Don't do Negotiate with GSSAPI if default credentials are not allowed.

net/http/http_auth_handler_negotiate.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_negotiate.h"
 
 #include "base/logging.h"
 #include "net/base/address_family.h"
 #include "net/base/host_resolver.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_auth_filter.h"
 #include "net/http/url_security_manager.h"
 
 namespace net {
 
 HttpAuthHandlerNegotiate::HttpAuthHandlerNegotiate(
+    AuthLibrary* auth_library,
 #if defined(OS_WIN)
-    SSPILibrary* library,
     ULONG max_token_length,
 #endif
-#if defined(OS_POSIX)
-    GSSAPILibrary* library,
-#endif
     URLSecurityManager* url_security_manager,
     HostResolver* resolver,
     bool disable_cname_lookup,
     bool use_port)
 #if defined(OS_WIN)
-    : auth_system_(library, "Negotiate", NEGOSSP_NAME, max_token_length),
-#endif
-#if defined(OS_POSIX)
-    : auth_system_(library, "Negotiate", CHROME_GSS_KRB5_MECH_OID_DESC),
+    : auth_system_(auth_library, "Negotiate", NEGOSSP_NAME, max_token_length),
+#elif defined(OS_POSIX)
+    : auth_system_(auth_library, "Negotiate", CHROME_GSS_KRB5_MECH_OID_DESC),
 #endif
       disable_cname_lookup_(disable_cname_lookup),
       use_port_(use_port),
       ALLOW_THIS_IN_INITIALIZER_LIST(io_callback_(
           this, &HttpAuthHandlerNegotiate::OnIOComplete)),
       resolver_(resolver),
       already_called_(false),
       has_username_and_password_(false),
       user_callback_(NULL),
       auth_token_(NULL),
@@ skipping 35 matching lines @@
 }
 
 // The Negotiate challenge header looks like:
 //   WWW-Authenticate: NEGOTIATE auth-data
 bool HttpAuthHandlerNegotiate::Init(HttpAuth::ChallengeTokenizer* challenge) {
 #if defined(OS_POSIX)
   if (!auth_system_.Init()) {
     LOG(INFO) << "can't initialize GSSAPI library";
     return false;
   }
+  // GSSAPI does not provide a way to enter username/password to
+  // obtain a TGT. If the default credentials are not allowed for
+  // a particular site (based on whitelist), fall back to a
+  // different scheme.
+  if (!AllowsDefaultCredentials())
+    return false;
 #endif
   scheme_ = "negotiate";
   score_ = 4;
   properties_ = ENCRYPTS_IDENTITY | IS_CONNECTION_BASED;
   return auth_system_.ParseChallenge(challenge);
 }
 
 // Require identity on first pass instead of second.
 bool HttpAuthHandlerNegotiate::NeedsIdentity() {
   return auth_system_.NeedsIdentity();
@@ skipping 142 matching lines @@
   callback->Run(rv);
 }
 
 HttpAuthHandlerNegotiate::Factory::Factory()
     : disable_cname_lookup_(false),
       use_port_(false),
 #if defined(OS_WIN)
       max_token_length_(0),
       first_creation_(true),
       is_unsupported_(false),
-      sspi_library_(SSPILibrary::GetDefault()) {
-#endif
-#if defined(OS_POSIX)
-      gssapi_library_(GSSAPILibrary::GetDefault()) {
+      auth_library_(SSPILibrary::GetDefault()) {
+#elif defined(OS_POSIX)
+      auth_library_(GSSAPILibrary::GetDefault()) {
 #endif
 }
 
 HttpAuthHandlerNegotiate::Factory::~Factory() {
 }
 
 void HttpAuthHandlerNegotiate::Factory::set_host_resolver(
     HostResolver* resolver) {
   resolver_ = resolver;
 }
 
 int HttpAuthHandlerNegotiate::Factory::CreateAuthHandler(
     HttpAuth::ChallengeTokenizer* challenge,
     HttpAuth::Target target,
     const GURL& origin,
     CreateReason reason,
     int digest_nonce_count,
     const BoundNetLog& net_log,
     scoped_ptr<HttpAuthHandler>* handler) {
 #if defined(OS_WIN)
   if (is_unsupported_ || reason == CREATE_PREEMPTIVE)
     return ERR_UNSUPPORTED_AUTH_SCHEME;
   if (max_token_length_ == 0) {
-    int rv = DetermineMaxTokenLength(sspi_library_, NEGOSSP_NAME,
+    int rv = DetermineMaxTokenLength(auth_library_, NEGOSSP_NAME,
                                      &max_token_length_);
     if (rv == ERR_UNSUPPORTED_AUTH_SCHEME)
       is_unsupported_ = true;
     if (rv != OK)
       return rv;
   }
   // TODO(cbentzel): Move towards model of parsing in the factory
   //                 method and only constructing when valid.
   scoped_ptr<HttpAuthHandler> tmp_handler(
-      new HttpAuthHandlerNegotiate(sspi_library_, max_token_length_,
+      new HttpAuthHandlerNegotiate(auth_library_, max_token_length_,
                                    url_security_manager(), resolver_,
                                    disable_cname_lookup_, use_port_));
   if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
-#endif
-#if defined(OS_POSIX)
+#elif defined(OS_POSIX)
   // TODO(ahendrickson): Move towards model of parsing in the factory
   //                     method and only constructing when valid.
   scoped_ptr<HttpAuthHandler> tmp_handler(
-      new HttpAuthHandlerNegotiate(gssapi_library_, url_security_manager(),
+      new HttpAuthHandlerNegotiate(auth_library_, url_security_manager(),
                                    resolver_, disable_cname_lookup_,
                                    use_port_));
   if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 #endif
 }
 
 }  // namespace net