANDLE);
'DECLARE_HANDLE(AUTHZ_SECURITY_EVENT_PROVIDER_HANDLE);
'typedef AUTHZ_ACCESS_CHECK_RESULTS_HANDLE *PAUTHZ_ACCESS_CHECK_RESULTS_HANDLE;
'typedef AUTHZ_CLIENT_CONTEXT_HANDLE *PAUTHZ_CLIENT_CONTEXT_HANDLE;
'typedef AUTHZ_RESOURCE_MANAGER_HANDLE *PAUTHZ_RESOURCE_MANAGER_HANDLE;
'typedef AUTHZ_AUDIT_EVENT_HANDLE *PAUTHZ_AUDIT_EVENT_HANDLE;
'typedef AUTHZ_AUDIT_EVENT_TYPE_HANDLE *PAUTHZ_AUDIT_EVENT_TYPE_HANDLE;
'typedef AUTHZ_SECURITY_EVENT_PROVIDER_HANDLE *PAUTHZ_SECURITY_EVENT_PROVIDER_HANDLE;
'//
'// Structure defining the access check request.
'//
' // Size = 20 bytes
TYPE AUTHZ_ACCESS_REQUEST DWORD
 DesiredAccess AS ACCESS_MASK ' ACCESS_MASK
 PrincipalSelfSid AS SID PTR
 ObjectTypeList AS OBJECT_TYPE_LIST PTR ' POBJECT_TYPE_LIST
 ObjectTypeListLength AS DWORD
 OptionalArguments AS DWORD
END TYPE
'//
'// Structure to return the results of the access check call.
'//
%EQUATE `AUTHZ_GENERATE_SUCCESS_AUDIT = &H1
%EQUATE `AUTHZ_GENERATE_FAILURE_AUDIT = &H2
' // Size = 16 bytes
TYPE AUTHZ_ACCESS_REPLY DWORD
 ResultListLength AS DWORD
 GrantedAccessMask AS ACCESS_MASK PTR ' PACCESS_MASK
 SaclEvaluationResults AS DWORD PTR ' PDWORD OPTIONAL
 Error AS DWORD PTR
END TYPE
'//
'// Typedefs for callback functions to be provided by the resource manager.
'//
'//
'// Callback access check function takes in
'// AuthzClientContext - a client context
'// pAce - pointer to a callback ace
'// pArgs - Optional arguments that were passed to AuthzAccessCheck thru
'// AuthzAccessRequest->OptionalArguments are passed back here.
'// pbAceApplicable - The resource manager must supply whether the ace should
'// be used in the computation of access evaluation
'//
'// Returns
'// TRUE if the API succeeded.
'// FALSE on any intermediate errors (like failed memory allocation)
'// In case of failure, the caller must use SetLastError(ErrorValue).
'//
'typedef BOOL (CALLBACK *PFN_AUTHZ_DYNAMIC_ACCESS_CHECK) (
' IN AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClientContext,
' IN PACE_HEADER pAce,
' IN PVOID pArgs OPTIONAL,
' IN OUT PBOOL pbAceApplicable
' );
'FUNCTION FN_AUTHZ_DYNAMIC_ACCESS_CHECK ( ' BYVAL DWORD ' IN AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClientContext
' , BYVAL DWORD ' IN PACE_HEADER pAce
' , BYVAL DWORD ' IN PVOID pArgs OPTIONAL
' , BYREF LONG ' IN OUT PBOOL pbAceApplicable
' ) AS LONG
'//
'// Callback compute dynamic groups function takes in
'// AuthzClientContext - a client context
'// pArgs - Optional arguments that supplied to AuthzInitializeClientContext*
'// thru DynamicGroupArgs are passed back here..
'// pSidAttrArray - To allocate and return an array of (sids, attribute)
'// pairs to be added to the normal part of the client context.
'// pSidCount - Number of elements in pSidAttrArray
'// pRestrictedSidAttrArray - To allocate and return an array of (sids, attribute)
'// pairs to be added to the restricted part of the client context.
'// pRestrictedSidCount - Number of elements in pRestrictedSidAttrArray
'//
'// Note:
'// Memory returned thru both these array will be freed by the callback
'// free function defined by the resource manager.
'//
'// Returns
'// TRUE if the API succeeded.
