Make kdb5_util dump work with LDAP again

The LDAP module doesn't support locking.  There's code to ignore this
in load but not in dump.  dump used to only lock for iprop dumps, but
now locks all the time after e65a16d898f3a686525e83661f4fd86c76e27bbf
(#7384), causing it to fail with LDAP.

ticket: 7445 (new)
target_version: 1.11
tags: pullup
Regenerate kdc.conf.man to pick up Camellia

We recently added documentation of the Camellia enctypes; rebuild
the in-tree man page to pick them up.

ticket: 7439
tags: pullup
Generate and use version.py for Sphinx

Sphinx's idea of the version number appears in the man pages and
compiled PDF documents, and shows up as metadata in the generated
HTML sources.

Extract the version information from the master source (patchlevel.h)
into a form usable by Sphinx.

ticket: 7433
tags: pullup
Use main conf.py for NOTICE

Generate the NOTICE file using the main conf.py, by using a special
tag when invoking sphinx-build.

While here, add notice.txt to the list of files removed by make clean.

ticket: 7433
tags: pullup
Update conf.py for latex output

We do not want one giant PDF document; we want separate PDFs for
our various components.

The features document cannot be included in the list because the
generated LaTeX for tables with empty cells does not compile.

ticket: 7433
tags: pullup
Make glue for building PDFs

sphinx-build's latex output engine creates a subdirectory with
various latex files, and a Makefile.  The generated Makefile assumes
gmake, which we do not.  The logic needed in this makefile is rather
simple, so we just include it in src/doc/Makefile.in, even if we
do need a rather complicated shell expression to work in the subdirectory.

ticket: 7433
tags: pullup
Use release, not version, for HTML index

The full release string includes RELTAIL from patchlevel.h; it
is useful to know whether we are on a pre- or post-release branch.

ticket: 7433
tags: pullup
Remove trailing whitespace

ticket: 7433
tags: pullup
Rename doc subdirectories

We like these names better, and they match the PDF document filenames.

admins -> admin
appldev -> appdev
users -> user

and catch up where the names are used elsewhere.

The relay/ directory has been removed, with its contents moved to the
top level in build_this.rst and a new about.rst.

The section headers for kadmind, krb5kdc, sserver, kpasswd, kswitch,
and sclient are misdetected as conflict markers.
bigredbutton: whitespace

ticket: 7433
tags: pullup
Replace UTF-8 with ASCII

We try to restrict non-ASCII to names.

Python does not accept U+2013 EN DASH as indicating a command-line
argument; U+2D HYPHEN-MINUS is required.

Replace U+201C LEFT DOUBLE QUOTATION MARK and U+201D RIGHT
DOUBLE QUOTATION MARK with ordinary ASCII quotes.

ticket: 7433
tags: pullup
Add Camellia enctypes to default enctype lists

Add camellia256-cts-cmas and camellia128-cts-cmac to the default
permitted_enctypes, default_tkt_enctypes, and default_tgs_enctypes
lists, to simplify deployment of Camellia.  The new enctypes still
aren't on supported_enctypes, so won't be in the set of long-term keys
for principals without administrator intervention.

ticket: 7446 (new)
target_version: 1.11
tags: pullup
Rebuild krb5.conf.man for default enctypes

Now that the Camellia enctypes are in the default lists for
permitted_enctypes, default_tkt_enctypes, and default_tgs_enctypes,
regenerate the man page to reflect that change.

ticket: 7446
target_version: 1.11
tags: pullup
Fix typo disabling static-linked LDAP back end
Add automated tests for LDAP KDB module

Add new tests kdbtest.c and t_kdb.py.  Together these exercise most of
the code in the LDAP back end.  kdbtest is also run against the DB2
module, which is mostly redundant with other tests, but does exercise
the lockout logic a little more thoroughly than t_lockout.py can.

To test the LDAP back end, we look for slapd and ldapadd binaries in
the path.  The system slapd is sometimes constrained by AppArmor or
the like, which we can typically work around by making a copy of the
binary.  slapd detaches before listening on its server socket (this
got better in 2.4.27 but still isn't perfect), so we unfortunately
have to use a one-second sleep in the slapd setup.
Avoid using grep -q in configure.in

grep -q isn't as portable as we would like, so don't use it.
Add Doxygen markup for Camellia enctype constants

An RFC number has been assigned for the Camellia draft.  Add Doxygen
markup to the enctype and cksumtype constants pointing to the
informational RFC.
Make kinit smarter about using keytabs

Previously, we would happily accept -i or -t name and do nothing
with it, if -k was not given.  If the user is passing -i or -t, they
clearly want to use a keytab, so do so (but print a warning).

While here, enforce that only one of -t and -i is given.

ticket: 7218
tags: pullup
target_version: 1.11
Tests for kinit's detection of a keytab request

We must check that 'kinit -t keytab' and 'kinit -i' successfully
produce tickets, and have the specified warning output.

ticket: 7218
tags: pullup
target_version: 1.11
Fix quoting issues in LDAP KDB module

Modify ldap_filter_correct() to quote special characters for DN
strings as well as filters, since it is already used to quote a DN
string in krb5_ldap_name_to_policydn() and there's no harm in
over-quoting.  In krb5_ldap_put_principal(), quote the unparsed
principal name for use in DNs we choose.  In
krb5_ldap_create_password_policy(), use the policy name for the CN of
the policy entry instead of the (possibly quoted) first element of the
DN.

Adapted from a patch by Jim Shi <hanmao_shi@apple.com>.

ticket: 7296
Add "Kerberos" to PDF titles

ticket: 7451 (new)
tags: pullup
target_version: 1.11