http_auth.h 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_HTTP_HTTP_AUTH_H_
  5. #define NET_HTTP_HTTP_AUTH_H_
  6. #include <memory>
  7. #include <set>
  8. #include <string>
  9. #include "net/base/auth.h"
  10. #include "net/base/net_export.h"
  11. template <class T> class scoped_refptr;
  12. namespace base {
  13. class Value;
  14. }
  15. namespace url {
  16. class SchemeHostPort;
  17. }
  18. namespace net {
  19. class HttpAuthHandler;
  20. class HttpAuthHandlerFactory;
  21. class HttpResponseHeaders;
  22. class HostResolver;
  23. class NetLogWithSource;
  24. class NetworkIsolationKey;
  25. class SSLInfo;
  26. // Utility class for http authentication.
  27. class NET_EXPORT_PRIVATE HttpAuth {
  28. public:
  29. // Http authentication can be done to the proxy server, origin server,
  30. // or both. This enum tracks who the target is.
  31. enum Target {
  32. AUTH_NONE = -1,
  33. // We depend on the valid targets (!= AUTH_NONE) being usable as indexes
  34. // in an array, so start from 0.
  35. AUTH_PROXY = 0,
  36. AUTH_SERVER = 1,
  37. AUTH_NUM_TARGETS = 2,
  38. };
  39. // What the HTTP WWW-Authenticate/Proxy-Authenticate headers indicate about
  40. // the previous authorization attempt.
  41. enum AuthorizationResult {
  42. AUTHORIZATION_RESULT_ACCEPT, // The authorization attempt was accepted,
  43. // although there still may be additional
  44. // rounds of challenges.
  45. AUTHORIZATION_RESULT_REJECT, // The authorization attempt was rejected.
  46. AUTHORIZATION_RESULT_STALE, // (Digest) The nonce used in the
  47. // authorization attempt is stale, but
  48. // otherwise the attempt was valid.
  49. AUTHORIZATION_RESULT_INVALID, // The authentication challenge headers are
  50. // poorly formed (the authorization attempt
  51. // itself may have been fine).
  52. AUTHORIZATION_RESULT_DIFFERENT_REALM, // The authorization
  53. // attempt was rejected,
  54. // but the realm associated
  55. // with the new challenge
  56. // is different from the
  57. // previous attempt.
  58. };
  59. // Describes where the identity used for authentication came from.
  60. enum IdentitySource {
  61. // Came from nowhere -- the identity is not initialized.
  62. IDENT_SRC_NONE,
  63. // The identity came from the auth cache, by doing a path-based
  64. // lookup (premptive authorization).
  65. IDENT_SRC_PATH_LOOKUP,
  66. // The identity was extracted from a URL of the form:
  67. // http://<username>:<password>@host:port
  68. IDENT_SRC_URL,
  69. // The identity was retrieved from the auth cache, by doing a
  70. // realm lookup.
  71. IDENT_SRC_REALM_LOOKUP,
  72. // The identity was provided by RestartWithAuth -- it likely
  73. // came from a prompt (or maybe the password manager).
  74. IDENT_SRC_EXTERNAL,
  75. // The identity used the default credentials for the computer,
  76. // on schemes that support single sign-on.
  77. IDENT_SRC_DEFAULT_CREDENTIALS,
  78. };
  79. // Identifier for auth scheme.
  80. //
  81. // The values are used for calculating UMA buckets. Add but don't remove or
  82. // reuse.
  83. enum Scheme {
  84. AUTH_SCHEME_BASIC = 0,
  85. AUTH_SCHEME_DIGEST,
  86. AUTH_SCHEME_NTLM,
  87. AUTH_SCHEME_NEGOTIATE,
  88. AUTH_SCHEME_SPDYPROXY, // No longer used.
  89. AUTH_SCHEME_MOCK,
  90. AUTH_SCHEME_MAX,
  91. };
  92. // Type of Kerberos credentials delegation to be performed during
  93. // authentication.
  94. enum class DelegationType {
  95. // Disallow delegation.
  96. kNone,
  97. // Delegate if approved by KDC policy. Implemented in GSSAPI.