'// FALSE on any intermediate errors (like failed memory allocation)
'// In case of failure, the caller must use SetLastError(ErrorValue).
'//
'typedef BOOL (CALLBACK *PFN_AUTHZ_COMPUTE_DYNAMIC_GROUPS) (
' IN AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClientContext,
' IN PVOID Args,
' OUT PSID_AND_ATTRIBUTES *pSidAttrArray,
' OUT PDWORD pSidCount,
' OUT PSID_AND_ATTRIBUTES *pRestrictedSidAttrArray,
' OUT PDWORD pRestrictedSidCount
' );
'FUNCTION FN_AUTHZ_COMPUTE_DYNAMIC_GROUPS ( ' BYVAL DWORD ' IN AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClientContext
' , BYVAL DWORD ' IN PVOID Args
' , BYREF SID_AND_ATTRIBUTES ' OUT PSID_AND_ATTRIBUTES *pSidAttrArray
' , BYREF DWORD ' OUT PDWORD pSidCount
' , BYREF SID_AND_ATTRIBUTES ' OUT PSID_AND_ATTRIBUTES *pRestrictedSidAttrArray
' , BYREF DWORD ' OUT PDWORD pRestrictedSidCount
' ) AS LONG
'//
'// Callback free function takes in
'// pSidAttrArray - To be freed. This has been allocated by the compute
'// dynamic groups function.
'//
'typedef VOID (CALLBACK *PFN_AUTHZ_FREE_DYNAMIC_GROUPS) (
' IN PSID_AND_ATTRIBUTES pSidAttrArray
' );
'SUB FN_AUTHZ_FREE_DYNAMIC_GROUPS ( ' BYREF SID_AND_ATTRIBUTES ' IN PSID_AND_ATTRIBUTES pSidAttrArray
' )
'//
'// BEGIN: *** (Subject) Security attributes ***
'//
'// WARNING!!!:
'// These #defines and data structures exactly mirror
'// the TOKEN_XXX definitions in ntseapi.w. Keep them
'// in sync.
'//
'//
'// Security attribute data types ...
'//
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_TYPE_INVALID = &H00
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_TYPE_INT64 = &H01
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_TYPE_UINT64 = &H02
'//
'// Case insensitive attribute value string by default.
'// Unless the flag AUTHZ_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE
'// is set indicating otherwise.
'//
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_TYPE_STRING = &H03
'//
'// Fully-qualified binary name.
'//
' // Size = 16 bytes - must be 8 bytes aligned
TYPE AUTHZ_SECURITY_ATTRIBUTE_FQBN_VALUE QWORD
 Version AS QUAD ' ULONG64
 pName AS WSTRINGZ PTR
END TYPE
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_TYPE_FQBN = &H04
'//
'// This is the 'catch all' type. The attribute manipulation
'// code really doesn't care about the actual format of the
'// value. Value subtypes are defined only for this type.
'// Value subtypes permit easy addition of new subtypes
'// without having to change the attribute manipulation
'// (and WOW64 thunking!) code.
'//
' // Size = 8 bytes
TYPE AUTHZ_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE DWORD
 pValue AS DWORD ' PVOID // Pointer is BYTE aligned.
 ValueLength AS DWORD ' ULONG // In bytes
END TYPE
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING = &H10
'//
'// Attribute operations that can be specified for a 'set' API:
'//
'typedef enum {
' //
' // No-op
' //
' AUTHZ_SECURITY_ATTRIBUTE_OPERATION_NONE = 0,
' //
' // Delete all existing security attributes and their values in
' // the NT token and replace it with the specified attributes/values.
' // If attributes to replace with are not specified, all existing
' // attributes and values are deleted.
' //
' // This operation can be specified at most once and must be the
' // only operation specified.
' //
' AUTHZ_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL,
' //
' // Add a new attribute or a new value to an existing attribute.
' // If the value specified for any attribute already exists for
' // that attribute, the call fails.
' //
' AUTHZ_SECURITY_ATTRIBUTE_OPERATION_ADD,
' //
' // Delete the specified value(s) of the specified attribute(s).
' // If the last value is deleted from an attribute, the attribute
' // itself is removed. If no matching attribute name was found, no
' // modifications are done and the call fails. If no value is specified
' // for the attribute, the attribute itself will be deleted.
