feat(admin_audit): write admin audit log for login failed

Signed-off-by: Luka Trovic <luka@nextcloud.com>

Author: luka-nextcloud

apps/admin_audit/lib/Actions/Auth.php

@@ -42,4 +42,15 @@ public function logout(array $params): void {
 			[]
 		);
 	}
+
+	public function loginFailed(array $params): void {
+		$this->log(
+			'Login failed: "%s"',
+			$params,
+			[
+				'uid',
+			],
+			true
+		);
+	}
 }

apps/admin_audit/lib/AppInfo/Application.php

@@ -145,6 +145,7 @@ private function authHooks(IAuditLogger $logger): void {
 		Util::connectHook('OC_User', 'pre_login', $authActions, 'loginAttempt');
 		Util::connectHook('OC_User', 'post_login', $authActions, 'loginSuccessful');
 		Util::connectHook('OC_User', 'logout', $authActions, 'logout');
+		Util::connectHook('OC_User', 'login_failed', $authActions, 'loginFailed');
 	}
 
 	private function appHooks(IAuditLogger $logger,

lib/private/Authentication/Listeners/LoginFailedListener.php

@@ -40,6 +40,7 @@ public function handle(Event $event): void {
 		$this->dispatcher->dispatchTyped(new AnyLoginFailedEvent($event->getLoginName(), $event->getPassword()));
 
 		$uid = $event->getLoginName();
+		\OC_Hook::emit('OC_User', 'login_failed', ['run' => true, 'uid' => $uid]);
 		Util::emitHook(
 			'\OCA\Files_Sharing\API\Server2Server',
 			'preLoginNameUsedAsUserName',