Document kadm5_hook chpass randomize-key behavior

kadmind's randkey operation invokes the kadm5_hook chpass method with
a null newpass parameter, which wasn't documented.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25805 dc483132-0cff-0310-8789-dd5450dbe970
Correct kdc_timesync documentation

kdc_timesync is read from the profile as an integer, not a boolean; go
back to documenting it that way.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25806 dc483132-0cff-0310-8789-dd5450dbe970
Add clock skew tests

Add a KDC option (-T) to run with a time offset, and use that to
test kdc_timesync behavior.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25807 dc483132-0cff-0310-8789-dd5450dbe970
Allow preauth mechs to work with clock skew

Add a clpreauth callback which gets the time of day using an offset
determined by the preauth-required error, and use it in encrypted
timestamp and encrypted challenge.  This timestamp is not necessarily
authenticated, but the security consequences for those preauth mechs
are minor (and can be mitigated by turning off kdc_timesync on
clients).

Based on a patch from Stef Walter.

ticket: 7114

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25808 dc483132-0cff-0310-8789-dd5450dbe970
Added MIT resources document.


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25809 dc483132-0cff-0310-8789-dd5450dbe970
Add Doxygen markup to API functions that were introduced in 1.10 release.


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25810 dc483132-0cff-0310-8789-dd5450dbe970
Translate @version Doxygen markup into rst format.


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25811 dc483132-0cff-0310-8789-dd5450dbe970
Rename mitresources.rst to resources.rst

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25812 dc483132-0cff-0310-8789-dd5450dbe970
Edit resources page

Improve description of kerberos and krbcore.  Remove trailing
whitespace throughout.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25813 dc483132-0cff-0310-8789-dd5450dbe970
Add Doxygen markup to API functions that were introduced in 1.9 release.


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25814 dc483132-0cff-0310-8789-dd5450dbe970
Add keytab kinit test cases

Create a test script for keytab-related tests.  Move the kvno wrapping
test there from t_general.py, and augment it to better match what's in
standalone.exp.  Add tests for kinit with keytab, including kinit with
the most-preferred enctype missing from the keytab (which currently
fails).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25815 dc483132-0cff-0310-8789-dd5450dbe970
Return kinit output in k5test's K5Realm.kinit

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25816 dc483132-0cff-0310-8789-dd5450dbe970
Unify krb5_get_init_creds_keytab code paths

Use krb5_init_creds_set_keytab in krb5_get_init_creds_keytab, so that
processing added to the former will be used by the latter.  This is
slightly awkward because of the way we do the use_master fallback, in
that we have to duplicate some of krb5int_get_init_creds.

Based on a patch from Stef Walter.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25817 dc483132-0cff-0310-8789-dd5450dbe970
Use etypes from keytab in krb5_gic_keytab

When getting initial credentials with a keytab, filter the list of
request enctypes based on the keys in the keytab.

Based on a patch from Stef Walter.

ticket: 2131

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25818 dc483132-0cff-0310-8789-dd5450dbe970
Try all history keys to decrypt password history

A database created prior to 1.3 will have multiple password history
keys, and kadmin prior to 1.8 won't necessarily choose the first one.
So if there are multiple keys, we have to try them all.  If none of
the keys can decrypt a password history entry, don't fail the password
change operation; it's not worth it without positive evidence of
password reuse.

ticket: 7099

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25819 dc483132-0cff-0310-8789-dd5450dbe970
Adjust t_general.py organization

Move some tests out of the multipass_realms loop since they aren't
enctype-dependent.  Fix the success message not to mention kvno
wrapping.  Don't start kadmind in the multipass_realms loop since we
don't use it.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25820 dc483132-0cff-0310-8789-dd5450dbe970
Add KRB5_TRACE test case

In t_general.py, run kinit with KRB5_TRACE enabled and make sure we
see some basic strings in the resulting file.

ticket: 7113

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25821 dc483132-0cff-0310-8789-dd5450dbe970
Clear preauth use counts for each AS request

Initialize use_count fields in krb5_preauth_request_context_init,
which is invoked before each AS request.  Previously they were
initialized only in krb5_init_preauth_context, which is only invoked
once per krb5 library context.

ticket: 7119
target_version: 1.10.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25822 dc483132-0cff-0310-8789-dd5450dbe970
Use "agogo" HTML theme (with some modifications) for the Sphinx documentation. Do not show the ReST source files.


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25823 dc483132-0cff-0310-8789-dd5450dbe970
Minor cleanup (mostly to remove the "Contents" section titles).


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25824 dc483132-0cff-0310-8789-dd5450dbe970