Add NTLM single-sign-on support via Samba's ntlm_auth helper

net/http/http_auth_handler_ntlm.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_ntlm.h"
 
 #if !defined(NTLM_SSPI)
 #include "base/base64.h"
 #endif
 #include "base/logging.h"
@@ skipping 20 matching lines @@
 
 int HttpAuthHandlerNTLM::GenerateAuthTokenImpl(
     const AuthCredentials* credentials, const HttpRequestInfo* request,
     const CompletionCallback& callback, std::string* auth_token) {
 #if defined(NTLM_SSPI)
   return auth_sspi_.GenerateAuthToken(
       credentials,
       CreateSPN(origin_),
       auth_token);
 #else  // !defined(NTLM_SSPI)
-  // TODO(cbentzel): Shouldn't be hitting this case.
-  if (!credentials) {
-    LOG(ERROR) << "Username and password are expected to be non-NULL.";
-    return ERR_MISSING_AUTH_CREDENTIALS;
+  if (!credentials && try_winbind_) {
+    token_callback_ = callback;
+    callback_auth_token_ = auth_token;
+    if (!auth_data_.empty()) {
+      std::string tt = std::string("TT ") + auth_data_ + std::string("\n");
+
+      VLOG(1) << "Feeding challenge to ntlm_auth: %s" << tt;
+      if (write(ntlm_write_pipe_, tt.data(), tt.length()) != (int)tt.length()) {
+        VLOG(1) << "Failed to send TT+auth_data_ to ntlm_auth: ";
+        return ERR_UNEXPECTED;
+      }
+
+      // Next time round, try real credentials.
+      try_winbind_ = false;
+    } else if (!start_ntlm_helper_()) {
+      // If we don't manage to start winbind's ntlm_auth helper then we can
+      // fall back immediately to the portable code.
+      try_winbind_ = false;
+      goto fallback_to_portable;
+    }
+
+    if (!base::MessageLoopForIO::current()->WatchFileDescriptor(ntlm_read_pipe_,
+                                    false, base::MessageLoopForIO::WATCH_READ,
+                                    &ntlm_read_watcher_, this)) {
+      VLOG(1) << "Failed to setup watcher on ntlm_read_pipe_";
+      return ERR_UNEXPECTED;
+    }
+    return ERR_IO_PENDING;
   }
+
+ fallback_to_portable:
   // TODO(wtc): See if we can use char* instead of void* for in_buf and
   // out_buf.  This change will need to propagate to GetNextToken,
   // GenerateType1Msg, and GenerateType3Msg, and perhaps further.
   const void* in_buf;
   void* out_buf;
   uint32 in_buf_len, out_buf_len;
   std::string decoded_auth_data;
 
-  // The username may be in the form "DOMAIN\user".  Parse it into the two
-  // components.
-  base::string16 domain;
-  base::string16 user;
-  const base::string16& username = credentials->username();
-  const base::char16 backslash_character = '\\';
-  size_t backslash_idx = username.find(backslash_character);
-  if (backslash_idx == base::string16::npos) {
-    user = username;
-  } else {
-    domain = username.substr(0, backslash_idx);
-    user = username.substr(backslash_idx + 1);
-  }
-  domain_ = domain;
-  credentials_.Set(user, credentials->password());
-
   // Initial challenge.
   if (auth_data_.empty()) {
     in_buf_len = 0;
     in_buf = NULL;
     int rv = InitializeBeforeFirstChallenge();
     if (rv != OK)
       return rv;
   } else {
+    // TODO(cbentzel): Shouldn't be hitting this case.
+    if (!credentials) {
+      LOG(ERROR) << "Username and password are expected to be non-NULL.";
+      return ERR_MISSING_AUTH_CREDENTIALS;
+    }
+
+    // The username may be in the form "DOMAIN\user".  Parse it into the two
+    // components.
+    base::string16 domain;
+    base::string16 user;
+    const base::string16& username = credentials->username();
+    const base::char16 backslash_character = '\\';
+    size_t backslash_idx = username.find(backslash_character);
+    if (backslash_idx == base::string16::npos) {
+      user = username;
+    } else {
+      domain = username.substr(0, backslash_idx);
+      user = username.substr(backslash_idx + 1);
+    }
+    domain_ = domain;
+    credentials_.Set(user, credentials->password());
+
     if (!base::Base64Decode(auth_data_, &decoded_auth_data)) {
       LOG(ERROR) << "Unexpected problem Base64 decoding.";
       return ERR_UNEXPECTED;
     }
     in_buf_len = decoded_auth_data.length();
     in_buf = decoded_auth_data.data();
   }
 
   int rv = GetNextToken(in_buf, in_buf_len, &out_buf, &out_buf_len);
   if (rv != OK)
@@ skipping 47 matching lines @@
 // static
 std::string HttpAuthHandlerNTLM::CreateSPN(const GURL& origin) {
   // The service principal name of the destination server.  See
   // http://msdn.microsoft.com/en-us/library/ms677949%28VS.85%29.aspx
   std::string target("HTTP/");
   target.append(GetHostAndPort(origin));
   return target;
 }
 
 }  // namespace net