Fix crash on invalid DIR ccache primary file

If read_primary_file() fails with an error other than ENOENT, abort
cache resolution rather than dereferencing a null pointer.  Reported
by Oliver Loch.

ticket: 7185
target_version: 1.10.3
tags: pullup
Correctly document module setting in host_config

The module variable must take the form modname:path, which was not
reflected in the example or described in the text.
Restore some spaces in trval

This is a cosmetic change to reintroduce some space characters that
cff6ea939f061d17a5742a04b8eeb2905c1813dc removed, e.g. between the tag
and the length or short value.
Fix another plugin example in host_config
Clarify module names in host_config

Explicitly state that a module name will usually be the same as the
shared object name, but doesn't have to be.
Simplify password storage in krb5_gss_cred_id_rec

The password is always zero-terminated, so we can store it as a char *
instead of a krb5_data.
Scan ccache more efficiently in gss_acquire_cred

Avoid rereading the ccache in order to find the impersonator config
entry.  Instead, check each entry as we scan through the first time.
Rename gss-krb5 cred tgt_expire field

The tgt_expire field is used to store non-TGT expiry times in a couple
of cases: when the ccache has no TGT, and after we've obtained a cred
for the target service.  Rename it to just "expire" to be less
misleading.
Correct and clarify keytab API documentation
Remove an outdated reference to DES in klist help
Try harder to make keytab-based AS requests work

When making a keytab-based AS request, a client has to choose between
sending its reply key enctype preference list (the enctypes it has in
the keytab) and its session key enctype preference list (all of the
enctypes it supports).  Heimdal and MIT krb5 1.11 clients send the
reply key preference list.  If this list doesn't overlap with the
server principal keys (say, because the krbtgt principal has only a
DES key), then the AS request will fail.

Try to make this work by making the KDC optimistically pick the first
permitted enctype in the request as the session key, even though it
can't be certain that other KDCs in the realm support that enctype.

Make sure to exercise this case in t_keytab.py by doing a multipass
keytab kinit test.

ticket: 7190 (new)
Get default cred only once in gss-krb5 initiator

In the regular krb5 code path, only get a default krb5 cred for the
initial token, since we don't need the cred for mutual_auth anyway.

In the IAKERB mechanism, cache the default cred in iakerb_ctx_id_rec
so we don't have to construct it again for each token.  Also, get an
IAKERB default cred, not a regular krb5 cred (a bug which is harmless
now, but becomes more of a problem with keytab initiation changes).
Add krb5_kt_client_default API

The default client keytab is intended to be used to automatically
acquire initial credentials for client applications.  The current
hardcoded default is a placeholder, and will likely change before
1.11.

Add test framework settings to ensure that a system default client
keytab doesn't interfere with tests, and to allow tests to be written
to deliberately use the default client keytab.

Add documentation about keytabs to the concepts section of the RST
docs, and describe the default client keytab there.

ticket: 7188 (new)
Document GSSAPI name type behavior

Separate out the general interpretation of GSSAPI name types by the
krb5 mechanism from the specific behavior of host-based and principal
name types when used as acceptor names.
Add client keytab initiation support

Support acquiring GSSAPI krb5 credentials by fetching initial
credentials using the client keytab.  Credentials obtained this way
will be stored in the default ccache or collection, and will be
refreshed when they are halfway to expiring.

ticket: 7189 (new)
Include all default etypes in gic_keytab requests

Revert 18b02f3e839c007fff54fc9b693f479b7563ec73 in the KDC.  Instead,
when making an initial request with a keytab, transmit the whole
default_tkt_enctypes list, but sorted with the enctypes we have in the
keytab first.  That way the KDC should prefer enctypes which we have
keys for (for both reply key and session key), but the other enctypes
are still available for use as ticket session keys.

ticket: 7190
Minor rst markup fix
Check sort_enctypes return value in gic_keytab
Fix minor memory leaks in acquire_cred.c
Comment fall-throughs in iakerb switch statement