4 * DEBUG: section 29 Negotiate Authenticator
5 * AUTHOR: Robert Collins, Henrik Nordstrom, Francesco Chemolli
7 * SQUID Web Proxy Cache http://www.squid-cache.org/
8 * ----------------------------------------------------------
10 * Squid is the result of efforts by numerous individuals from
11 * the Internet community; see the CONTRIBUTORS file for full
12 * details. Many organizations have provided support for Squid's
13 * development; see the SPONSORS file for full details. Squid is
14 * Copyrighted (C) 2001 by the Regents of the University of
15 * California; see the COPYRIGHT file for full details. Squid
16 * incorporates software developed and/or copyrighted by other
17 * sources; see the CREDITS file for full details.
19 * This program is free software; you can redistribute it and/or modify
20 * it under the terms of the GNU General Public License as published by
21 * the Free Software Foundation; either version 2 of the License, or
22 * (at your option) any later version.
24 * This program is distributed in the hope that it will be useful,
25 * but WITHOUT ANY WARRANTY; without even the implied warranty of
26 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27 * GNU General Public License for more details.
29 * You should have received a copy of the GNU General Public License
30 * along with this program; if not, write to the Free Software
31 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
35 /* The functions in this file handle authentication.
36 * They DO NOT perform access control or auditing.
37 * See acl.c for access control and client_side.c for auditing */
41 #include "auth_negotiate.h"
42 #include "auth/Gadgets.h"
43 #include "CacheManager.h"
45 #include "client_side.h"
46 #include "HttpReply.h"
47 #include "HttpRequest.h"
48 #include "SquidTime.h"
49 /** \todo remove this include */
50 #include "negotiateScheme.h"
54 \defgroup AuthNegotiateInternal Negotiate Authenticator Internals
55 \ingroup AuthNegotiateAPI
59 * Maximum length (buffer size) for token strings.
61 // AYJ: must match re-definition in helpers/negotiate_auth/squid_kerb_auth/squid_kerb_auth.c
62 #define MAX_AUTHTOKEN_LEN 32768
65 /// \ingroup AuthNegotiateInternal
67 authenticateStateFree(authenticateStateData
* r
)
69 AUTHUSERREQUESTUNLOCK(r
->auth_user_request
, "r");
73 /* Negotiate Scheme */
74 static HLPSCB authenticateNegotiateHandleReply
;
75 static AUTHSSTATS authenticateNegotiateStats
;
77 /// \ingroup AuthNegotiateInternal
78 static statefulhelper
*negotiateauthenticators
= NULL
;
80 CBDATA_TYPE(authenticateStateData
);
82 /// \ingroup AuthNegotiateInternal
83 static int authnegotiate_initialised
= 0;
85 /// \ingroup AuthNegotiateInternal
86 static auth_negotiate_config negotiateConfig
;
88 /// \ingroup AuthNegotiateInternal
89 static hash_table
*proxy_auth_cache
= NULL
;
98 \ingroup AuthNegotiateInternal
99 \todo move to negotiateScheme.cc
102 negotiateScheme::done()
104 /* TODO: this should be a Config call. */
105 debugs(29, 2, "negotiateScheme::done: shutting down Negotiate authentication.");
107 if (negotiateauthenticators
)
108 helperStatefulShutdown(negotiateauthenticators
);
110 authnegotiate_initialised
= 0;
115 if (negotiateauthenticators
)
116 helperStatefulFree(negotiateauthenticators
);
118 negotiateauthenticators
= NULL
;
120 debugs(29, 2, "negotiateScheme::done: Negotiate authentication Shutdown.");
124 AuthNegotiateConfig::done()
127 wordlistDestroy(&authenticate
);
131 AuthNegotiateConfig::dump(StoreEntry
* entry
, const char *name
, AuthConfig
* scheme
)
133 wordlist
*list
= authenticate
;
134 storeAppendPrintf(entry
, "%s %s", name
, "negotiate");
136 while (list
!= NULL
) {
137 storeAppendPrintf(entry
, " %s", list
->key
);
141 storeAppendPrintf(entry
, "\n%s negotiate children %d\n",
142 name
, authenticateChildren
);
143 storeAppendPrintf(entry
, "%s %s keep_alive %s\n", name
, "negotiate", keep_alive
? "on" : "off");
147 AuthNegotiateConfig::AuthNegotiateConfig() : authenticateChildren(5), keep_alive(1)
151 AuthNegotiateConfig::parse(AuthConfig
* scheme
, int n_configured
, char *param_str
)
153 if (strcasecmp(param_str
, "program") == 0) {
155 wordlistDestroy(&authenticate
);
157 parse_wordlist(&authenticate
);
159 requirePathnameExists("auth_param negotiate program", authenticate
->key
);
160 } else if (strcasecmp(param_str
, "children") == 0) {
161 parse_int(&authenticateChildren
);
162 } else if (strcasecmp(param_str
, "keep_alive") == 0) {
163 parse_onoff(&keep_alive
);
165 debugs(29, 0, "AuthNegotiateConfig::parse: unrecognised negotiate auth scheme parameter '" << param_str
<< "'");
169 * disable client side request pipelining. There is a race with
170 * Negotiate when the client sends a second request on an Negotiate
171 * connection before the authenticate challenge is sent. With
172 * this patch, the client may fail to authenticate, but squid's
173 * state will be preserved. Caveats: this should be a post-parse
174 * test, but that can wait for the modular parser to be integrated.
