| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // This file contains common routines used by NTLM and Negotiate authentication | 5 // This file contains common routines used by NTLM and Negotiate authentication |
| 6 // using the SSPI API on Windows. | 6 // using the SSPI API on Windows. |
| 7 | 7 |
| 8 #ifndef NET_HTTP_HTTP_AUTH_SSPI_WIN_H_ | 8 #ifndef NET_HTTP_HTTP_AUTH_SSPI_WIN_H_ |
| 9 #define NET_HTTP_HTTP_AUTH_SSPI_WIN_H_ | 9 #define NET_HTTP_HTTP_AUTH_SSPI_WIN_H_ |
| 10 | 10 |
| (...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 51 unsigned long Reserved1, | 51 unsigned long Reserved1, |
| 52 unsigned long TargetDataRep, | 52 unsigned long TargetDataRep, |
| 53 PSecBufferDesc pInput, | 53 PSecBufferDesc pInput, |
| 54 unsigned long Reserved2, | 54 unsigned long Reserved2, |
| 55 PCtxtHandle phNewContext, | 55 PCtxtHandle phNewContext, |
| 56 PSecBufferDesc pOutput, | 56 PSecBufferDesc pOutput, |
| 57 unsigned long* contextAttr, | 57 unsigned long* contextAttr, |
| 58 PTimeStamp ptsExpiry) = 0; | 58 PTimeStamp ptsExpiry) = 0; |
| 59 | 59 |
| 60 virtual SECURITY_STATUS QuerySecurityPackageInfo(LPWSTR pszPackageName, | 60 virtual SECURITY_STATUS QuerySecurityPackageInfo(LPWSTR pszPackageName, |
| 61 PSecPkgInfoW *pkgInfo) = 0; | 61 PSecPkgInfoW* pkgInfo) = 0; |
| 62 | 62 |
| 63 virtual SECURITY_STATUS FreeCredentialsHandle(PCredHandle phCredential) = 0; | 63 virtual SECURITY_STATUS FreeCredentialsHandle(PCredHandle phCredential) = 0; |
| 64 | 64 |
| 65 virtual SECURITY_STATUS DeleteSecurityContext(PCtxtHandle phContext) = 0; | 65 virtual SECURITY_STATUS DeleteSecurityContext(PCtxtHandle phContext) = 0; |
| 66 | 66 |
| 67 virtual SECURITY_STATUS FreeContextBuffer(PVOID pvContextBuffer) = 0; | 67 virtual SECURITY_STATUS FreeContextBuffer(PVOID pvContextBuffer) = 0; |
| 68 }; | 68 }; |
| 69 | 69 |
| 70 class SSPILibraryDefault : public SSPILibrary { | 70 class SSPILibraryDefault : public SSPILibrary { |
| 71 public: | 71 public: |
| 72 SSPILibraryDefault() {} | 72 SSPILibraryDefault() {} |
| 73 virtual ~SSPILibraryDefault() {} | 73 virtual ~SSPILibraryDefault() {} |
| 74 | 74 |
| 75 virtual SECURITY_STATUS AcquireCredentialsHandle(LPWSTR pszPrincipal, | 75 virtual SECURITY_STATUS AcquireCredentialsHandle(LPWSTR pszPrincipal, |
| 76 LPWSTR pszPackage, | 76 LPWSTR pszPackage, |
| 77 unsigned long fCredentialUse, | 77 unsigned long fCredentialUse, |
| 78 void* pvLogonId, | 78 void* pvLogonId, |
| 79 void* pvAuthData, | 79 void* pvAuthData, |
| 80 SEC_GET_KEY_FN pGetKeyFn, | 80 SEC_GET_KEY_FN pGetKeyFn, |
| 81 void* pvGetKeyArgument, | 81 void* pvGetKeyArgument, |
| 82 PCredHandle phCredential, | 82 PCredHandle phCredential, |
| 83 PTimeStamp ptsExpiry) { | 83 PTimeStamp ptsExpiry) { |
| 84 return ::AcquireCredentialsHandle(pszPrincipal, pszPackage, fCredentialUse, | 84 return ::AcquireCredentialsHandle(pszPrincipal, |
| 85 pvLogonId, pvAuthData, pGetKeyFn, | 85 pszPackage, |
| 86 pvGetKeyArgument, phCredential, | 86 fCredentialUse, |
| 87 pvLogonId, |
| 88 pvAuthData, |
| 89 pGetKeyFn, |
| 90 pvGetKeyArgument, |
| 91 phCredential, |
| 87 ptsExpiry); | 92 ptsExpiry); |
| 88 } | 93 } |
| 89 | 94 |
| 90 virtual SECURITY_STATUS InitializeSecurityContext(PCredHandle phCredential, | 95 virtual SECURITY_STATUS InitializeSecurityContext(PCredHandle phCredential, |
| 91 PCtxtHandle phContext, | 96 PCtxtHandle phContext, |
| 92 SEC_WCHAR* pszTargetName, | 97 SEC_WCHAR* pszTargetName, |
| 93 unsigned long fContextReq, | 98 unsigned long fContextReq, |