' //
' AUTHZ_SECURITY_ATTRIBUTE_OPERATION_DELETE,
' //
' // The value(s) of the specified security attribute(s) completely
' // replace(s) the existing value(s) of the attribute(s). If the
' // attribute does not already exist, it is added. When no value
' // is specified, the attribute is deleted, if it exists; otherwise,
' // the operation is simply ignored and no failure is reported.
' //
' AUTHZ_SECURITY_ATTRIBUTE_OPERATION_REPLACE
'} AUTHZ_SECURITY_ATTRIBUTE_OPERATION, *PAUTHZ_SECURITY_ATTRIBUTE_OPERATION;
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_OPERATION_NONE = 0
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL = 1
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_OPERATION_ADD = 2
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_OPERATION_DELETE = 3
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_OPERATION_REPLACE = 4
'//
'// An individual security attribute.
'//
'typedef struct _AUTHZ_SECURITY_ATTRIBUTE_V1 {
' //
' // Name of the attribute.
' // Case insensitive Windows Unicode string.
' //
' PWSTR pName;
' //
' // Data type of attribute.
' //
' USHORT ValueType;
' //
' // Pass 0 in a set operation and check for 0 in
' // a get operation.
' //
' USHORT Reserved;
'//
'// Attribute must not be inherited across process spawns.
'//
'#define AUTHZ_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001
'//
'// Attribute value is compared in a case sensitive way. It is valid with string value
'// or composite type containing string value. For other types of value, this flag
'// will be ignored. Currently, it is valid with the two types:
'// AUTHZ_SECURITY_ATTRIBUTE_TYPE_STRING and AUTHZ_SECURITY_ATTRIBUTE_TYPE_FQBN.
'//
'#define AUTHZ_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE 0x0002
'#define AUTHZ_SECURITY_ATTRIBUTE_VALID_FLAGS ( \
' AUTHZ_SECURITY_ATTRIBUTE_NON_INHERITABLE | \
' AUTHZ_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE \
' )
' ULONG Flags;
' //
' // Number of values.
' //
' ULONG ValueCount;
' //
' // The actual value itself.
' //
' union {
' PLONG64 pInt64;
' PULONG64 pUint64;
' PWSTR *ppString;
' PAUTHZ_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
' PAUTHZ_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
' } Values;
'} AUTHZ_SECURITY_ATTRIBUTE_V1, *PAUTHZ_SECURITY_ATTRIBUTE_V1;
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_NON_INHERITABLE = &H0001
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE = &H0002
%EQUATE `AUTHZ_SECURITY_ATTRIBUTE_VALID_FLAGS = %AUTHZ_SECURITY_ATTRIBUTE_NON_INHERITABLE OR %AUTHZ_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE
' // Size = 4 bytes
UNION AUTHZ_SECURITY_ATTRIBUTE_V1_Values DWORD
 pInt64 AS QUAD PTR ' PLONG64
 pUint64 AS QUAD PTR ' PULONG64
 ppString AS WSTRINGZ PTR ' PWSTR*
 pFqbn AS AUTHZ_SECURITY_ATTRIBUTE_FQBN_VALUE PTR ' PAUTHZ_SECURITY_ATTRIBUTE_FQBN_VALUE
 pOctetString AS AUTHZ_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE PTR ' PAUTHZ_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
END UNION
' // Size = 20 bytes
TYPE AUTHZ_SECURITY_ATTRIBUTE_V1 DWORD FILL
 pName AS WSTRINGZ PTR
 ValueType AS WORD ' USHORT
 Reserved AS WORD ' USHORT
 Flags AS DWORD ' ULONG
 ValueCount AS DWORD ' ULONG
 Values AS AUTHZ_SECURITY_ATTRIBUTE_V1_Values
END TYPE
'//
'// Set of security attributes.
'//
'typedef struct _AUTHZ_SECURITY_ATTRIBUTES_INFORMATION {
' //
' // Versioning. The interpretation of the pointers in the
' // Attribute field below is dependent on the version field.
' //
' // Get operations return the version while the set operation
' // MUST specify the version of the data structure passed in.
' //
'#define AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1 1
'#define AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_VERSION \
' AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1
' //
' // MUST BE first.
' //
' USHORT Version;
' //
' // Pass 0 in set operations and ignore on get operations.