177 Config
.onoff
.pipeline_prefetch
= 0;
181 AuthNegotiateConfig::type() const
183 return negotiateScheme::GetInstance().type();
187 * Initialize helpers and the like for this auth scheme.
188 * Called AFTER parsing the config file
191 AuthNegotiateConfig::init(AuthConfig
* scheme
)
195 authnegotiate_initialised
= 1;
197 if (negotiateauthenticators
== NULL
)
198 negotiateauthenticators
= helperStatefulCreate("negotiateauthenticator");
200 if (!proxy_auth_cache
)
201 proxy_auth_cache
= hash_create((HASHCMP
*) strcmp
, 7921, hash_string
);
203 assert(proxy_auth_cache
);
205 negotiateauthenticators
->cmdline
= authenticate
;
207 negotiateauthenticators
->n_to_start
= authenticateChildren
;
209 negotiateauthenticators
->ipc_type
= IPC_STREAM
;
211 helperStatefulOpenServers(negotiateauthenticators
);
213 CBDATA_INIT_TYPE(authenticateStateData
);
218 AuthNegotiateConfig::registerWithCacheManager(void)
220 CacheManager::GetInstance()->
221 registerAction("negotiateauthenticator",
222 "Negotiate User Authenticator Stats",
223 authenticateNegotiateStats
, 0, 1);
227 AuthNegotiateConfig::active() const
229 return authnegotiate_initialised
== 1;
233 AuthNegotiateConfig::configured() const
235 if ((authenticate
!= NULL
) && (authenticateChildren
!= 0)) {
236 debugs(29, 9, "AuthNegotiateConfig::configured: returning configured");
240 debugs(29, 9, "AuthNegotiateConfig::configured: returning unconfigured");
244 /* Negotiate Scheme */
245 /* See AuthUserRequest.cc::authenticateDirection for return values */
247 AuthNegotiateUserRequest::module_direction()
249 /* null auth_user is checked for by authenticateDirection */
251 if (waiting
|| client_blob
)
252 return -1; /* need helper response to continue */
254 switch (auth_state
) {
256 /* no progress at all. */
258 case AUTHENTICATE_STATE_NONE
:
259 debugs(29, 1, "AuthNegotiateUserRequest::direction: called before Negotiate Authenticate for request " << this << "!. Report a bug to squid-dev.");
260 return -2; /* error */
262 case AUTHENTICATE_STATE_FAILED
:
263 return -2; /* error */
266 case AUTHENTICATE_STATE_IN_PROGRESS
:
268 return 1; /* send to client */
270 case AUTHENTICATE_STATE_DONE
:
271 return 0; /* do nothing */
273 case AUTHENTICATE_STATE_INITIAL
:
274 debugs(29, 1, "AuthNegotiateUserRequest::direction: Unexpected AUTHENTICATE_STATE_INITIAL");
281 /* add the [proxy]authorisation header */
283 AuthNegotiateUserRequest::addHeader(HttpReply
* rep
, int accel
)
290 /* don't add to authentication error pages */
292 if ((!accel
&& rep
->sline
.status
== HTTP_PROXY_AUTHENTICATION_REQUIRED
)
293 || (accel
&& rep
->sline
.status
== HTTP_UNAUTHORIZED
))
296 type
= accel
? HDR_AUTHENTICATION_INFO
: HDR_PROXY_AUTHENTICATION_INFO
;
298 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate %s", server_blob
);
300 safe_free(server_blob
);
304 AuthNegotiateConfig::fixHeader(AuthUserRequest
*auth_user_request
, HttpReply
*rep
, http_hdr_type type
, HttpRequest
* request
)
306 AuthNegotiateUserRequest
*negotiate_request
;
311 /* Need keep-alive */
312 if (!request
->flags
.proxy_keepalive
&& request
->flags
.must_keepalive
)
315 /* New request, no user details */
316 if (auth_user_request
== NULL
) {
317 debugs(29, 9, "AuthNegotiateConfig::fixHeader: Sending type:" << type
<< " header: 'Negotiate'");
318 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate");
321 /* drop the connection */
322 rep
->header
.delByName("keep-alive");
323 request
->flags
.proxy_keepalive
= 0;
326 negotiate_request
= dynamic_cast<AuthNegotiateUserRequest
*>(auth_user_request
);
328 assert(negotiate_request
!= NULL