| 94 unsigned long Reserved1, | 99 unsigned long Reserved1, |
| 95 unsigned long TargetDataRep, | 100 unsigned long TargetDataRep, |
| 96 PSecBufferDesc pInput, | 101 PSecBufferDesc pInput, |
| 97 unsigned long Reserved2, | 102 unsigned long Reserved2, |
| 98 PCtxtHandle phNewContext, | 103 PCtxtHandle phNewContext, |
| 99 PSecBufferDesc pOutput, | 104 PSecBufferDesc pOutput, |
| 100 unsigned long* contextAttr, | 105 unsigned long* contextAttr, |
| 101 PTimeStamp ptsExpiry) { | 106 PTimeStamp ptsExpiry) { |
| 102 return ::InitializeSecurityContext(phCredential, phContext, pszTargetName, | 107 return ::InitializeSecurityContext(phCredential, |
| 103 fContextReq, Reserved1, TargetDataRep, | 108 phContext, |
| 104 pInput, Reserved2, phNewContext, pOutput, | 109 pszTargetName, |
| 105 contextAttr, ptsExpiry); | 110 fContextReq, |
| 111 Reserved1, |
| 112 TargetDataRep, |
| 113 pInput, |
| 114 Reserved2, |
| 115 phNewContext, |
| 116 pOutput, |
| 117 contextAttr, |
| 118 ptsExpiry); |
| 106 } | 119 } |
| 107 | 120 |
| 108 virtual SECURITY_STATUS QuerySecurityPackageInfo(LPWSTR pszPackageName, | 121 virtual SECURITY_STATUS QuerySecurityPackageInfo(LPWSTR pszPackageName, |
| 109 PSecPkgInfoW *pkgInfo) { | 122 PSecPkgInfoW* pkgInfo) { |
| 110 return ::QuerySecurityPackageInfo(pszPackageName, pkgInfo); | 123 return ::QuerySecurityPackageInfo(pszPackageName, pkgInfo); |
| 111 } | 124 } |
| 112 | 125 |
| 113 virtual SECURITY_STATUS FreeCredentialsHandle(PCredHandle phCredential) { | 126 virtual SECURITY_STATUS FreeCredentialsHandle(PCredHandle phCredential) { |
| 114 return ::FreeCredentialsHandle(phCredential); | 127 return ::FreeCredentialsHandle(phCredential); |
| 115 } | 128 } |
| 116 | 129 |
| 117 virtual SECURITY_STATUS DeleteSecurityContext(PCtxtHandle phContext) { | 130 virtual SECURITY_STATUS DeleteSecurityContext(PCtxtHandle phContext) { |
| 118 return ::DeleteSecurityContext(phContext); | 131 return ::DeleteSecurityContext(phContext); |
| 119 } | 132 } |
| 120 | 133 |
| 121 virtual SECURITY_STATUS FreeContextBuffer(PVOID pvContextBuffer) { | 134 virtual SECURITY_STATUS FreeContextBuffer(PVOID pvContextBuffer) { |
| 122 return ::FreeContextBuffer(pvContextBuffer); | 135 return ::FreeContextBuffer(pvContextBuffer); |
| 123 } | 136 } |
| 124 }; | 137 }; |
| 125 | 138 |
| 126 class NET_EXPORT_PRIVATE HttpAuthSSPI { | 139 class NET_EXPORT_PRIVATE HttpAuthSSPI { |
| 127 public: | 140 public: |
| 128 HttpAuthSSPI(SSPILibrary* sspi_library, | 141 HttpAuthSSPI(SSPILibrary* sspi_library, |
| 129 const std::string& scheme, | 142 const std::string& scheme, |
| 130 const SEC_WCHAR* security_package, | 143 const SEC_WCHAR* security_package, |
| 131 ULONG max_token_length); | 144 ULONG max_token_length); |
| 132 ~HttpAuthSSPI(); | 145 ~HttpAuthSSPI(); |
| 133 | 146 |
| 134 bool NeedsIdentity() const; | 147 bool NeedsIdentity() const; |
| 135 | 148 |
| 136 bool AllowsExplicitCredentials() const; | 149 bool AllowsExplicitCredentials() const; |
| 137 | 150 |
| 138 HttpAuth::AuthorizationResult ParseChallenge( | 151 HttpAuth::AuthorizationResult ParseChallenge(HttpAuthChallengeTokenizer* tok); |
| 139 HttpAuthChallengeTokenizer* tok); | |
| 140 | 152 |
| 141 // Generates an authentication token for the service specified by the | 153 // Generates an authentication token for the service specified by the |
| 142 // Service Principal Name |spn| and stores the value in |*auth_token|. | 154 // Service Principal Name |spn| and stores the value in |*auth_token|. |