' //
' USHORT Reserved;
' ULONG AttributeCount;
' union {
' PAUTHZ_SECURITY_ATTRIBUTE_V1 pAttributeV1;
' } Attribute;
'} AUTHZ_SECURITY_ATTRIBUTES_INFORMATION,
' *PAUTHZ_SECURITY_ATTRIBUTES_INFORMATION;
%EQUATE `AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1 = 1
%EQUATE `AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_VERSION = %AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1
' // Size = 4 bytes
UNION AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_Attribute DWORD
 pAttributeV1 AS AUTHZ_SECURITY_ATTRIBUTE_V1 PTR
END UNION
' // Size = 12 bytes
TYPE AUTHZ_SECURITY_ATTRIBUTES_INFORMATION DWORD FILL
 Version AS WORD ' USHORT
 Reserved AS WORD ' USHORT
 AttributeCount AS DWORD ' ULONG
 Attribute AS AUTHZ_SECURITY_ATTRIBUTES_INFORMATION_Attribute
END TYPE
'//
'// Valid flags for AuthzAccessCheck
'//
%EQUATE `AUTHZ_ACCESS_CHECK_NO_DEEP_COPY_SD = &H00000001
DECLARE FUNCTION AuthzAccessCheck LIB "authz.dll" ALIAS "AuthzAccessCheck" ( BYVAL Flags AS QUAD , BYVAL hAuthzClientContext AS QUAD , BYREF AUTHZ_ACCESS_REQUEST , BYVAL pRequest AS QUAD , BYREF pSecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF OptionalSecurityDescriptorArray AS SECURITY_DESCRIPTOR , BYVAL OptionalSecurityDescriptorCount AS QUAD , BYREF pReply AS AUTHZ_ACCESS_REPLY , BYREF phAccessCheckResults AS QUAD ) AS LONG
DECLARE FUNCTION AuthzCachedAccessCheck LIB "authz.dll" ALIAS "AuthzCachedAccessCheck" ( BYVAL Flags AS QUAD
 , BYVAL hAccessCheckResults AS DWORD
 , BYREF pRequest AS AUTHZ_ACCESS_REQUEST
 , BYVAL hAuditEvent AS DWORD
 , BYREF hAuditEvent AS AUTHZ_ACCESS_REPLY
 ) AS LONG
DECLARE FUNCTION AuthzOpenObjectAudit LIB "authz.dll" ALIAS "AuthzOpenObjectAudit" ( BYVAL Flags AS DWORD
 , BYVAL hAuthzClientContext AS DWORD
 , BYREF pRequest AS AUTHZ_ACCESS_REQUEST
 , BYVAL pRequest AS DWORD
 , BYREF pSecurityDescriptor AS SECURITY_DESCRIPTOR
 , BYREF OptionalSecurityDescriptorArray AS SECURITY_DESCRIPTOR
 , BYVAL OptionalSecurityDescriptorCount AS DWORD
 , BYREF pReply AS AUTHZ_ACCESS_REPLY
 ) AS LONG
DECLARE FUNCTION AuthzFreeHandle LIB "authz.dll" ALIAS "AuthzFreeHandle" ( BYVAL hAccessCheckResults AS DWORD
 ) AS LONG
'//
'// Flags for AuthzInitializeResourceManager
'//
%EQUATE `AUTHZ_RM_FLAG_NO_AUDIT = &H1
%EQUATE `AUTHZ_RM_FLAG_INITIALIZE_UNDER_IMPERSONATION = &H2
%EQUATE `AUTHZ_VALID_RM_INIT_FLAGS = %AUTHZ_RM_FLAG_NO_AUDIT OR %AUTHZ_RM_FLAG_INITIALIZE_UNDER_IMPERSONATION
DECLARE FUNCTION AuthzInitializeResourceManager LIB "authz.dll" ALIAS "AuthzInitializeResourceManager" ( BYVAL Flags AS QUAD , BYVAL pfnDynamicAccessCheck AS QUAD , BYVAL pfnComputeDynamicGroups AS QUAD , BYVAL pfnFreeDynamicGroups AS QUAD , BYREF szResourceManagerName AS WSTRINGZ , BYREF phAuthzResourceManager AS QUAD ) AS LONG
DECLARE FUNCTION AuthzFreeResourceManager LIB "authz.dll" ALIAS "AuthzFreeResourceManager" ( BYVAL hAuthzResourceManager AS QUAD
