Home | History | Annotate | Download | only in http 
      1 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 // See "SSPI Sample Application" at
      6 // http://msdn.microsoft.com/en-us/library/aa918273.aspx
      7 
      8 #include "net/http/http_auth_sspi_win.h"
      9 
     10 #include "base/base64.h"
     11 #include "base/logging.h"
     12 #include "base/string_util.h"
     13 #include "base/utf_string_conversions.h"
     14 #include "net/base/net_errors.h"
     15 #include "net/http/http_auth.h"
     16 
     17 namespace net {
     18 
     19 namespace {
     20 
     21 int MapAcquireCredentialsStatusToError(SECURITY_STATUS status,
     22                                        const SEC_WCHAR* package) {
     23   VLOG(1) << "AcquireCredentialsHandle returned 0x" << std::hex << status;
     24   switch (status) {
     25     case SEC_E_OK:
     26       return OK;
     27     case SEC_E_INSUFFICIENT_MEMORY:
     28       return ERR_OUT_OF_MEMORY;
     29     case SEC_E_INTERNAL_ERROR:
     30       LOG(WARNING)
     31           << "AcquireCredentialsHandle returned unexpected status 0x"
     32           << std::hex << status;
     33       return ERR_UNEXPECTED_SECURITY_LIBRARY_STATUS;
     34     case SEC_E_NO_CREDENTIALS:
     35     case SEC_E_NOT_OWNER:
     36     case SEC_E_UNKNOWN_CREDENTIALS:
     37       return ERR_INVALID_AUTH_CREDENTIALS;
     38     case SEC_E_SECPKG_NOT_FOUND:
     39       // This indicates that the SSPI configuration does not match expectations
     40       return ERR_UNSUPPORTED_AUTH_SCHEME;
     41     default:
     42       LOG(WARNING)
     43           << "AcquireCredentialsHandle returned undocumented status 0x"
     44           << std::hex << status;
     45       return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS;
     46   }
     47 }
     48 
     49 int AcquireExplicitCredentials(SSPILibrary* library,
     50                                const SEC_WCHAR* package,
     51                                const string16& domain,
     52                                const string16& user,
     53                                const string16& password,
     54                                CredHandle* cred) {
     55   SEC_WINNT_AUTH_IDENTITY identity;
     56   identity.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
     57   identity.User =
     58       reinterpret_cast<unsigned short*>(const_cast<wchar_t*>(user.c_str()));
     59   identity.UserLength = user.size();
     60   identity.Domain =
     61       reinterpret_cast<unsigned short*>(const_cast<wchar_t*>(domain.c_str()));
     62   identity.DomainLength = domain.size();
     63   identity.Password =
     64       reinterpret_cast<unsigned short*>(const_cast<wchar_t*>(password.c_str()));
     65   identity.PasswordLength = password.size();
     66 
     67   TimeStamp expiry;
     68 
     69   // Pass the username/password to get the credentials handle.
     70   SECURITY_STATUS status = library->AcquireCredentialsHandle(
     71       NULL,  // pszPrincipal
     72       const_cast<SEC_WCHAR*>(package),  // pszPackage
     73       SECPKG_CRED_OUTBOUND,  // fCredentialUse
     74       NULL,  // pvLogonID
     75       &identity,  // pAuthData
     76       NULL,  // pGetKeyFn (not used)
     77       NULL,  // pvGetKeyArgument (not used)
     78       cred,  // phCredential
     79       &expiry);  // ptsExpiry
     80 
     81   return MapAcquireCredentialsStatusToError(status, package);
     82 }
     83 
     84 int AcquireDefaultCredentials(SSPILibrary* library, const SEC_WCHAR* package,
     85                               CredHandle* cred) {
     86   TimeStamp expiry;
     87 
     88   // Pass the username/password to get the credentials handle.
     89   // Note: Since the 5th argument is NULL, it uses the default
     90   // cached credentials for the logged in user, which can be used
     91   // for a single sign-on.
     92   SECURITY_STATUS status = library->AcquireCredentialsHandle(
     93       NULL,  // pszPrincipal
     94       const_cast<SEC_WCHAR*>(package),  // pszPackage
     95       SECPKG_CRED_OUTBOUND,  // fCredentialUse
     96       NULL,  // pvLogonID
     97       NULL,  // pAuthData
     98       NULL,  // pGetKeyFn (not used)
     99       NULL,  // pvGetKeyArgument (not used)
    100       cred,  // phCredential
    101       &expiry);  // ptsExpiry
    102 
    103   return MapAcquireCredentialsStatusToError(status, package);
    104 }
    105 
    106 int MapInitializeSecurityContextStatusToError(SECURITY_STATUS status) {
    107   VLOG(1) << "InitializeSecurityContext returned 0x" << std::hex << status;
    108   switch (status) {
    109     case SEC_E_OK:
    110     case SEC_I_CONTINUE_NEEDED:
    111       return OK;
    112     case SEC_I_COMPLETE_AND_CONTINUE:
    113     case SEC_I_COMPLETE_NEEDED:
    114     case SEC_I_INCOMPLETE_CREDENTIALS:
    115     case SEC_E_INCOMPLETE_MESSAGE:
    116     case SEC_E_INTERNAL_ERROR:
    117       // These are return codes reported by InitializeSecurityContext
    118       // but not expected by Chrome (for example, INCOMPLETE_CREDENTIALS
    119       // and INCOMPLETE_MESSAGE are intended for schannel).
