Add responder feature for initial cred exchanges

Add new APIs:
* krb5_get_init_creds_opt_set_responder
* krb5_responder_get_challenge
* krb5_responder_list_questions
* krb5_responder_set_answer

If a caller sets a responder, it will be invoked after preauth modules
have had a chance to review their incoming padata but before they produce
outgoing padata.  The responder will be presented a set of questions with
optional challenges.  The responder should then answer all questions it knows
how to handle.  Both the answers and the challenges are printable UTF-8 and
may contain encoded, structured data specific to the question asked.

Add two new callbacks and one optional method to the clpreauth
interface.  The new method (prep_questions) allows modules to ask questions
by setting them in the responder context using one of the new callbacks
(ask_responder_question).  The other new callback (get_responder_answer) is
used by the process method to read the answers to the questions asked.

ticket: 7355 (new)
Add internal base64 encoding and decoding support

Add base64 support based on Heimdal's libroken base64 code.
Add internal JSON encoding and decoding support

Add JSON support based loosely on Heimdal's heimbase code.
Introduce gss_export_cred and gss_import_cred

Add gss_export_cred and gss_import_cred mechglue functions to
serialize and unserialize GSSAPI credential handles.  Mechanism
implementations and tests will follow.

ticket: 7354 (new)
Add krb5 support for GSS cred export and import

Using the new internal JSON support to implement serialization and
unserialization of krb5 GSS credentials.

ticket: 7354
Add SPNEGO support for GSS cred export and import

ticket: 7354
Add tests for GSS cred export and import

ticket: 7354
Add new api to Sphinx doc; doc introduced version
Do not retrieve zero-length creds

In the MSLSA cache, if we get back a zero-length ticket, don't
accept it as success; continue on to try and get an acceptable
ticket.

ticket: 7349 (new)
subject: SapGUI sometimes crashes on new session with MSLSA cache
target_version: 1.10.4
tags: pullup
make depend
Unregister error message key on library unload

Revision fcdd2de1 added the K5_KEY_GSS_KRB5_ERROR_MESSAGE key, and
registered it in the gssapi library initialization routine, but
did not unregister it in the libary finalization routine.
When the library is unloaded and reloaded in the same process,
this leads to an assertion failure, since we check that
destructors_set[keynum] is zero (no destructor set) when registering
a key in util/support/threads.c.
Unregister the key on library cleanup to resolve the error.

ticket: 7353
target_version: 1.10.4
tags: pullup
Map CANTLOCK_DB to SVC_UNAVAILABLE in krb5kdc

The KDC should not return KRB5KRB_ERR_GENERIC (KRB_ERR_GENERIC) when the
KDB plugin returns KRB5_KDB_CANTLOCK_DB: it should return
KRB5KDC_ERR_SVC_UNAVAILABLE (KDC_ERR_SVC_UNAVAILABLE) instead.  This
allows clients to immediately fallback onto other KDCs.

When we switch to using blocking locks in the db2 KDB backend we'll very
rarely hit this code path, perhaps only when racing against a kdb5_util load.
Other KDB backends might still return KRB5_KDB_CANTLOCK_DB often enough that
this change is desirable.

ticket: 7358 (new)
Use blocking locks in krb5kdc and libkadm5srv

We don't really need or want to use non-blocking locks, and we certainly
don't want to sleep(1) in krb5kdc (possibly several times, as there was
a loop over this) when either of the principal or policy DB is locked.
Some callers still request non-blocking locks, and ctx_lock() still
honors this.

ticket: 7359 (new)
Fix lock inconsistency in ctx_unlock()

The lock inconsistency fixed here is quite possibly the same as
described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 .

The problem is that ctx_unlock() fails to unlock the principal DB if
it fails to unlock the policy DB, and this happens when ctx_lock()
fails to lock the policy DB (likely because the caller is racing
against a kdb5_util load, which will be using a "permanent" lock,
meaning that the lock file will be unlinked after acquiring the
lock).  The fix is to perform both unlock operations *then* handle
any errors that either or both might have returned.

Additionally, we don't really need or want to use non-blocking locks,
and we certainly don't want to sleep(1) in krb5kdc (possibly several
times, as there was a loop over this) when either of the principal or
policy DB is locked.  Some callers still request non-blocking locks,
and ctx_lock() still honors this.

ticket: 7360 (new)
Test the inconsistent locking fix and svc unavail

Test the fix for https://bugzilla.redhat.com/show_bug.cgi?id=586032 .

Also test that krb5kdc can return svc unavailable
Fix typo in util/support/Makefile.in
Improve LEASHAUTOINIT description

This installer option determines whether the -autoinit argument
is passed to the MIT Kerberos executable.
On startup, if this argument is passed, and if there are no tickets
in the default cache, and if no useful tickets can be imported from
the LSA cache, MIT Kerberos will open the get ticket dialog and prompt
for a password; this option does not appear to have any other effect.

ticket: 7357 (new)
queue: kfw
target_version: 1.10.4
tags: pullup
Tidy up GSSAPI test programs

Factor out some common functions used by multiple test programs.  Use
a common argument format for importing names (p:princname,
h:hostbasedname, or u:username) and adjust the Python tests to match
it.  Use more consistent conventions in test programs and fix some
coding style issues.  Normalize how the test programs are built.
Remove osa_adb_rename_db

This function wasn't used anywhere.  Also remove the declaration for
osa_adb_close_policy(), which doesn't exist.
Avoid multiply defining OIDs in tests/gssapi

Declarations of gss_OID_desc mech_krb5, etc. in tests/gssapi/common.h
can result in multiple definitions when the test programs are linked.
Prefix the declarations with "extern" to prevent this.