1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // See "SSPI Sample Application" at 6 // http://msdn.microsoft.com/en-us/library/aa918273.aspx 7 8 #include "net/http/http_auth_sspi_win.h" 9 10 #include "base/base64.h" 11 #include "base/logging.h" 12 #include "base/strings/string_util.h" 13 #include "base/strings/utf_string_conversions.h" 14 #include "net/base/net_errors.h" 15 #include "net/http/http_auth.h" 16 #include "net/http/http_auth_challenge_tokenizer.h" 17 18 namespace net { 19 20 namespace { 21 22 int MapAcquireCredentialsStatusToError(SECURITY_STATUS status, 23 const SEC_WCHAR* package) { 24 VLOG(1) << "AcquireCredentialsHandle returned 0x" << std::hex << status; 25 switch (status) { 26 case SEC_E_OK: 27 return OK; 28 case SEC_E_INSUFFICIENT_MEMORY: 29 return ERR_OUT_OF_MEMORY; 30 case SEC_E_INTERNAL_ERROR: 31 LOG(WARNING) 32 << "AcquireCredentialsHandle returned unexpected status 0x" 33 << std::hex << status; 34 return ERR_UNEXPECTED_SECURITY_LIBRARY_STATUS; 35 case SEC_E_NO_CREDENTIALS: 36 case SEC_E_NOT_OWNER: 37 case SEC_E_UNKNOWN_CREDENTIALS: 38 return ERR_INVALID_AUTH_CREDENTIALS; 39 case SEC_E_SECPKG_NOT_FOUND: 40 // This indicates that the SSPI configuration does not match expectations 41 return ERR_UNSUPPORTED_AUTH_SCHEME; 42 default: 43 LOG(WARNING) 44 << "AcquireCredentialsHandle returned undocumented status 0x" 45 << std::hex << status; 46 return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS; 47 } 48 } 49 50 int AcquireExplicitCredentials(SSPILibrary* library, 51 const SEC_WCHAR* package, 52 const base::string16& domain, 53 const base::string16& user, 54 const base::string16& password, 55 CredHandle* cred) { 56 SEC_WINNT_AUTH_IDENTITY identity; 57 identity.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE; 58 identity.User = 59 reinterpret_cast<unsigned short*>(const_cast<wchar_t*>(user.c_str())); 60 identity.UserLength = user.size(); 61 identity.Domain = 62 reinterpret_cast<unsigned short*>(const_cast<wchar_t*>(domain.c_str())); 63 identity.DomainLength = domain.size(); 64 identity.Password = 65 reinterpret_cast<unsigned short*>(const_cast<wchar_t*>(password.c_str())); 66 identity.PasswordLength = password.size(); 67 68 TimeStamp expiry; 69 70 // Pass the username/password to get the credentials handle. 71 SECURITY_STATUS status = library->AcquireCredentialsHandle( 72 NULL, // pszPrincipal 73 const_cast<SEC_WCHAR*>(package), // pszPackage 74 SECPKG_CRED_OUTBOUND, // fCredentialUse 75 NULL, // pvLogonID 76 &identity, // pAuthData 77 NULL, // pGetKeyFn (not used) 78 NULL, // pvGetKeyArgument (not used) 79 cred, // phCredential 80 &expiry); // ptsExpiry 81 82 return MapAcquireCredentialsStatusToError(status, package); 83 } 84 85 int AcquireDefaultCredentials(SSPILibrary* library, const SEC_WCHAR* package, 86 CredHandle* cred) { 87 TimeStamp expiry; 88 89 // Pass the username/password to get the credentials handle. 90 // Note: Since the 5th argument is NULL, it uses the default 91 // cached credentials for the logged in user, which can be used 92 // for a single sign-on. 93 SECURITY_STATUS status = library->AcquireCredentialsHandle( 94 NULL, // pszPrincipal 95 const_cast<SEC_WCHAR*>(package), // pszPackage 96 SECPKG_CRED_OUTBOUND, // fCredentialUse 97 NULL, // pvLogonID 98 NULL, // pAuthData 99 NULL, // pGetKeyFn (not used) 100 NULL, // pvGetKeyArgument (not used) 101 cred, // phCredential 102 &expiry); // ptsExpiry 103 104 return MapAcquireCredentialsStatusToError(status, package); 105 } 106 107 int