    120       LOG(WARNING)
    121           << "InitializeSecurityContext returned unexpected status 0x"
    122           << std::hex << status;
    123       return ERR_UNEXPECTED_SECURITY_LIBRARY_STATUS;
    124     case SEC_E_INSUFFICIENT_MEMORY:
    125       return ERR_OUT_OF_MEMORY;
    126     case SEC_E_UNSUPPORTED_FUNCTION:
    127       NOTREACHED();
    128       return ERR_UNEXPECTED;
    129     case SEC_E_INVALID_HANDLE:
    130       NOTREACHED();
    131       return ERR_INVALID_HANDLE;
    132     case SEC_E_INVALID_TOKEN:
    133       return ERR_INVALID_RESPONSE;
    134     case SEC_E_LOGON_DENIED:
    135       return ERR_ACCESS_DENIED;
    136     case SEC_E_NO_CREDENTIALS:
    137     case SEC_E_WRONG_PRINCIPAL:
    138       return ERR_INVALID_AUTH_CREDENTIALS;
    139     case SEC_E_NO_AUTHENTICATING_AUTHORITY:
    140     case SEC_E_TARGET_UNKNOWN:
    141       return ERR_MISCONFIGURED_AUTH_ENVIRONMENT;
    142     default:
    143       LOG(WARNING)
    144           << "InitializeSecurityContext returned undocumented status 0x"
    145           << std::hex << status;
    146       return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS;
    147   }
    148 }
    149 
    150 int MapQuerySecurityPackageInfoStatusToError(SECURITY_STATUS status) {
    151   VLOG(1) << "QuerySecurityPackageInfo returned 0x" << std::hex << status;
    152   switch (status) {
    153     case SEC_E_OK:
    154       return OK;
    155     case SEC_E_SECPKG_NOT_FOUND:
    156       // This isn't a documented return code, but has been encountered
    157       // during testing.
    158       return ERR_UNSUPPORTED_AUTH_SCHEME;
    159     default:
    160       LOG(WARNING)
    161           << "QuerySecurityPackageInfo returned undocumented status 0x"
    162           << std::hex << status;
    163       return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS;
    164   }
    165 }
    166 
    167 int MapFreeContextBufferStatusToError(SECURITY_STATUS status) {
    168   VLOG(1) << "FreeContextBuffer returned 0x" << std::hex << status;
    169   switch (status) {
    170     case SEC_E_OK:
    171       return OK;
    172     default:
    173       // The documentation at
    174       // http://msdn.microsoft.com/en-us/library/aa375416(VS.85).aspx
    175       // only mentions that a non-zero (or non-SEC_E_OK) value is returned
    176       // if the function fails, and does not indicate what the failure
    177       // conditions are.
    178       LOG(WARNING)
    179           << "FreeContextBuffer returned undocumented status 0x"
    180           << std::hex << status;
    181       return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS;
    182   }
    183 }
    184 
    185 }  // anonymous namespace
    186 
    187 HttpAuthSSPI::HttpAuthSSPI(SSPILibrary* library,
    188                            const std::string& scheme,
    189                            SEC_WCHAR* security_package,
    190                            ULONG max_token_length)
    191     : library_(library),
    192       scheme_(scheme),
    193       security_package_(security_package),
    194       max_token_length_(max_token_length),
    195       can_delegate_(false) {
    196   DCHECK(library_);
    197   SecInvalidateHandle(&cred_);
    198   SecInvalidateHandle(&ctxt_);
    199 }
    200 
    201 HttpAuthSSPI::~HttpAuthSSPI() {
    202   ResetSecurityContext();
    203   if (SecIsValidHandle(&cred_)) {
    204     library_->FreeCredentialsHandle(&cred_);
    205     SecInvalidateHandle(&cred_);
    206   }
    207 }
    208 
    209 bool HttpAuthSSPI::NeedsIdentity() const {
    210   return decoded_server_auth_token_.empty();
    211 }
    212 
    213 void HttpAuthSSPI::Delegate() {
    214   can_delegate_ = true;
    215 }
    216 
    217 void HttpAuthSSPI::ResetSecurityContext() {
    218   if (SecIsValidHandle(&ctxt_)) {
    219     library_->DeleteSecurityContext(&ctxt_);
    220     SecInvalidateHandle(&ctxt_);
    221   }
    222 }
    223 
    224 HttpAuth::AuthorizationResult HttpAuthSSPI::ParseChallenge(
    225     HttpAuth::ChallengeTokenizer* tok) {
    226   // Verify the challenge's auth-scheme.
