Create a branch for iakerb work

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23842 dc483132-0cff-0310-8789-dd5450dbe970
Merge changes from /users/lhoward/iakerb-refonly

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23843 dc483132-0cff-0310-8789-dd5450dbe970
Rewrite gc_frm_kdc_step.c to handle the full functionality of
gc_frm_krb.c.  Not tested yet.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23854 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r23844 (krb5_init_creds_step flags fix) from trunk

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23855 dc483132-0cff-0310-8789-dd5450dbe970
In the GSSAPI IAKERB code, fix the sense of the flags expected from
krb5_init_creds_step and krb5_tkt_creds_step.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23856 dc483132-0cff-0310-8789-dd5450dbe970
Add krb5_tkt_creds_get().  Still untested

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23857 dc483132-0cff-0310-8789-dd5450dbe970
Make krb5_get_credentials use the krb5_tkt_creds interface instead of
krb5_get_cred_from_kdc_opt.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23859 dc483132-0cff-0310-8789-dd5450dbe970
In spnego_mech.c, revert r23225 from Luke's branch.  The logic errors
were fixed independently on the trunk in r23742 (#6603) and the first
hunk would cause spnego_gss_init_sec_context to seg fault when passed
GSS_C_NO_BUFFER as input_token.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23860 dc483132-0cff-0310-8789-dd5450dbe970
In gc_frm_kdc_step.c, fix some typos and simplify some code here and
there.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23861 dc483132-0cff-0310-8789-dd5450dbe970
Move a little bit of logic out of step_referrals into
try_fallback_realm.  If try_fallback_realm gives up because the
fallback realm is the same as the initial referral realm, return the
code from the TGS reply instead of KRB5_ERR_HOST_REALM_UNKNOWN.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23862 dc483132-0cff-0310-8789-dd5450dbe970
Fix typo

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23863 dc483132-0cff-0310-8789-dd5450dbe970
In gc_frm_kdc_step.c, remove a check from init_realm_path which was
redundant with a check in krb5_walk_realm_tree.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23865 dc483132-0cff-0310-8789-dd5450dbe970
gc_frm_kdc_step.c was feeding the wrong in_creds to
krb5int_process_tgs_reply when performing TGT requests.  Add
additional state to track what in_creds to use.

Also improve comments, and make the handling of ctx->realm_path a
little more obviously correct.  (It never gets initialized twice, but
proving that is non-trivial, so we now free it before initialization.)

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23868 dc483132-0cff-0310-8789-dd5450dbe970
In get_creds.c, rewrite validate_or_renew_creds() and
get_credentials_val_renew_core() in terms of the new gc_frm_kdc_step.c
code.  For now, create a static helper get_tkt_creds() to run
krb5_tkt_creds_init/get/get_creds; probably move that into
gc_frm_kdc_step.c at some point.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23869 dc483132-0cff-0310-8789-dd5450dbe970
Use krb5_get_credentials in ksu instead of krb5_get_cred_from_kdc, so
we can get rid of the latter.  (Also simplifies the code.)

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23871 dc483132-0cff-0310-8789-dd5450dbe970
Merge changes from /users/lhoward/iakerb-refonly

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23872 dc483132-0cff-0310-8789-dd5450dbe970
In int-proto.h, remove krb5int_tgt_mcred, which was added on this
branch but no longer exists.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23873 dc483132-0cff-0310-8789-dd5450dbe970
Merge trunk changes from r23842 to r23874 to iakerb branch

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23875 dc483132-0cff-0310-8789-dd5450dbe970
Use krb5_cc_dup to make a copy of the ccache handle passed to
krb5_tkt_creds_init(), so that ccache can be closed before the context
is freed.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23876 dc483132-0cff-0310-8789-dd5450dbe970
Move validation/renewal APIs into a separate file.  Make them use
gc_via_tkt directly, which is more correct for non-TGT validation or
renewal.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/iakerb@23883 dc483132-0cff-0310-8789-dd5450dbe970