);
330 switch (negotiate_request
->auth_state
) {
332 case AUTHENTICATE_STATE_FAILED
:
333 /* here it makes sense to drop the connection, as auth is
334 * tied to it, even if MAYBE the client could handle it - Kinkie */
335 rep
->header
.delByName("keep-alive");
336 request
->flags
.proxy_keepalive
= 0;
339 case AUTHENTICATE_STATE_DONE
:
340 /* Special case: authentication finished OK but disallowed by ACL.
341 * Need to start over to give the client another chance.
344 if (negotiate_request
->server_blob
) {
345 debugs(29, 9, "authenticateNegotiateFixErrorHeader: Sending type:" << type
<< " header: 'Negotiate " << negotiate_request
->server_blob
<< "'");
346 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate %s", negotiate_request
->server_blob
);
347 safe_free(negotiate_request
->server_blob
);
349 debugs(29, 9, "authenticateNegotiateFixErrorHeader: Connection authenticated");
350 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate");
355 case AUTHENTICATE_STATE_NONE
:
356 /* semantic change: do not drop the connection.
357 * 2.5 implementation used to keep it open - Kinkie */
358 debugs(29, 9, "AuthNegotiateConfig::fixHeader: Sending type:" << type
<< " header: 'Negotiate'");
359 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate");
362 case AUTHENTICATE_STATE_IN_PROGRESS
:
363 /* we're waiting for a response from the client. Pass it the blob */
364 debugs(29, 9, "AuthNegotiateConfig::fixHeader: Sending type:" << type
<< " header: 'Negotiate " << negotiate_request
->server_blob
<< "'");
365 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate %s", negotiate_request
->server_blob
);
366 safe_free(negotiate_request
->server_blob
);
371 debugs(29, 0, "AuthNegotiateConfig::fixHeader: state " << negotiate_request
->auth_state
<< ".");
372 fatal("unexpected state in AuthenticateNegotiateFixErrorHeader.\n");
377 NegotiateUser::~NegotiateUser()
379 debugs(29, 5, "NegotiateUser::~NegotiateUser: doing nothing to clearNegotiate scheme data for '" << this << "'");
383 authenticateNegotiateHandleReply(void *data
, void *lastserver
, char *reply
)
385 authenticateStateData
*r
= static_cast<authenticateStateData
*>(data
);
388 char *blob
, *arg
= NULL
;
390 AuthUserRequest
*auth_user_request
;
392 NegotiateUser
*negotiate_user
;
393 AuthNegotiateUserRequest
*negotiate_request
;
395 debugs(29, 8, "authenticateNegotiateHandleReply: helper: '" << lastserver
<< "' sent us '" << (reply
? reply
: "<NULL>") << "'");
396 valid
= cbdataReferenceValid(r
->data
);
399 debugs(29, 1, "authenticateNegotiateHandleReply: invalid callback data. helper '" << lastserver
<< "'.");
400 cbdataReferenceDone(r
->data
);
401 authenticateStateFree(r
);
406 debugs(29, 1, "authenticateNegotiateHandleReply: Helper '" << lastserver
<< "' crashed!.");
407 reply
= (char *)"BH Internal error";
410 auth_user_request
= r
->auth_user_request
;
411 assert(auth_user_request
!= NULL
);
412 negotiate_request
= dynamic_cast<AuthNegotiateUserRequest
*>(auth_user_request
);
414 assert(negotiate_request
!= NULL
);
415 assert(negotiate_request
->waiting
);
416 negotiate_request
->waiting
= 0;
417 safe_free(negotiate_request
->client_blob
);
419 auth_user
= negotiate_request
->user();
420 assert(auth_user
!= NULL
);
421 assert(auth_user
->auth_type
== AUTH_NEGOTIATE
);
422 negotiate_user
= dynamic_cast<negotiate_user_t
*>(auth_user_request
->user());
424 assert(negotiate_user
!= NULL
);
426 if (negotiate_request
->authserver
== NULL
)
427 negotiate_request
->authserver
= static_cast<helper_stateful_server
*>(lastserver
);
429 assert(negotiate_request
->authserver
