spnego: http handler features

[nrolans]

I needed more flexibility and added some features to the server HTTP handler. There's been issues asking for similar features (#313, #314), I hope you will find this useful too. Compatibility with the current method is maintained.

Basic auth

When the client first connects without any authorization header, we offer both Negotiate and Basic. The browser picks what works.

With basic auth, I get the user and password via the HTTP header. Then I try to login in the realms listed in the config. I think mod_auth_kerb for httpd stops here but that only gives us a username. I create a service ticket on behalf of the user so we can get all the ticket attributes in the goidentity context (same as SPNEGO/Negotiate auth).

Since I create a new client.Client, I had to add the config and optional settings.

Custom unauthorized handler

I set the unauthorized status code and www-authenticate headers then call the specified handler or a default one if it doesn't exist.

Pass-through unknown authentication types

If the client provides an authorization type that is not Negotiate or Basic, we pass the request to the next handler. That helps if there's another handler in the chain to handle it (e.g. bearer tokens). This does not affect clients not providing an authorization at all, they will still be presented with Negotiate and Basic if configured.

__

The testing environment has been very useful, thanks!

[nrolans]

Hi @jcmturner, do you have any feedback on this? I understand you work on this project in your free time so there's really no hurry. Thanks!