 ) AS LONG
DECLARE FUNCTION AuthzInitializeContextFromToken LIB "authz.dll" ALIAS "AuthzInitializeContextFromToken" ( BYVAL Flags AS DWORD
 , BYVAL TokenHandle AS DWORD
 , BYVAL hAuthzResourceManager AS DWORD
 , BYREF pExpirationTime AS ANY
 , BYVAL Identifier AS QUAD
 , BYVAL DynamicGroupArgs AS DWORD
 , BYREF phAuthzClientContext AS DWORD
 ) AS LONG
DECLARE FUNCTION AuthzInitializeContextFromSid LIB "authz.dll" ALIAS "AuthzInitializeContextFromSid" ( BYVAL Flags AS DWORD
 , BYVAL UserSid AS SID PTR
 , BYVAL hAuthzResourceManager AS DWORD
 , BYREF pExpirationTime AS ANY
 , BYVAL Identifier AS QUAD
 , BYVAL DynamicGroupArgs AS DWORD
 , BYREF phAuthzClientContext AS DWORD
 ) AS LONG
DECLARE FUNCTION AuthzInitializeContextFromAuthzContext LIB "authz.dll" ALIAS "AuthzInitializeContextFromAuthzContext" ( BYVAL Flags AS DWORD
 , BYVAL hAuthzClientContext AS DWORD
 , BYREF pExpirationTime AS ANY
 , BYVAL Identifier AS QUAD
 , BYVAL DynamicGroupArgs AS DWORD
 , BYREF phNewAuthzClientContext AS DWORD
 ) AS LONG
DECLARE FUNCTION AuthzAddSidsToContext LIB "authz.dll" ALIAS "AuthzAddSidsToContext" ( BYVAL hAuthzClientContext AS DWORD
 , BYREF Sids AS SID_AND_ATTRIBUTES
 , BYVAL SidCount AS DWORD
 , BYREF RestrictedSids AS SID_AND_ATTRIBUTES
 , BYVAL RestrictedSidCount AS DWORD
 , BYREF phNewAuthzClientContext AS DWORD
 ) AS LONG
'//
'// API to modify security attributes in AUTHZ client context.
'//
DECLARE FUNCTION AuthzModifySecurityAttributes LIB "authz.dll" ALIAS "AuthzModifySecurityAttributes" ( BYVAL hAuthzClientContext AS QUAD , BYVAL pOperations AS LONG , BYREF pAttributes AS AUTHZ_SECURITY_ATTRIBUTES_INFORMATION ) AS LONG
'//
'// Enumeration type to be used to specify the type of information to be
'// retrieved from an existing AuthzClientContext.
'//
' enum AUTHZ_CONTEXT_INFORMATION_CLASS
MACRO AUTHZ_CONTEXT_INFORMATION_CLASS_ENUM = LONG
%EQUATE `AuthzContextInfoUserSid = 1
%EQUATE `AuthzContextInfoGroupsSids = 2
%EQUATE `AuthzContextInfoRestrictedSids = 3
%EQUATE `AuthzContextInfoPrivileges = 4
%EQUATE `AuthzContextInfoExpirationTime = 5
%EQUATE `AuthzContextInfoServerContext = 6
%EQUATE `AuthzContextInfoIdentifier = 7
%EQUATE `AuthzContextInfoSource = 8
%EQUATE `AuthzContextInfoAll = 9
%EQUATE `AuthzContextInfoAuthenticationId = 10
%EQUATE `AuthzContextInfoSecurityAttributes = 11
DECLARE FUNCTION AuthzGetInformationFromContext LIB "authz.dll" ALIAS "AuthzGetInformationFromContext" ( BYVAL hAuthzClientContext AS QUAD , BYVAL InfoClass AS AUTHZ_CONTEXT_INFORMATION_CLASS_ENUM , BYVAL BufferSize AS QUAD , BYREF pSizeRequired AS QUAD , BYREF Buffer AS ANY ) AS LONG
DECLARE FUNCTION AuthzFreeContext LIB "authz.dll" ALIAS "AuthzFreeContext" ( BYVAL hAuthzClientContext AS QUAD
 ) AS LONG
'//
'// Valid flags that may be used in AuthzInitializeObjectAccessAuditEvent().
