KRB5_AUTHDATA_SIGNTICKET value is now 142

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@22991 dc483132-0cff-0310-8789-dd5450dbe970
reject KRB5_AUTHDATA_MANDATORY_FOR_KDC top-level authdata

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@22992 dc483132-0cff-0310-8789-dd5450dbe970
Update KRB5SignedPath to match latest Heimdal

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@22999 dc483132-0cff-0310-8789-dd5450dbe970
Replace oblique krb5_transited_service structure with an array 
of krb5_principals

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23000 dc483132-0cff-0310-8789-dd5450dbe970
revert handle_authdata reordering

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23005 dc483132-0cff-0310-8789-dd5450dbe970
revert unneeded changes to kdc_process_s4u2proxy_req

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23006 dc483132-0cff-0310-8789-dd5450dbe970
revert unneeded changes to kdc_process_s4u2proxy_req

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23007 dc483132-0cff-0310-8789-dd5450dbe970
explicitly check for keyed checksums when signing AD-KDCIssued and KRB5SignedPath

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23009 dc483132-0cff-0310-8789-dd5450dbe970
also sign authdata in KRB5_AUTHDATA_SIGNTICKET

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23010 dc483132-0cff-0310-8789-dd5450dbe970
fix off by one error in previous commit

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23011 dc483132-0cff-0310-8789-dd5450dbe970
reassign krbAllowedToDelegateTo under PADL arc

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23014 dc483132-0cff-0310-8789-dd5450dbe970
Fix previous commit OIDs

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23017 dc483132-0cff-0310-8789-dd5450dbe970
In constrained delegation, careful only to copy fields to the reply
ticket that have been protected by the TGS checksum. Previously we
were treating the evidence ticket as the header_enc_tkt, which could
have allowed a malicious server to forge the flags, times (apart from
endtime) and transited realms on the evidence ticket.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23018 dc483132-0cff-0310-8789-dd5450dbe970
The Windows PAC fulfils the same role as the signed path
in the case that there is no other KDC issued auth data.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23019 dc483132-0cff-0310-8789-dd5450dbe970
Cleanup logic: only if the Windows 2000 PAC is the only element in the
authorization data array is it safe to omit KRB5SignedPath. We could
always include KRB5SignedPath were it not for some interop issues with
earlier versions of Windows.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23020 dc483132-0cff-0310-8789-dd5450dbe970
cleanup

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23021 dc483132-0cff-0310-8789-dd5450dbe970
cleanup

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23022 dc483132-0cff-0310-8789-dd5450dbe970
Fix ignored error code

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23023 dc483132-0cff-0310-8789-dd5450dbe970
cleanup

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23024 dc483132-0cff-0310-8789-dd5450dbe970
cleanup

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u2proxy@23025 dc483132-0cff-0310-8789-dd5450dbe970