MapInitializeSecurityContextStatusToError(SECURITY_STATUS status) { 108 VLOG(1) << "InitializeSecurityContext returned 0x" << std::hex << status; 109 switch (status) { 110 case SEC_E_OK: 111 case SEC_I_CONTINUE_NEEDED: 112 return OK; 113 case SEC_I_COMPLETE_AND_CONTINUE: 114 case SEC_I_COMPLETE_NEEDED: 115 case SEC_I_INCOMPLETE_CREDENTIALS: 116 case SEC_E_INCOMPLETE_MESSAGE: 117 case SEC_E_INTERNAL_ERROR: 118 // These are return codes reported by InitializeSecurityContext 119 // but not expected by Chrome (for example, INCOMPLETE_CREDENTIALS 120 // and INCOMPLETE_MESSAGE are intended for schannel). 121 LOG(WARNING) 122 << "InitializeSecurityContext returned unexpected status 0x" 123 << std::hex << status; 124 return ERR_UNEXPECTED_SECURITY_LIBRARY_STATUS; 125 case SEC_E_INSUFFICIENT_MEMORY: 126 return ERR_OUT_OF_MEMORY; 127 case SEC_E_UNSUPPORTED_FUNCTION: 128 NOTREACHED(); 129 return ERR_UNEXPECTED; 130 case SEC_E_INVALID_HANDLE: 131 NOTREACHED(); 132 return ERR_INVALID_HANDLE; 133 case SEC_E_INVALID_TOKEN: 134 return ERR_INVALID_RESPONSE; 135 case SEC_E_LOGON_DENIED: 136 return ERR_ACCESS_DENIED; 137 case SEC_E_NO_CREDENTIALS: 138 case SEC_E_WRONG_PRINCIPAL: 139 return ERR_INVALID_AUTH_CREDENTIALS; 140 case SEC_E_NO_AUTHENTICATING_AUTHORITY: 141 case SEC_E_TARGET_UNKNOWN: 142 return ERR_MISCONFIGURED_AUTH_ENVIRONMENT; 143 default: 144 LOG(WARNING) 145 << "InitializeSecurityContext returned undocumented status 0x" 146 << std::hex << status; 147 return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS; 148 } 149 } 150 151 int MapQuerySecurityPackageInfoStatusToError(SECURITY_STATUS status) { 152 VLOG(1) << "QuerySecurityPackageInfo returned 0x" << std::hex << status; 153 switch (status) { 154 case SEC_E_OK: 155 return OK; 156 case SEC_E_SECPKG_NOT_FOUND: 157 // This isn't a documented return code, but has been encountered 158 // during testing. 159 return ERR_UNSUPPORTED_AUTH_SCHEME; 160 default: 161 LOG(WARNING) 162 << "QuerySecurityPackageInfo returned undocumented status 0x" 163 << std::hex << status; 164 return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS; 165 } 166 } 167 168 int MapFreeContextBufferStatusToError(SECURITY_STATUS status) { 169 VLOG(1) << "FreeContextBuffer returned 0x" << std::hex << status; 170 switch (status) { 171 case SEC_E_OK: 172 return OK; 173 default: 174 // The documentation at 175 // http://msdn.microsoft.com/en-us/library/aa375416(VS.85).aspx 176 // only mentions that a non-zero (or non-SEC_E_OK) value is returned 177 // if the function fails, and does not indicate what the failure 178 // conditions are. 179 LOG(WARNING) 180 << "FreeContextBuffer returned undocumented status 0x" 181 << std::hex << status; 182 return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS; 183 } 184 } 185 186 } // anonymous namespace 187 188 HttpAuthSSPI::HttpAuthSSPI(SSPILibrary* library, 189 const std::string& scheme, 190 const SEC_WCHAR* security_package, 191 ULONG max_token_length) 192 : library_(library), 193 scheme_(scheme), 194 security_package_(security_package), 195 max_token_length_(max_token_length), 196 can_delegate_(false) { 197 DCHECK(library_); 198 SecInvalidateHandle(&cred_); 199 SecInvalidateHandle(&ctxt_); 200 } 201 202 HttpAuthSSPI::~HttpAuthSSPI() { 203 ResetSecurityContext(); 204 if (SecIsValidHandle(&cred_)) { 205 library_->FreeCredentialsHandle(&cred_); 206 SecInvalidateHandle(&cred_); 207 } 208 } 209 210 bool HttpAuthSSPI::NeedsIdentity() const { 211 return decoded_server_auth_token_.empty(); 212 } 213 214 bool HttpAuthSSPI::AllowsExplicitCredentials() const { 215 return true; 216 } 217 218 void HttpAuthSSPI::Delegate() { 219 can_delegate_ = true; 220 } 221 222 void HttpAuthSSPI::ResetSecurityContext() { 223 if (SecIsValidHandle(&ctxt_)) { 224 library_->DeleteSecurityContext(&ctxt_); 225 SecInvalidateHandle(&ctxt_); 226 } 227 } 228 229 HttpAuth::AuthorizationResult HttpAuthSSPI::ParseChallenge( 230 HttpAuthChallengeTokenizer* tok) { 231 // Verify the challenge's auth-scheme. 