'//
%EQUATE `AUTHZ_NO_SUCCESS_AUDIT = &H00000001
%EQUATE `AUTHZ_NO_FAILURE_AUDIT = &H00000002
%EQUATE `AUTHZ_NO_ALLOC_STRINGS = &H00000004
%EQUATE `AUTHZ_VALID_OBJECT_ACCESS_AUDIT_FLAGS = %AUTHZ_NO_SUCCESS_AUDIT OR %AUTHZ_NO_FAILURE_AUDIT OR %AUTHZ_NO_ALLOC_STRINGS
'AUTHZAPI
'WINAPI
'AuthzInitializeObjectAccessAuditEvent(
' IN DWORD Flags,
' IN AUTHZ_AUDIT_EVENT_TYPE_HANDLE hAuditEventType,
' OUT PAUTHZ_AUDIT_EVENT_HANDLE phAuditEvent,
' IN DWORD dwAdditionalParameterCount,
' ...
' );
DECLARE FUNCTION AuthzInitializeObjectAccessAuditEvent CDECL LIB "authz.dll" ALIAS "AuthzInitializeObjectAccessAuditEvent" ( BYVAL Flags AS QUAD , BYVAL hAuditEventType AS QUAD , BYREF szOperationType AS WSTRINGZ , BYREF szObjectType AS WSTRINGZ , BYREF szObjectName AS WSTRINGZ , BYREF szAdditionalInfo AS WSTRINGZ , BYREF phAuditEvent AS QUAD , BYVAL dwAdditionalParameterCount AS QUAD ) AS LONG
'AUTHZAPI
'WINAPI
'AuthzInitializeObjectAccessAuditEvent2(
' IN DWORD Flags,
' IN AUTHZ_AUDIT_EVENT_TYPE_HANDLE hAuditEventType,
' OUT PAUTHZ_AUDIT_EVENT_HANDLE phAuditEvent,
' IN DWORD dwAdditionalParameterCount,
' ...
' );
DECLARE FUNCTION AuthzInitializeObjectAccessAuditEvent2 CDECL LIB "authz.dll" ALIAS "AuthzInitializeObjectAccessAuditEvent2" ( BYVAL Flags AS QUAD , BYVAL hAuditEventType AS QUAD , BYREF szOperationType AS WSTRINGZ , BYREF szObjectType AS WSTRINGZ , BYREF szObjectName AS WSTRINGZ , BYREF szAdditionalInfo AS WSTRINGZ , BYREF szAdditionalInfo2 AS WSTRINGZ , BYREF phAuditEvent AS QUAD , BYVAL dwAdditionalParameterCount AS QUAD ) AS LONG
'//
'// Enumeration type to be used to specify the type of information to be
'// retrieved from an existing AUTHZ_AUDIT_EVENT_HANDLE.
'//
' enum AUTHZ_AUDIT_EVENT_INFORMATION_CLASS
%EQUATE `AuthzAuditEventInfoFlags = 1
%EQUATE `AuthzAuditEventInfoOperationType = 2
%EQUATE `AuthzAuditEventInfoObjectType = 3
%EQUATE `AuthzAuditEventInfoObjectName = 4
%EQUATE `AuthzAuditEventInfoAdditionalInfo = 5
' Removed in the Windows 7 SDK
'DECLARE FUNCTION AuthzGetInformationFromAuditEvent LIB "authz.dll" ALIAS "AuthzGetInformationFromAuditEvent" ( ' BYVAL hAuditEvent AS DWORD
' , BYVAL InfoClass AS DWORD
' , BYVAL BufferSize AS DWORD
' , BYREF pSizeRequired AS DWORD
' , BYREF Buffer AS ANY
' ) AS LONG
DECLARE FUNCTION AuthzFreeAuditEvent LIB "authz.dll" ALIAS "AuthzFreeAuditEvent" ( BYVAL hAuditEvent AS DWORD
 ) AS LONG
'//
'// Support for SACL evaluation
'//
DECLARE FUNCTION AuthzEvaluateSacl LIB "authz.dll" ALIAS "AuthzEvaluateSacl" ( BYVAL AuthzClientContext AS QUAD , BYREF pRequest AS AUTHZ_ACCESS_REQUEST , BYREF Sacl AS ACL , BYVAL GrantedAccess AS ACCESS_MASK , BYVAL AccessGranted AS LONG , BYREF pbGenerateAudit AS LONG ) AS LONG
'//
'// Support for generic auditing.