    227   if (!LowerCaseEqualsASCII(tok->scheme(), StringToLowerASCII(scheme_).c_str()))
    228     return HttpAuth::AUTHORIZATION_RESULT_INVALID;
    229 
    230   std::string encoded_auth_token = tok->base64_param();
    231   if (encoded_auth_token.empty()) {
    232     // If a context has already been established, an empty challenge
    233     // should be treated as a rejection of the current attempt.
    234     if (SecIsValidHandle(&ctxt_))
    235       return HttpAuth::AUTHORIZATION_RESULT_REJECT;
    236     DCHECK(decoded_server_auth_token_.empty());
    237     return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
    238   } else {
    239     // If a context has not already been established, additional tokens should
    240     // not be present in the auth challenge.
    241     if (!SecIsValidHandle(&ctxt_))
    242       return HttpAuth::AUTHORIZATION_RESULT_INVALID;
    243   }
    244 
    245   std::string decoded_auth_token;
    246   bool base64_rv = base::Base64Decode(encoded_auth_token, &decoded_auth_token);
    247   if (!base64_rv)
    248     return HttpAuth::AUTHORIZATION_RESULT_INVALID;
    249   decoded_server_auth_token_ = decoded_auth_token;
    250   return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
    251 }
    252 
    253 int HttpAuthSSPI::GenerateAuthToken(const string16* username,
    254                                     const string16* password,
    255                                     const std::wstring& spn,
    256                                     std::string* auth_token) {
    257   DCHECK((username == NULL) == (password == NULL));
    258 
    259   // Initial challenge.
    260   if (!SecIsValidHandle(&cred_)) {
    261     int rv = OnFirstRound(username, password);
    262     if (rv != OK)
    263       return rv;
    264   }
    265 
    266   DCHECK(SecIsValidHandle(&cred_));
    267   void* out_buf;
    268   int out_buf_len;
    269   int rv = GetNextSecurityToken(
    270       spn,
    271       static_cast<void *>(const_cast<char *>(
    272           decoded_server_auth_token_.c_str())),
    273       decoded_server_auth_token_.length(),
    274       &out_buf,
    275       &out_buf_len);
    276   if (rv != OK)
    277     return rv;
    278 
    279   // Base64 encode data in output buffer and prepend the scheme.
    280   std::string encode_input(static_cast<char*>(out_buf), out_buf_len);
    281   std::string encode_output;
    282   bool base64_rv = base::Base64Encode(encode_input, &encode_output);
    283   // OK, we are done with |out_buf|
    284   free(out_buf);
    285   if (!base64_rv) {
    286     LOG(ERROR) << "Base64 encoding of auth token failed.";
    287     return ERR_ENCODING_CONVERSION_FAILED;
    288   }
    289   *auth_token = scheme_ + " " + encode_output;
    290   return OK;
    291 }
    292 
    293 int HttpAuthSSPI::OnFirstRound(const string16* username,
    294                                const string16* password) {
    295   DCHECK((username == NULL) == (password == NULL));
    296   DCHECK(!SecIsValidHandle(&cred_));
    297   int rv = OK;
    298   if (username) {
    299     string16 domain;
    300     string16 user;
    301     SplitDomainAndUser(*username, &domain, &user);
    302     rv = AcquireExplicitCredentials(library_, security_package_, domain,
    303                                     user, *password, &cred_);
    304     if (rv != OK)
    305       return rv;
    306   } else {
    307     rv = AcquireDefaultCredentials(library_, security_package_, &cred_);
    308     if (rv != OK)
    309       return rv;
    310   }
    311 
    312   return rv;
    313 }
    314 
    315 int HttpAuthSSPI::GetNextSecurityToken(
    316     const std::wstring& spn,
    317     const void* in_token,
    318     int in_token_len,
    319     void** out_token,
    320     int* out_token_len) {
    321   CtxtHandle* ctxt_ptr;
    322   SecBufferDesc in_buffer_desc, out_buffer_desc;
    323   SecBufferDesc* in_buffer_desc_ptr;
    324   SecBuffer in_buffer, out_buffer;
    325 
    326   if (in_token_len > 0) {
    327     // Prepare input buffer.
