Add support for delegated Kerberos tickets during Negotiate authentication.

net/http/http_auth_sspi_win.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See "SSPI Sample Application" at
 // http://msdn.microsoft.com/en-us/library/aa918273.aspx
 
 #include "net/http/http_auth_sspi_win.h"
 
 #include "base/base64.h"
@@ skipping 90 matching lines @@
 
 }  // anonymous namespace
 
 HttpAuthSSPI::HttpAuthSSPI(SSPILibrary* library,
                            const std::string& scheme,
                            SEC_WCHAR* security_package,
                            ULONG max_token_length)
     : library_(library),
       scheme_(scheme),
       security_package_(security_package),
-      max_token_length_(max_token_length) {
+      max_token_length_(max_token_length),
+      can_delegate_(false) {
   DCHECK(library_);
   SecInvalidateHandle(&cred_);
   SecInvalidateHandle(&ctxt_);
 }
 
 HttpAuthSSPI::~HttpAuthSSPI() {
   ResetSecurityContext();
   if (SecIsValidHandle(&cred_)) {
     library_->FreeCredentialsHandle(&cred_);
     SecInvalidateHandle(&cred_);
   }
 }
 
 bool HttpAuthSSPI::NeedsIdentity() const {
   return decoded_server_auth_token_.empty();
 }
 
 bool HttpAuthSSPI::IsFinalRound() const {
   return !decoded_server_auth_token_.empty();
 }
 
+void HttpAuthSSPI::Delegate() {
+  can_delegate_ = true;
+}
+
 void HttpAuthSSPI::ResetSecurityContext() {
   if (SecIsValidHandle(&ctxt_)) {
     library_->DeleteSecurityContext(&ctxt_);
     SecInvalidateHandle(&ctxt_);
   }
 }
 
 bool HttpAuthSSPI::ParseChallenge(HttpAuth::ChallengeTokenizer* tok) {
   // Verify the challenge's auth-scheme.
   if (!tok->valid() ||
@@ skipping 74 matching lines @@
     rv = AcquireDefaultCredentials(library_, security_package_, &cred_);
     if (rv != OK)
       return rv;
   }
 
   return rv;
 }
 
 int HttpAuthSSPI::GetNextSecurityToken(
     const std::wstring& spn,
-    const void * in_token,
+    const void* in_token,
     int in_token_len,
     void** out_token,
     int* out_token_len) {
-  SECURITY_STATUS status;
-  TimeStamp expiry;
-
-  DWORD ctxt_attr;
   CtxtHandle* ctxt_ptr;
   SecBufferDesc in_buffer_desc, out_buffer_desc;
   SecBufferDesc* in_buffer_desc_ptr;
   SecBuffer in_buffer, out_buffer;
 
   if (in_token_len > 0) {
     // Prepare input buffer.
     in_buffer_desc.ulVersion = SECBUFFER_VERSION;
     in_buffer_desc.cBuffers = 1;
     in_buffer_desc.pBuffers = &in_buffer;
@@ skipping 17 matching lines @@
   // Prepare output buffer.
   out_buffer_desc.ulVersion = SECBUFFER_VERSION;
   out_buffer_desc.cBuffers = 1;
   out_buffer_desc.pBuffers = &out_buffer;
   out_buffer.BufferType = SECBUFFER_TOKEN;
   out_buffer.cbBuffer = max_token_length_;
   out_buffer.pvBuffer = malloc(out_buffer.cbBuffer);
   if (!out_buffer.pvBuffer)
     return ERR_OUT_OF_MEMORY;
 
+  DWORD context_flags = 0;
+  // Firefox only sets ISC_REQ_DELEGATE, but MSDN documentation indicates that
+  // ISC_REQ_MUTUAL_AUTH must also be set.
+  if (can_delegate_)
+    context_flags |= (ISC_REQ_DELEGATE | ISC_REQ_MUTUAL_AUTH);
+
   // This returns a token that is passed to the remote server.
-  status = library_->InitializeSecurityContext(
+  DWORD context_attribute;
+  SECURITY_STATUS status = library_->InitializeSecurityContext(
       &cred_,  // phCredential
       ctxt_ptr,  // phContext
       const_cast<wchar_t *>(spn.c_str()),  // pszTargetName
-      0,  // fContextReq
+      context_flags,  // fContextReq
       0,  // Reserved1 (must be 0)
       SECURITY_NATIVE_DREP,  // TargetDataRep
       in_buffer_desc_ptr,  // pInput
       0,  // Reserved2 (must be 0)
       &ctxt_,  // phNewContext
       &out_buffer_desc,  // pOutput
-      &ctxt_attr,  // pfContextAttr
-      &expiry);  // ptsExpiry
+      &context_attribute,  // pfContextAttr
+      NULL);  // ptsExpiry
   // On success, the function returns SEC_I_CONTINUE_NEEDED on the first call
   // and SEC_E_OK on the second call.  On failure, the function returns an
   // error code.
   if (status != SEC_I_CONTINUE_NEEDED && status != SEC_E_OK) {
     LOG(ERROR) << "InitializeSecurityContext failed " << status;
     ResetSecurityContext();
     free(out_buffer.pvBuffer);
     return ERR_UNEXPECTED;  // TODO(wtc): map error code.
   }
   if (!out_buffer.cbBuffer) {
@@ skipping 116 matching lines @@
  private:
   friend struct DefaultSingletonTraits<SSPILibraryDefault>;
 };
 
 // static
 SSPILibrary* SSPILibrary::GetDefault() {
   return Singleton<SSPILibraryDefault>::get();
 }
 
 }  // namespace net