'//
' // Size = 8 bytes
TYPE AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET DWORD
 szObjectTypeName AS WSTRINGZ PTR
 dwOffset AS DWORD
END TYPE
UNION AUTHZ_SOURCE_SCHEMA_REGISTRATION_UNION DWORD
 pReserved AS DWORD
 pProviderGuid AS GUID PTR ' GUID*
END UNION
' // Size = 40 bytes
TYPE AUTHZ_SOURCE_SCHEMA_REGISTRATION DWORD
 dwFlags AS DWORD
 szEventSourceName AS WSTRINGZ PTR
 szEventMessageFile AS WSTRINGZ PTR
 szEventSourceXmlSchemaFile AS WSTRINGZ PTR
 szEventAccessStringsFile AS WSTRINGZ PTR
 szExecutableImagePath AS WSTRINGZ PTR
 AUTHZ_SOURCE_SCHEMA_REGISTRATION_UNION
 dwObjectTypeNameCount AS DWORD
 ObjectTypeNames(0) AS AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
END TYPE
%EQUATE `AUTHZ_FLAG_ALLOW_MULTIPLE_SOURCE_INSTANCES = &H1
DECLARE FUNCTION AuthzInstallSecurityEventSource LIB "authz.dll" ALIAS "AuthzInstallSecurityEventSource" ( BYVAL dwFlags AS QUAD , BYREF pRegistration AS AUTHZ_SOURCE_SCHEMA_REGISTRATION ) AS LONG
DECLARE FUNCTION AuthzUninstallSecurityEventSource LIB "authz.dll" ALIAS "AuthzUninstallSecurityEventSource" ( BYVAL dwFlags AS QUAD
 , BYREF szEventSourceName AS WSTRINGZ
 ) AS LONG
DECLARE FUNCTION AuthzEnumerateSecurityEventSources LIB "authz.dll" ALIAS "AuthzEnumerateSecurityEventSources" ( BYVAL dwFlags AS DWORD
 , BYREF Buffer AS AUTHZ_SOURCE_SCHEMA_REGISTRATION
 , BYREF pdwCount AS DWORD
 , BYREF pdwLength AS DWORD
 ) AS LONG
DECLARE FUNCTION AuthzRegisterSecurityEventSource LIB "authz.dll" ALIAS "AuthzRegisterSecurityEventSource" ( BYVAL dwFlags AS DWORD
 , BYREF szEventSourceName AS WSTRINGZ
 , BYREF phEventProvider AS DWORD
 ) AS LONG
DECLARE FUNCTION AuthzUnregisterSecurityEventSource LIB "authz.dll" ALIAS "AuthzUnregisterSecurityEventSource" ( BYVAL dwFlags AS DWORD
 , BYREF phEventProvider AS DWORD
 ) AS LONG
'AUTHZAPI
'WINAPI
'AuthzReportSecurityEvent(
' IN DWORD dwFlags,
' IN OUT AUTHZ_SECURITY_EVENT_PROVIDER_HANDLE hEventProvider,
' IN DWORD dwAuditId,
' IN PSID pUserSid OPTIONAL,
' IN DWORD dwCount,
' ...
' );
DECLARE FUNCTION AuthzReportSecurityEvent CDECL LIB "authz.dll" ALIAS "AuthzReportSecurityEvent" ( BYVAL dwFlags AS QUAD , BYVAL hEventProvider AS QUAD , BYVAL dwAuditId AS QUAD , BYVAL pUserSid AS SID PTR , BYVAL dwCount AS QUAD , OPTIONAL BYREF ANY ) AS LONG ' A list of AuditParamFlag type/value pairs , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY , OPTIONAL BYREF ANY
DECLARE FUNCTION AuthzReportSecurityEventFromParams LIB "authz.dll" ALIAS "AuthzReportSecurityEventFromParams" ( BYVAL dwFlags AS QUAD
 , BYVAL hEventProvider AS DWORD
 , BYVAL dwAuditId AS DWORD
 , BYVAL pUserSid AS SID PTR
 , BYREF pParams AS AUDIT_PARAMS
 ) AS LONG
#ENDIF
