Add support for delegated Kerberos tickets during Negotiate authentication.

net/http/http_auth_gssapi_posix.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_HTTP_AUTH_GSSAPI_POSIX_H_
 #define NET_HTTP_HTTP_AUTH_GSSAPI_POSIX_H_
 #pragma once
 
 #include <string>
 
@@ skipping 222 matching lines @@
   // |spn| is the Service Principal Name of the server that the token is
   // being generated for.
   // If this is the first round of a multiple round scheme, credentials are
   // obtained using |*username| and |*password|. If |username| and |password|
   // are NULL, the default credentials are used instead.
   int GenerateAuthToken(const string16* username,
                         const string16* password,
                         const std::wstring& spn,
                         std::string* auth_token);
 
+  // Delegation is allowed on the Kerberos ticket. This allows certain servers
+  // to act as the user, such as an IIS server retrieiving data from a
+  // Kerberized MSSQL server.
+  void Delegate();
+
  private:
   int OnFirstRound(const string16* username,
                    const string16* password);
   int GetNextSecurityToken(const std::wstring& spn,
                            gss_buffer_t in_token,
                            gss_buffer_t out_token);
 
   std::string scheme_;
   string16 username_;
   string16 password_;
   gss_OID gss_oid_;
   GSSAPILibrary* library_;
   std::string decoded_server_auth_token_;
   ScopedSecurityContext scoped_sec_context_;
+  bool can_delegate_;
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_AUTH_GSSAPI_POSIX_H_