== lastserver
);
431 /* seperate out the useful data */
432 blob
= strchr(reply
, ' ');
436 arg
= strchr(blob
+ 1, ' ');
441 if (strncasecmp(reply
, "TT ", 3) == 0) {
442 /* we have been given a blob to send to the client */
445 safe_free(negotiate_request
->server_blob
);
446 negotiate_request
->request
->flags
.must_keepalive
= 1;
447 if (negotiate_request
->request
->flags
.proxy_keepalive
) {
448 negotiate_request
->server_blob
= xstrdup(blob
);
449 negotiate_request
->auth_state
= AUTHENTICATE_STATE_IN_PROGRESS
;
450 auth_user_request
->denyMessage("Authentication in progress");
451 debugs(29, 4, "authenticateNegotiateHandleReply: Need to challenge the client with a server blob '" << blob
<< "'");
453 negotiate_request
->auth_state
= AUTHENTICATE_STATE_FAILED
;
454 auth_user_request
->denyMessage("NTLM authentication requires a persistent connection");
456 } else if (strncasecmp(reply
, "AF ", 3) == 0 && arg
!= NULL
) {
457 /* we're finished, release the helper */
462 negotiate_user
->username(arg
);
464 auth_user_request
->denyMessage("Login successful");
466 safe_free(negotiate_request
->server_blob
);
468 negotiate_request
->server_blob
= xstrdup(blob
);
470 negotiate_request
->releaseAuthServer();
472 negotiate_request
->auth_state
= AUTHENTICATE_STATE_DONE
;
474 debugs(29, 4, "authenticateNegotiateHandleReply: Successfully validated user via Negotiate. Username '" << blob
<< "'");
476 /* connection is authenticated */
477 debugs(29, 4, "AuthNegotiateUserRequest::authenticate: authenticated user " << negotiate_user
->username());
478 /* see if this is an existing user with a different proxy_auth
480 AuthUserHashPointer
*usernamehash
= static_cast<AuthUserHashPointer
*>(hash_lookup(proxy_auth_username_cache
, negotiate_user
->username()));
481 AuthUser
*local_auth_user
= negotiate_request
->user();
482 while (usernamehash
&& (usernamehash
->user()->auth_type
!= AUTH_NEGOTIATE
|| strcmp(usernamehash
->user()->username(), negotiate_user
->username()) != 0))
483 usernamehash
= static_cast<AuthUserHashPointer
*>(usernamehash
->next
);
485 /* we can't seamlessly recheck the username due to the
486 * challenge-response nature of the protocol.
487 * Just free the temporary auth_user */
488 usernamehash
->user()->absorb(local_auth_user
);
489 //authenticateAuthUserMerge(local_auth_user, usernamehash->user());
490 local_auth_user
= usernamehash
->user();
491 negotiate_request
->_auth_user
= local_auth_user
;
493 /* store user in hash's */
494 local_auth_user
->addToNameCache();
495 // authenticateUserNameCacheAdd(local_auth_user);
497 /* set these to now because this is either a new login from an
498 * existing user or a new user */
499 local_auth_user
->expiretime
= current_time
.tv_sec
;
500 negotiate_request
->releaseAuthServer();
501 negotiate_request
->auth_state
= AUTHENTICATE_STATE_DONE
;
503 } else if (strncasecmp(reply
, "NA ", 3) == 0 && arg
!= NULL
) {
504 /* authentication failure (wrong password, etc.) */
509 auth_user_request
->denyMessage(arg
);
511 negotiate_request
->auth_state
= AUTHENTICATE_STATE_FAILED
;
513 safe_free(negotiate_request
->server_blob
);
515 negotiate_request
->server_blob
= xstrdup(blob
);
517 negotiate_request
->releaseAuthServer();
519 debugs(29, 4, "authenticateNegotiateHandleReply: Failed validating user via Negotiate. Error returned '" << blob
<< "'");
520 } else if (strncasecmp(reply
, "BH ", 3) == 0) {
521 /* TODO kick off a refresh process. This can occur after a YR or after
522 * a KK. If after a YR release the helper and resubmit the request via
523 * Authenticate Negotiate start.