232 if (!LowerCaseEqualsASCII(tok->scheme(), StringToLowerASCII(scheme_).c_str())) 233 return HttpAuth::AUTHORIZATION_RESULT_INVALID; 234 235 std::string encoded_auth_token = tok->base64_param(); 236 if (encoded_auth_token.empty()) { 237 // If a context has already been established, an empty challenge 238 // should be treated as a rejection of the current attempt. 239 if (SecIsValidHandle(&ctxt_)) 240 return HttpAuth::AUTHORIZATION_RESULT_REJECT; 241 DCHECK(decoded_server_auth_token_.empty()); 242 return HttpAuth::AUTHORIZATION_RESULT_ACCEPT; 243 } else { 244 // If a context has not already been established, additional tokens should 245 // not be present in the auth challenge. 246 if (!SecIsValidHandle(&ctxt_)) 247 return HttpAuth::AUTHORIZATION_RESULT_INVALID; 248 } 249 250 std::string decoded_auth_token; 251 bool base64_rv = base::Base64Decode(encoded_auth_token, &decoded_auth_token); 252 if (!base64_rv) 253 return HttpAuth::AUTHORIZATION_RESULT_INVALID; 254 decoded_server_auth_token_ = decoded_auth_token; 255 return HttpAuth::AUTHORIZATION_RESULT_ACCEPT; 256 } 257 258 int HttpAuthSSPI::GenerateAuthToken(const AuthCredentials* credentials, 259 const std::string& spn, 260 std::string* auth_token) { 261 // Initial challenge. 262 if (!SecIsValidHandle(&cred_)) { 263 int rv = OnFirstRound(credentials); 264 if (rv != OK) 265 return rv; 266 } 267 268 DCHECK(SecIsValidHandle(&cred_)); 269 void* out_buf; 270 int out_buf_len; 271 int rv = GetNextSecurityToken( 272 spn, 273 static_cast<void *>(const_cast<char *>( 274 decoded_server_auth_token_.c_str())), 275 decoded_server_auth_token_.length(), 276 &out_buf, 277 &out_buf_len); 278 if (rv != OK) 279 return rv; 280 281 // Base64 encode data in output buffer and prepend the scheme. 282 std::string encode_input(static_cast<char*>(out_buf), out_buf_len); 283 std::string encode_output; 284 base::Base64Encode(encode_input, &encode_output); 285 // OK, we are done with |out_buf| 286 free(out_buf); 287 *auth_token = scheme_ + " " + encode_output; 288 return OK; 289 } 290 291 int HttpAuthSSPI::OnFirstRound(const AuthCredentials* credentials) { 292 DCHECK(!SecIsValidHandle(&cred_)); 293 int rv = OK; 294 if (credentials) { 295 base::string16 domain; 296 base::string16 user; 297 SplitDomainAndUser(credentials->username(), &domain, &user); 298 rv = AcquireExplicitCredentials(library_, security_package_, domain, 299 user, credentials->password(), &cred_); 300 if (rv != OK) 301 return rv; 302 } else { 303 rv = AcquireDefaultCredentials(library_, security_package_, &cred_); 304 if (rv != OK) 305 return rv; 306 } 307 308 return rv; 309 } 310 311 int HttpAuthSSPI::GetNextSecurityToken( 312 const std::string& spn, 313 const void* in_token, 314 int in_token_len, 315 void** out_token, 316 int* out_token_len) { 317 CtxtHandle* ctxt_ptr; 318 SecBufferDesc in_buffer_desc, out_buffer_desc; 319 SecBufferDesc* in_buffer_desc_ptr; 320 SecBuffer in_buffer, out_buffer; 321 322 if (in_token_len > 0) { 323 // Prepare input buffer. 