| 143 // If the return value is not |OK|, then the value of |*auth_token| is | 155 // If the return value is not |OK|, then the value of |*auth_token| is |
| 144 // unspecified. ERR_IO_PENDING is not a valid return code. | 156 // unspecified. ERR_IO_PENDING is not a valid return code. |
| 145 // If this is the first round of a multiple round scheme, credentials are | 157 // If this is the first round of a multiple round scheme, credentials are |
| 146 // obtained using |*credentials|. If |credentials| is NULL, the credentials | 158 // obtained using |*credentials|. If |credentials| is NULL, the credentials |
| 147 // for the currently logged in user are used instead. | 159 // for the currently logged in user are used instead. |
| 148 int GenerateAuthToken(const AuthCredentials* credentials, | 160 int GenerateAuthToken(const AuthCredentials* credentials, |
| 149 const std::string& spn, | 161 const std::string& spn, |
| 150 std::string* auth_token); | 162 std::string* auth_token); |
| 151 | 163 |
| 152 // Delegation is allowed on the Kerberos ticket. This allows certain servers | 164 // Delegation is allowed on the Kerberos ticket. This allows certain servers |
| 153 // to act as the user, such as an IIS server retrieiving data from a | 165 // to act as the user, such as an IIS server retrieiving data from a |
| 154 // Kerberized MSSQL server. | 166 // Kerberized MSSQL server. |
| 155 void Delegate(); | 167 void Delegate(); |
| 156 | 168 |
| 157 private: | 169 private: |
| 158 int OnFirstRound(const AuthCredentials* credentials); | 170 int OnFirstRound(const AuthCredentials* credentials); |
| 159 | 171 |
| 160 int GetNextSecurityToken( | 172 int GetNextSecurityToken(const std::string& spn, |
| 161 const std::string& spn, | 173 const void* in_token, |
| 162 const void* in_token, | 174 int in_token_len, |
| 163 int in_token_len, | 175 void** out_token, |
| 164 void** out_token, | 176 int* out_token_len); |
| 165 int* out_token_len); | |
| 166 | 177 |
| 167 void ResetSecurityContext(); | 178 void ResetSecurityContext(); |
| 168 | 179 |
| 169 SSPILibrary* library_; | 180 SSPILibrary* library_; |
| 170 std::string scheme_; | 181 std::string scheme_; |
| 171 const SEC_WCHAR* security_package_; | 182 const SEC_WCHAR* security_package_; |
| 172 std::string decoded_server_auth_token_; | 183 std::string decoded_server_auth_token_; |
| 173 ULONG max_token_length_; | 184 ULONG max_token_length_; |
| 174 CredHandle cred_; | 185 CredHandle cred_; |
| 175 CtxtHandle ctxt_; | 186 CtxtHandle ctxt_; |
| (...skipping 24 matching lines...) Expand all Loading... |
| 200 // If the return value is ERR_UNEXPECTED, there was an unanticipated problem | 211 // If the return value is ERR_UNEXPECTED, there was an unanticipated problem |
| 201 // in the underlying SSPI call. The details are logged, and |*max_token_length| | 212 // in the underlying SSPI call. The details are logged, and |*max_token_length| |
| 202 // is not changed. | 213 // is not changed. |
| 203 NET_EXPORT_PRIVATE int DetermineMaxTokenLength(SSPILibrary* library, | 214 NET_EXPORT_PRIVATE int DetermineMaxTokenLength(SSPILibrary* library, |
| 204 const std::wstring& package, | 215 const std::wstring& package, |
| 205 ULONG* max_token_length); | 216 ULONG* max_token_length); |
| 206 | 217 |
| 207 } // namespace net | 218 } // namespace net |
| 208 | 219 |
| 209 #endif // NET_HTTP_HTTP_AUTH_SSPI_WIN_H_ | 220 #endif // NET_HTTP_HTTP_AUTH_SSPI_WIN_H_ |
| OLD | NEW |