524 * If after a KK deny the user's request w/ 407 and mark the helper as
526 auth_user_request
->denyMessage(blob
);
527 negotiate_request
->auth_state
= AUTHENTICATE_STATE_FAILED
;
528 safe_free(negotiate_request
->server_blob
);
529 negotiate_request
->releaseAuthServer();
530 debugs(29, 1, "authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned '" << reply
<< "'");
533 fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply
);
536 if (negotiate_request
->request
) {
537 HTTPMSGUNLOCK(negotiate_request
->request
);
538 negotiate_request
->request
= NULL
;
540 r
->handler(r
->data
, NULL
);
541 cbdataReferenceDone(r
->data
);
542 authenticateStateFree(r
);
546 authenticateNegotiateStats(StoreEntry
* sentry
)
548 helperStatefulStats(sentry
, negotiateauthenticators
, "Negotiate Authenticator Statistics");
552 /** send the initial data to a stateful negotiate authenticator module */
554 AuthNegotiateUserRequest::module_start(RH
* handler
, void *data
)
556 authenticateStateData
*r
= NULL
;
557 static char buf
[MAX_AUTHTOKEN_LEN
];
558 negotiate_user_t
*negotiate_user
;
559 AuthUser
*auth_user
= user();
564 assert(auth_user
->auth_type
== AUTH_NEGOTIATE
);
566 negotiate_user
= dynamic_cast<negotiate_user_t
*>(user());
568 debugs(29, 8, "AuthNegotiateUserRequest::module_start: auth state is '" << auth_state
<< "'");
570 if (negotiateConfig
.authenticate
== NULL
) {
571 debugs(29, 0, "AuthNegotiateUserRequest::module_start: no Negotiate program specified.");
576 r
= cbdataAlloc(authenticateStateData
);
577 r
->handler
= handler
;
578 r
->data
= cbdataReference(data
);
579 r
->auth_user_request
= this;
580 AUTHUSERREQUESTLOCK(r
->auth_user_request
, "r");
582 if (auth_state
== AUTHENTICATE_STATE_INITIAL
) {
583 snprintf(buf
, MAX_AUTHTOKEN_LEN
, "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
585 snprintf(buf
, MAX_AUTHTOKEN_LEN
, "KK %s\n", client_blob
);
590 safe_free(client_blob
);
591 helperStatefulSubmit(negotiateauthenticators
, buf
, authenticateNegotiateHandleReply
, r
, authserver
);
595 * Atomic action: properly release the Negotiate auth helpers which may have been reserved
596 * for this request connections use.
599 AuthNegotiateUserRequest::releaseAuthServer()
602 debugs(29, 6, HERE
<< "releasing Negotiate auth server '" << authserver
<< "'");
603 helperStatefulReleaseServer(authserver
);
607 debugs(29, 6, HERE
<< "No Negotiate auth server to release.");
610 /* clear any connection related authentication details */
612 AuthNegotiateUserRequest::onConnectionClose(ConnStateData
*conn
)
614 assert(conn
!= NULL
);
616 debugs(29, 8, "AuthNegotiateUserRequest::onConnectionClose: closing connection '" << conn
<< "' (this is '" << this << "')");
618 if (conn
->auth_user_request
== NULL
) {
619 debugs(29, 8, "AuthNegotiateUserRequest::onConnectionClose: no auth_user_request");
625 /* unlock the connection based lock */
626 debugs(29, 9, "AuthNegotiateUserRequest::onConnectionClose: Unlocking auth_user from the connection '" << conn
<< "'.");
628 AUTHUSERREQUESTUNLOCK(conn
->auth_user_request
, "conn");
632 * Decode a Negotiate [Proxy-]Auth string, placing the results in the passed
633 * Auth_user structure.
