Add support for delegated Kerberos tickets during Negotiate authentication.

net/http/http_auth_handler_negotiate.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_negotiate.h"
 
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "net/base/address_family.h"
@@ skipping 72 matching lines @@
     LOG(INFO) << "can't initialize GSSAPI library";
     return false;
   }
   // GSSAPI does not provide a way to enter username/password to
   // obtain a TGT. If the default credentials are not allowed for
   // a particular site (based on whitelist), fall back to a
   // different scheme.
   if (!AllowsDefaultCredentials())
     return false;
 #endif
+  if (CanDelegate())
+    auth_system_.Delegate();
   scheme_ = "negotiate";
   score_ = 4;
   properties_ = ENCRYPTS_IDENTITY | IS_CONNECTION_BASED;
   return auth_system_.ParseChallenge(challenge);
 }
 
 // Require identity on first pass instead of second.
 bool HttpAuthHandlerNegotiate::NeedsIdentity() {
   return auth_system_.NeedsIdentity();
 }
 
 bool HttpAuthHandlerNegotiate::IsFinalRound() {
   return auth_system_.IsFinalRound();
 }
 
 bool HttpAuthHandlerNegotiate::AllowsDefaultCredentials() {
   if (target_ == HttpAuth::AUTH_PROXY)
     return true;
   if (!url_security_manager_)
     return false;
   return url_security_manager_->CanUseDefaultCredentials(origin_);
 }
 
+bool HttpAuthHandlerNegotiate::CanDelegate() const {
+  // TODO(cbentzel): Should delegation be allowed on proxies?
+  if (target_ == HttpAuth::AUTH_PROXY)
+    return false;
+  if (!url_security_manager_)
+    return false;
+  return url_security_manager_->CanDelegate(origin_);
+}
+
 std::wstring HttpAuthHandlerNegotiate::CreateSPN(
     const AddressList& address_list, const GURL& origin) {
   // Kerberos Web Server SPNs are in the form HTTP/<host>:<port> through SSPI,
   // and in the form HTTP@<host>:<port> through GSSAPI
   //   http://msdn.microsoft.com/en-us/library/ms677601%28VS.85%29.aspx
   //
   // However, reality differs from the specification. A good description of
   // the problems can be found here:
   //   http://blog.michelbarneveld.nl/michel/archive/2009/11/14/the-reason-why-kb911149-and-kb908209-are-not-the-soluton.aspx
   //
@@ skipping 183 matching lines @@
                                    resolver_, disable_cname_lookup_,
                                    use_port_));
   if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 #endif
 }
 
 }  // namespace net