Add support for delegated Kerberos tickets during Negotiate authentication.

net/http/http_auth_gssapi_posix.cc

Index: net/http/http_auth_gssapi_posix.cc
===================================================================
--- net/http/http_auth_gssapi_posix.cc	(revision 57541)
+++ net/http/http_auth_gssapi_posix.cc	(working copy)
@@ -677,7 +677,8 @@
     : scheme_(scheme),
       gss_oid_(gss_oid),
       library_(library),
-      scoped_sec_context_(library) {
+      scoped_sec_context_(library),
+      can_delegate_(false) {
   DCHECK(library_);
 }
 
@@ -698,6 +699,10 @@
   return !NeedsIdentity();
 }
 
+void HttpAuthGSSAPI::Delegate() {
+  can_delegate_ = true;
+}
+
 bool HttpAuthGSSAPI::ParseChallenge(HttpAuth::ChallengeTokenizer* tok) {
   // Verify the challenge's auth-scheme.
   if (!tok->valid() ||
@@ -799,6 +804,8 @@
 
   // Continue creating a security context.
   OM_uint32 req_flags = 0;
+  if (can_delegate_)
+    req_flags |= GSS_C_DELEG_FLAG;
   major_status = library_->init_sec_context(
       &minor_status,
       GSS_C_NO_CREDENTIAL,