    328     in_buffer_desc.ulVersion = SECBUFFER_VERSION;
    329     in_buffer_desc.cBuffers = 1;
    330     in_buffer_desc.pBuffers = &in_buffer;
    331     in_buffer.BufferType = SECBUFFER_TOKEN;
    332     in_buffer.cbBuffer = in_token_len;
    333     in_buffer.pvBuffer = const_cast<void*>(in_token);
    334     ctxt_ptr = &ctxt_;
    335     in_buffer_desc_ptr = &in_buffer_desc;
    336   } else {
    337     // If there is no input token, then we are starting a new authentication
    338     // sequence.  If we have already initialized our security context, then
    339     // we're incorrectly reusing the auth handler for a new sequence.
    340     if (SecIsValidHandle(&ctxt_)) {
    341       NOTREACHED();
    342       return ERR_UNEXPECTED;
    343     }
    344     ctxt_ptr = NULL;
    345     in_buffer_desc_ptr = NULL;
    346   }
    347 
    348   // Prepare output buffer.
    349   out_buffer_desc.ulVersion = SECBUFFER_VERSION;
    350   out_buffer_desc.cBuffers = 1;
    351   out_buffer_desc.pBuffers = &out_buffer;
    352   out_buffer.BufferType = SECBUFFER_TOKEN;
    353   out_buffer.cbBuffer = max_token_length_;
    354   out_buffer.pvBuffer = malloc(out_buffer.cbBuffer);
    355   if (!out_buffer.pvBuffer)
    356     return ERR_OUT_OF_MEMORY;
    357 
    358   DWORD context_flags = 0;
    359   // Firefox only sets ISC_REQ_DELEGATE, but MSDN documentation indicates that
    360   // ISC_REQ_MUTUAL_AUTH must also be set.
    361   if (can_delegate_)
    362     context_flags |= (ISC_REQ_DELEGATE | ISC_REQ_MUTUAL_AUTH);
    363 
    364   // This returns a token that is passed to the remote server.
    365   DWORD context_attribute;
    366   SECURITY_STATUS status = library_->InitializeSecurityContext(
    367       &cred_,  // phCredential
    368       ctxt_ptr,  // phContext
    369       const_cast<wchar_t *>(spn.c_str()),  // pszTargetName
    370       context_flags,  // fContextReq
    371       0,  // Reserved1 (must be 0)
    372       SECURITY_NATIVE_DREP,  // TargetDataRep
    373       in_buffer_desc_ptr,  // pInput
    374       0,  // Reserved2 (must be 0)
    375       &ctxt_,  // phNewContext
    376       &out_buffer_desc,  // pOutput
    377       &context_attribute,  // pfContextAttr
    378       NULL);  // ptsExpiry
    379   int rv = MapInitializeSecurityContextStatusToError(status);
    380   if (rv != OK) {
    381     ResetSecurityContext();
    382     free(out_buffer.pvBuffer);
    383     return rv;
    384   }
    385   if (!out_buffer.cbBuffer) {
    386     free(out_buffer.pvBuffer);
    387     out_buffer.pvBuffer = NULL;
    388   }
    389   *out_token = out_buffer.pvBuffer;
    390   *out_token_len = out_buffer.cbBuffer;
    391   return OK;
    392 }
    393 
    394 void SplitDomainAndUser(const string16& combined,
    395                         string16* domain,
    396                         string16* user) {
    397   // |combined| may be in the form "user" or "DOMAIN\user".
    398   // Separate the two parts if they exist.
    399   // TODO(cbentzel): I believe user@domain is also a valid form.
    400   size_t backslash_idx = combined.find(L'\\');
    401   if (backslash_idx == string16::npos) {
    402     domain->clear();
    403     *user = combined;
    404   } else {
    405     *domain = combined.substr(0, backslash_idx);
    406     *user = combined.substr(backslash_idx + 1);
    407   }
    408 }
    409 
    410 int DetermineMaxTokenLength(SSPILibrary* library,
    411                             const std::wstring& package,
    412                             ULONG* max_token_length) {
    413   DCHECK(library);
    414   DCHECK(max_token_length);
    415   PSecPkgInfo pkg_info = NULL;
    416   SECURITY_STATUS status = library->QuerySecurityPackageInfo(
    417       const_cast<wchar_t *>(package.c_str()), &pkg_info);
    418   int rv = MapQuerySecurityPackageInfoStatusToError(status);
    419   if (rv != OK)
    420     return rv;
    421   int token_length = pkg_info->cbMaxToken;
    422   status = library->FreeContextBuffer(pkg_info);
    423   rv = MapFreeContextBufferStatusToError(status);
    424   if (rv != OK)
    425     return rv;
    426   *max_token_length = token_length;
    427   return OK;
    428 }
    429 
    430 }  // namespace net
    431