Add support for delegated Kerberos tickets during Negotiate authentication.

net/http/http_auth_sspi_win.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains common routines used by NTLM and Negotiate authentication
 // using the SSPI API on Windows.
 
 #ifndef NET_HTTP_HTTP_AUTH_SSPI_WIN_H_
 #define NET_HTTP_HTTP_AUTH_SSPI_WIN_H_
 #pragma once
@@ skipping 78 matching lines @@
   // unspecified. ERR_IO_PENDING is not a valid return code.
   // If this is the first round of a multiple round scheme, credentials are
   // obtained using |*username| and |*password|. If |username| and |password|
   // are both NULL, the credentials for the currently logged in user are used
   // instead.
   int GenerateAuthToken(const string16* username,
                         const string16* password,
                         const std::wstring& spn,
                         std::string* auth_token);
 
+  // Delegation is allowed on the Kerberos ticket. This allows certain servers
+  // to act as the user, such as an IIS server retrieiving data from a
+  // Kerberized MSSQL server.
+  void Delegate();
+
  private:
   int OnFirstRound(const string16* username,
                    const string16* password);
 
   int GetNextSecurityToken(
       const std::wstring& spn,
       const void* in_token,
       int in_token_len,
       void** out_token,
       int* out_token_len);
 
   void ResetSecurityContext();
 
   SSPILibrary* library_;
   std::string scheme_;
   SEC_WCHAR* security_package_;
   std::string decoded_server_auth_token_;
   ULONG max_token_length_;
   CredHandle cred_;
   CtxtHandle ctxt_;
+  bool can_delegate_;
 };
 
 // Splits |combined| into domain and username.
 // If |combined| is of form "FOO\bar", |domain| will contain "FOO" and |user|
 // will contain "bar".
 // If |combined| is of form "bar", |domain| will be empty and |user| will
 // contain "bar".
 // |domain| and |user| must be non-NULL.
 void SplitDomainAndUser(const string16& combined,
                         string16* domain,
@@ skipping 13 matching lines @@
 // If the return value is ERR_UNEXPECTED, there was an unanticipated problem
 // in the underlying SSPI call. The details are logged, and |*max_token_length|
 // is not changed.
 int DetermineMaxTokenLength(SSPILibrary* library,
                             const std::wstring& package,
                             ULONG* max_token_length);
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_AUTH_SSPI_WIN_H_