[net/auth] Treat ERR_INVALID_HANDLE as a identity invalidating error.

net/http/http_auth_controller.cc

Index: net/http/http_auth_controller.cc
diff --git a/net/http/http_auth_controller.cc b/net/http/http_auth_controller.cc
index 39361b44ed5633d100a4b5fb0998cd7c9f934d66..fa74f838d0c2ebcf1497dda5a50b7af9b2771fcb 100644
--- a/net/http/http_auth_controller.cc
+++ b/net/http/http_auth_controller.cc
@@ -474,16 +474,22 @@ void HttpAuthController::PopulateAuthChallenge() {
 int HttpAuthController::HandleGenerateTokenResult(int result) {
   DCHECK(CalledOnValidThread());
   switch (result) {
+    // Occurs if the credential handle is found to be invalid at the point it is
+    // exercised (i.e. GenerateAuthToken stage). We are going to consider this
+    // to be an error that invalidates the identity but not necessarily the
+    // scheme. Doing so allows a different identity to be used with the same
+    // scheme. See https://crbug.com/648366.
+    case ERR_INVALID_HANDLE:

[mmenke, 2016/11/16 22:44:23]

How do we get an invalid handle in the first place?

I guess this is similar enough to the ERR_INVALID_AUTH_CREDENTIALS case that
testing doesn't get us much, since we mock out the thing that's actually
returning the error.

[asanka, 2016/11/16 23:01:31]

It's possible for us to get a credentials handle, but then the platform deciding
that the handle is not valid for auth target when we get around to generating a
token.

+
+    // If the GenerateAuthToken call fails with this error, this means that the
+    // handler can no longer be used. However, the authentication scheme is
+    // considered still usable. This allows a scheme that attempted and failed
+    // to use default credentials to recover and use explicit credentials.
+    //
+    // The current handler may be tied to external state that is no longer
+    // valid, hence should be discarded. Since the scheme is still valid, a new
+    // handler can be created for the current scheme.
     case ERR_INVALID_AUTH_CREDENTIALS:
-      // If the GenerateAuthToken call fails with this error, this means that
-      // the handler can no longer be used. However, the authentication scheme
-      // is considered still usable. This allows a scheme that attempted and
-      // failed to use default credentials to recover and use explicit
-      // credentials.
-      //
-      // The current handler may be tied to external state that is no longer
-      // valid, hence should be discarded. Since the scheme is still valid, a
-      // new handler can be created for the current scheme.
       InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS);
       auth_token_.clear();
       return OK;