1 files changed, 39 insertions, 2 deletions
diff --git a/Swiften/Client/ClientSession.cpp b/Swiften/Client/ClientSession.cpp
index 26b89c4..52b8cfb 100644
--- a/Swiften/Client/ClientSession.cpp
+++ b/Swiften/Client/ClientSession.cpp
@@ -1,7 +1,7 @@
 /*
- * Copyright (c) 2010-2014 Isode Limited.
+ * Copyright (c) 2010-2015 Isode Limited.
 * All rights reserved.
 * See the COPYING file for more information.
 */
 #include <Swiften/Client/ClientSession.h>
@@ -45,10 +45,11 @@
 #include <Swiften/TLS/CertificateTrustChecker.h>
 #include <Swiften/TLS/ServerIdentityVerifier.h>
 #ifdef SWIFTEN_PLATFORM_WIN32
 #include <Swiften/Base/WindowsRegistry.h>
+#include <Swiften/SASL/WindowsGSSAPIClientAuthenticator.h>
 #endif
 #define CHECK_STATE_OR_RETURN(a) \
        if (!checkState(a)) { return; }
@@ -71,11 +72,13 @@ ClientSession::ClientSession(
                        needSessionStart(false),
                        needResourceBind(false),
                        needAcking(false),
                        rosterVersioningSupported(false),
                        authenticator(NULL),
-                        certificateTrustChecker(NULL) {
+                        certificateTrustChecker(NULL),
+                        singleSignOn(false),
+                        authenticationPort(-1) {
 #ifdef SWIFTEN_PLATFORM_WIN32
 if (WindowsRegistry::isFIPSEnabled()) {
        SWIFT_LOG(info) << "Windows is running in FIPS-140 mode. Some authentication methods will be unavailable." << std::endl;
 }
 #endif
@@ -202,10 +205,36 @@ void ClientSession::handleElement(boost::shared_ptr<ToplevelElement> element) {
                else if (useStreamCompression && stream->supportsZLibCompression() && streamFeatures->hasCompressionMethod("zlib")) {
                        state = Compressing;
                        stream->writeElement(boost::make_shared<CompressRequest>("zlib"));
                }
                else if (streamFeatures->hasAuthenticationMechanisms()) {
+#ifdef SWIFTEN_PLATFORM_WIN32
+                        if (singleSignOn) {
+                                const boost::optional<std::string> authenticationHostname = streamFeatures->getAuthenticationHostname();
+                                bool gssapiSupported = streamFeatures->hasAuthenticationMechanism("GSSAPI") && authenticationHostname && !authenticationHostname->empty();
+                                if (!gssapiSupported) {
+                                        finishSession(Error::NoSupportedAuthMechanismsError);
+                                }
+                                else {
+                                        WindowsGSSAPIClientAuthenticator* gssapiAuthenticator = new WindowsGSSAPIClientAuthenticator(*authenticationHostname, localJID.getDomain(), authenticationPort);
+                                        boost::shared_ptr<Error> error = boost::make_shared<Error>(Error::AuthenticationFailedError);
+                                        authenticator = gssapiAuthenticator;
+                                        if (!gssapiAuthenticator->isError()) {
+                                                state = Authenticating;
+                                                stream->writeElement(boost::make_shared<AuthRequest>(authenticator->getName(), authenticator->getResponse()));
+                                        }
+                                        else {
+                                                error->errorCode = gssapiAuthenticator->getErrorCode();
+                                                finishSession(error);
+                                        }
+                                }
+                        }
+                        else
+#endif
                        if (stream->hasTLSCertificate()) {
                                if (streamFeatures->hasAuthenticationMechanism("EXTERNAL")) {
                                        authenticator = new EXTERNALClientAuthenticator();
                                        state = Authenticating;
                                        stream->writeElement(boost::make_shared<AuthRequest>("EXTERNAL", createSafeByteArray("")));
@@ -296,10 +325,18 @@ void ClientSession::handleElement(boost::shared_ptr<ToplevelElement> element) {
                CHECK_STATE_OR_RETURN(Authenticating);
                assert(authenticator);
                if (authenticator->setChallenge(challenge->getValue())) {
                        stream->writeElement(boost::make_shared<AuthResponse>(authenticator->getResponse()));
                }
+#ifdef SWIFTEN_PLATFORM_WIN32
+                else if (WindowsGSSAPIClientAuthenticator* gssapiAuthenticator = dynamic_cast<WindowsGSSAPIClientAuthenticator*>(authenticator)) {
+                        boost::shared_ptr<Error> error = boost::make_shared<Error>(Error::AuthenticationFailedError);
+                        error->errorCode = gssapiAuthenticator->getErrorCode();
+                        finishSession(error);
+                }
+#endif
                else {
                        finishSession(Error::AuthenticationFailedError);
                }
        }
        else if (AuthSuccess* authSuccess = dynamic_cast<AuthSuccess*>(element.get())) {