324 in_buffer_desc.ulVersion = SECBUFFER_VERSION; 325 in_buffer_desc.cBuffers = 1; 326 in_buffer_desc.pBuffers = &in_buffer; 327 in_buffer.BufferType = SECBUFFER_TOKEN; 328 in_buffer.cbBuffer = in_token_len; 329 in_buffer.pvBuffer = const_cast<void*>(in_token); 330 ctxt_ptr = &ctxt_; 331 in_buffer_desc_ptr = &in_buffer_desc; 332 } else { 333 // If there is no input token, then we are starting a new authentication 334 // sequence. If we have already initialized our security context, then 335 // we're incorrectly reusing the auth handler for a new sequence. 336 if (SecIsValidHandle(&ctxt_)) { 337 NOTREACHED(); 338 return ERR_UNEXPECTED; 339 } 340 ctxt_ptr = NULL; 341 in_buffer_desc_ptr = NULL; 342 } 343 344 // Prepare output buffer. 345 out_buffer_desc.ulVersion = SECBUFFER_VERSION; 346 out_buffer_desc.cBuffers = 1; 347 out_buffer_desc.pBuffers = &out_buffer; 348 out_buffer.BufferType = SECBUFFER_TOKEN; 349 out_buffer.cbBuffer = max_token_length_; 350 out_buffer.pvBuffer = malloc(out_buffer.cbBuffer); 351 if (!out_buffer.pvBuffer) 352 return ERR_OUT_OF_MEMORY; 353 354 DWORD context_flags = 0; 355 // Firefox only sets ISC_REQ_DELEGATE, but MSDN documentation indicates that 356 // ISC_REQ_MUTUAL_AUTH must also be set. 357 if (can_delegate_) 358 context_flags |= (ISC_REQ_DELEGATE | ISC_REQ_MUTUAL_AUTH); 359 360 // This returns a token that is passed to the remote server. 361 DWORD context_attribute; 362 std::wstring spn_wide = base::ASCIIToWide(spn); 363 SECURITY_STATUS status = library_->InitializeSecurityContext( 364 &cred_, // phCredential 365 ctxt_ptr, // phContext 366 const_cast<wchar_t *>(spn_wide.c_str()), // pszTargetName 367 context_flags, // fContextReq 368 0, // Reserved1 (must be 0) 369 SECURITY_NATIVE_DREP, // TargetDataRep 370 in_buffer_desc_ptr, // pInput 371 0, // Reserved2 (must be 0) 372 &ctxt_, // phNewContext 373 &out_buffer_desc, // pOutput 374 &context_attribute, // pfContextAttr 375 NULL); // ptsExpiry 376 int rv = MapInitializeSecurityContextStatusToError(status); 377 if (rv != OK) { 378 ResetSecurityContext(); 379 free(out_buffer.pvBuffer); 380 return rv; 381 } 382 if (!out_buffer.cbBuffer) { 383 free(out_buffer.pvBuffer); 384 out_buffer.pvBuffer = NULL; 385 } 386 *out_token = out_buffer.pvBuffer; 387 *out_token_len = out_buffer.cbBuffer; 388 return OK; 389 } 390 391 void SplitDomainAndUser(const base::string16& combined, 392 base::string16* domain, 393 base::string16* user) { 394 // |combined| may be in the form "user" or "DOMAIN\user". 395 // Separate the two parts if they exist. 396 // TODO(cbentzel): I believe user@domain is also a valid form. 397 size_t backslash_idx = combined.find(L'\\'); 398 if (backslash_idx == base::string16::npos) { 399 domain->clear(); 400 *user = combined; 401 } else { 402 *domain = combined.substr(0, backslash_idx); 403 *user = combined.substr(backslash_idx + 1); 404 } 405 } 406 407 int DetermineMaxTokenLength(SSPILibrary* library, 408 const std::wstring& package, 409 ULONG* max_token_length) { 410 DCHECK(library); 411 DCHECK(max_token_length); 412 PSecPkgInfo pkg_info = NULL; 413 SECURITY_STATUS status = library->QuerySecurityPackageInfo( 414 const_cast<wchar_t *>(package.c_str()), &pkg_info); 415 int rv = MapQuerySecurityPackageInfoStatusToError(status); 416 if (rv != OK) 417 return rv; 418 int token_length = pkg_info->cbMaxToken; 419 status = library->FreeContextBuffer(pkg_info); 420 rv = MapFreeContextBufferStatusToError(status); 421 if (rv != OK) 422 return rv; 423 *max_token_length = token_length; 424 return OK; 425 } 426 427 } // namespace net 428