  98. kByKdcPolicy,
  99. // Unconstrained delegation. On Windows, both kByKdcPolicy and
  100. // kUnconstrained will check KDC policy.
  101. kUnconstrained,
  102. };
  103. // Helper structure used by HttpNetworkTransaction to track
  104. // the current identity being used for authorization.
  105. struct Identity {
  106. Identity();
  107. IdentitySource source = IDENT_SRC_NONE;
  108. bool invalid = true;
  109. AuthCredentials credentials;
  110. };
  111. // Get the name of the header containing the auth challenge
  112. // (either WWW-Authenticate or Proxy-Authenticate).
  113. static std::string GetChallengeHeaderName(Target target);
  114. // Get the name of the header where the credentials go
  115. // (either Authorization or Proxy-Authorization).
  116. static std::string GetAuthorizationHeaderName(Target target);
  117. // Returns a string representation of a Target value that can be used in log
  118. // messages.
  119. static std::string GetAuthTargetString(Target target);
  120. // Returns a string representation of an authentication Scheme.
  121. static const char* SchemeToString(Scheme scheme);
  122. // Returns an authentication Scheme from a string which was produced by
  123. // SchemeToString().
  124. static Scheme StringToScheme(const std::string& str);
  125. // Returns a string representation of an authorization result.
  126. static const char* AuthorizationResultToString(
  127. AuthorizationResult authorization_result);
  128. // Returns a value for logging an authorization result to a NetLog.
  129. static base::Value NetLogAuthorizationResultParams(
  130. const char* name,
  131. AuthorizationResult authorization_result);
  132. // Iterate through |response_headers|, and pick the best one that we support.
  133. // Obtains the implementation class for handling the challenge, and passes it
  134. // back in |*handler|. If no supported challenge was found, |*handler| is set
  135. // to nullptr.
  136. //
  137. // |disabled_schemes| is the set of schemes that we should not use.
  138. //
  139. // |scheme_host_port| is used by the NTLM and Negotiation authentication
  140. // scheme to construct the service principal name. It is ignored by other
  141. // schemes.
  142. //
  143. // |ssl_info| is passed through to the scheme specific authentication handlers
  144. // to use as appropriate.
  145. static void ChooseBestChallenge(
  146. HttpAuthHandlerFactory* http_auth_handler_factory,
  147. const HttpResponseHeaders& response_headers,
  148. const SSLInfo& ssl_info,
  149. const NetworkIsolationKey& network_isolation_key,
  150. Target target,
  151. const url::SchemeHostPort& scheme_host_port,
  152. const std::set<Scheme>& disabled_schemes,
  153. const NetLogWithSource& net_log,
  154. HostResolver* host_resolver,
  155. std::unique_ptr<HttpAuthHandler>* handler);
  156. // Handle a 401/407 response from a server/proxy after a previous
  157. // authentication attempt. For connection-based authentication schemes, the
  158. // new response may be another round in a multi-round authentication sequence.
  159. // For request-based schemes, a 401/407 response is typically treated like a
  160. // rejection of the previous challenge, except in the Digest case when a
  161. // "stale" attribute is present.
  162. //
  163. // |handler| must be non-nullptr, and is the HttpAuthHandler from the previous
  164. // authentication round.
  165. //
  166. // |response_headers| must contain the new HTTP response.
  167. //
  168. // |target| specifies whether the authentication challenge response came
  169. // from a server or a proxy.
  170. //
  171. // |disabled_schemes| are the authentication schemes to ignore.
  172. //
  173. // |challenge_used| is the text of the authentication challenge used in
  174. // support of the returned AuthorizationResult. If no headers were used for
  175. // the result (for example, all headers have unknown authentication schemes),
  176. // the value is cleared.
  177. static AuthorizationResult HandleChallengeResponse(
  178. HttpAuthHandler* handler,
  179. const HttpResponseHeaders& response_headers,
  180. Target target,
  181. const std::set<Scheme>& disabled_schemes,
  182. std::string* challenge_used);
  183. };
  184. } // namespace net
  185. #endif // NET_HTTP_HTTP_AUTH_H_