636 AuthNegotiateConfig::decode(char const *proxy_auth
)
638 NegotiateUser
*newUser
= new NegotiateUser(&negotiateConfig
);
639 AuthNegotiateUserRequest
*auth_user_request
= new AuthNegotiateUserRequest ();
640 assert(auth_user_request
->user() == NULL
);
641 auth_user_request
->user(newUser
);
642 auth_user_request
->user()->auth_type
= AUTH_NEGOTIATE
;
643 auth_user_request
->user()->addRequest(auth_user_request
);
645 /* all we have to do is identify that it's Negotiate - the helper does the rest */
646 debugs(29, 9, "AuthNegotiateConfig::decode: Negotiate authentication");
647 return auth_user_request
;
651 AuthNegotiateUserRequest::authenticated() const
653 if (auth_state
== AUTHENTICATE_STATE_DONE
) {
654 debugs(29, 9, "AuthNegotiateUserRequest::authenticated: user authenticated.");
658 debugs(29, 9, "AuthNegotiateUserRequest::authenticated: user not fully authenticated.");
664 AuthNegotiateUserRequest::authenticate(HttpRequest
* request
, ConnStateData
* conn
, http_hdr_type type
)
666 const char *proxy_auth
, *blob
;
668 /** \todo rename this!! */
669 AuthUser
*local_auth_user
;
670 negotiate_user_t
*negotiate_user
;
672 local_auth_user
= user();
673 assert(local_auth_user
);
674 assert(local_auth_user
->auth_type
== AUTH_NEGOTIATE
);
675 negotiate_user
= dynamic_cast<negotiate_user_t
*>(local_auth_user
);
678 /** Check that we are in the client side, where we can generate
682 auth_state
= AUTHENTICATE_STATE_FAILED
;
683 debugs(29, 1, "AuthNegotiateUserRequest::authenticate: attempt to perform authentication without a connection!");
688 debugs(29, 1, "AuthNegotiateUserRequest::authenticate: waiting for helper reply!");
693 debugs(29, 2, "AuthNegotiateUserRequest::authenticate: need to challenge client '" << server_blob
<< "'!");
698 proxy_auth
= request
->header
.getStr(type
);
700 /* locate second word */
704 while (xisspace(*blob
) && *blob
)
707 while (!xisspace(*blob
) && *blob
)
710 while (xisspace(*blob
) && *blob
)
714 switch (auth_state
) {
716 case AUTHENTICATE_STATE_NONE
:
717 /* we've received a negotiate request. pass to a helper */
718 debugs(29, 9, "AuthNegotiateUserRequest::authenticate: auth state negotiate none. Received blob: '" << proxy_auth
<< "'");
719 auth_state
= AUTHENTICATE_STATE_INITIAL
;
720 safe_free(client_blob
);
721 client_blob
=xstrdup(blob
);
722 conn
->auth_type
= AUTH_NEGOTIATE
;
723 assert(conn
->auth_user_request
== NULL
);
724 conn
->auth_user_request
= this;
725 AUTHUSERREQUESTLOCK(conn
->auth_user_request
, "conn");
726 this->request
= request
;
727 HTTPMSGLOCK(this->request
);
732 case AUTHENTICATE_STATE_INITIAL
:
733 debugs(29, 1, "AuthNegotiateUserRequest::authenticate: need to ask helper");
740 case AUTHENTICATE_STATE_IN_PROGRESS
:
741 /* we should have received a blob from the client. Hand it off to
743 safe_free(client_blob
);
745 client_blob
= xstrdup (blob
);
748 HTTPMSGUNLOCK(this->request
);
749 this->request
= request
;
750 HTTPMSGLOCK(this->request
);
755 case AUTHENTICATE_STATE_DONE
:
756 fatal("AuthNegotiateUserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
760 case AUTHENTICATE_STATE_FAILED
:
761 /* we've failed somewhere in authentication */
762 debugs(29, 9, "AuthNegotiateUserRequest::authenticate: auth state negotiate failed. " << proxy_auth
);
772 AuthNegotiateUserRequest::AuthNegotiateUserRequest() :
773 /*conn(NULL),*/ auth_state(AUTHENTICATE_STATE_NONE
),
783 AuthNegotiateUserRequest::~AuthNegotiateUserRequest()
785 safe_free(server_blob
);
786 safe_free(client_blob
);
788 if (authserver
!= NULL
) {
789 debugs(29, 9, "AuthNegotiateUserRequest::~AuthNegotiateUserRequest: releasing server '" << authserver
<< "'");
790 helperStatefulReleaseServer(authserver
);
794 HTTPMSGUNLOCK(request
);
800 NegotiateUser::deleteSelf() const
805 NegotiateUser::NegotiateUser (AuthConfig
*config
) : AuthUser (config
)
807 proxy_auth_list
.head
= proxy_auth_list
.tail
= NULL
;
811 negotiateScheme::createConfig()
813 return &negotiateConfig
;
817 AuthNegotiateUserRequest::connLastHeader()