Add support for delegated Kerberos tickets during Negotiate authentication.

net/http/http_auth_gssapi_posix.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_gssapi_posix.h"
 
 #include <limits>
 #include <string>
 
 #include "base/base64.h"
@@ skipping 659 matching lines @@
     security_context_ = GSS_C_NO_CONTEXT;
   }
 }
 
 HttpAuthGSSAPI::HttpAuthGSSAPI(GSSAPILibrary* library,
                                const std::string& scheme,
                                gss_OID gss_oid)
     : scheme_(scheme),
       gss_oid_(gss_oid),
       library_(library),
-      scoped_sec_context_(library) {
+      scoped_sec_context_(library),
+      can_delegate_(false) {
   DCHECK(library_);
 }
 
 HttpAuthGSSAPI::~HttpAuthGSSAPI() {
 }
 
 bool HttpAuthGSSAPI::Init() {
   if (!library_)
     return false;
   return library_->Init();
 }
 
 bool HttpAuthGSSAPI::NeedsIdentity() const {
   return decoded_server_auth_token_.empty();
 }
 
 bool HttpAuthGSSAPI::IsFinalRound() const {
   return !NeedsIdentity();
 }
 
+void HttpAuthGSSAPI::Delegate() {
+  can_delegate_ = true;
+}
+
 bool HttpAuthGSSAPI::ParseChallenge(HttpAuth::ChallengeTokenizer* tok) {
   // Verify the challenge's auth-scheme.
   if (!tok->valid() ||
       !LowerCaseEqualsASCII(tok->scheme(), StringToLowerASCII(scheme_).c_str()))
     return false;
 
   tok->set_expect_base64_token(true);
   if (!tok->GetNext()) {
     decoded_server_auth_token_.clear();
     return true;
@@ skipping 81 matching lines @@
                << std::endl
                << DisplayExtendedStatus(library_,
                                         major_status,
                                         minor_status);
     return ERR_UNEXPECTED;
   }
   ScopedName scoped_name(principal_name, library_);
 
   // Continue creating a security context.
   OM_uint32 req_flags = 0;
+  if (can_delegate_)
+    req_flags |= GSS_C_DELEG_FLAG;
   major_status = library_->init_sec_context(
       &minor_status,
       GSS_C_NO_CREDENTIAL,
       scoped_sec_context_.receive(),
       principal_name,
       gss_oid_,
       req_flags,
       GSS_C_INDEFINITE,
       GSS_C_NO_CHANNEL_BINDINGS,
       in_token,
@@ skipping 10 matching lines @@
                                         minor_status)
                << std::endl
                << DescribeContext(library_, scoped_sec_context_.get());
     return ERR_MISSING_AUTH_CREDENTIALS;
   }
 
   return OK;
 }
 
 }  // namespace net