Bug 428482 Add support for Kerberised LDAP to extensions/auth. r=bienvenu,sr=dmose,a1.9=beltzner

extensions/auth/nsAuthGSSAPI.cpp

@@ -357,7 +357,8 @@ nsAuthGSSAPI::Shutdown()
     }
 }
 
-NS_IMPL_ISUPPORTS1(nsAuthGSSAPI, nsIAuthModule)
+/* Limitations apply to this class's thread safety. See the header file */
+NS_IMPL_THREADSAFE_ISUPPORTS1(nsAuthGSSAPI, nsIAuthModule)
 
 NS_IMETHODIMP
 nsAuthGSSAPI::Init(const char *serviceName,
@@ -446,7 +447,10 @@ nsAuthGSSAPI::GetNextToken(const void *inToken,
     // We can only use Mac OS X specific kerb functions if we are using 
     // the native lib
     KLBoolean found;    
-    PRBool doingMailTask = mServiceName.Find("imap@") || mServiceName.Find("pop@") || mServiceName.Find("smtp@");
+    PRBool doingMailTask = mServiceName.Find("imap@") ||
+                           mServiceName.Find("pop@") ||
+                           mServiceName.Find("smtp@") ||
+                           mServiceName.Find("ldap@");
     
     if (!doingMailTask && (gssNativeImp &&
          (KLCacheHasValidTickets_ptr(NULL, kerberosVersion_V5, &found, NULL, NULL) != klNoErr || !found)))

extensions/auth/nsAuthGSSAPI.h

@@ -52,6 +52,23 @@
 // The nsAuthGSSAPI class provides responses for the GSS-API Negotiate method
 // as specified by Microsoft in draft-brezak-spnego-http-04.txt
 
+/* Some remarks on thread safety ...
+ *
+ * The thread safety of this class depends largely upon the thread safety of
+ * the underlying GSSAPI and Kerberos libraries. This code just loads the 
+ * system GSSAPI library, and whilst it avoids loading known bad libraries, 
+ * it cannot determine the thread safety of the the code it loads.
+ *
+ * When used with a non-threadsafe library, it is not safe to simultaneously 
+ * use multiple instantiations of this class.
+ *
+ * When used with a threadsafe Kerberos library, multiple instantiations of 
+ * this class may happily co-exist. Methods may be sequentially called from 
+ * multiple threads. The nature of the GSSAPI protocol is such that a correct 
+ * implementation will never call methods in parallel, as the results of the 
+ * last call are required as input to the next.
+ */
+
 class nsAuthGSSAPI : public nsIAuthModule
 {
 public:

extensions/auth/nsAuthSASL.cpp

@@ -54,7 +54,8 @@ void nsAuthSASL::Reset()
     mSASLReady = false;
 }
 
-NS_IMPL_ISUPPORTS1(nsAuthSASL, nsIAuthModule)
+/* Limitations apply to this class's thread safety. See the header file */
+NS_IMPL_THREADSAFE_ISUPPORTS1(nsAuthSASL, nsIAuthModule)
 
 NS_IMETHODIMP
 nsAuthSASL::Init(const char *serviceName,

extensions/auth/nsAuthSASL.h

@@ -42,6 +42,11 @@
 #include "nsString.h"
 #include "nsCOMPtr.h"
 
+/* This class is implemented using the nsAuthGSSAPI class, and the same
+ * thread safety constraints which are documented in nsAuthGSSAPI.h
+ * apply to this class
+ */
+
 class nsAuthSASL : public nsIAuthModule
 {
 public: