Fix typos in kdb5_util master key command outputs

kdb5_util list_mkeys was beginning lines with "KNVO" instead of
"KVNO".  kdb5_util purge_mkeys was displaying "follwing" instead of
"following" for both dry-run and normal cases.

(cherry picked from commit 7fee58ccadf1b61eec9a8c62f47dac43986e2ad1)

ticket: 7734 (new)
version_fixed: 1.11.4
status: resolved
Use active master key in update_princ_encryption

kdb5_util update_princ_encryption should update to the active master
key version, not the most recent.

(cherry picked from commit 4ccc18bc3ddc49d0fd0d2de00ec91c0fa44c53a8)

ticket: 7735 (new)
version_fixed: 1.11.4
status: resolved
Correctly activate master keys in pre-1.7 KDBs

Starting with 1.7, databases are created with actkvno tl-data in the
K/M entry which gives the initial master key version an activation
time of 0.  A database created before 1.7 will not have this tl-data,
but we should behave in the same way as we do for a more recent
database.

Move the actkvno list synthesis code from krb5_dbe_fetch_act_key_list
to krb5_dbe_lookup_actkvno so it applies to kdb5_util commands as well
as libkadm5.  Synthesize the same list as we would have initialized
the KDB with, with an activation time of 0 for the earliest master
key.

(cherry picked from commit ec560fac83912abaa15fb158101c8174497081c5)

ticket: 7737 (new)
version_fixed: 1.11.4
status: resolved
Reset key-generation parameters for each enctype

In add_key_pwd, initialize s2k_params to NULL inside the loop over
enctypes instead of outside the loop, so that if the afs3 salt type
is used it does not contaminate later enctype/salt pairs in the list.

(cherry picked from commit 381cf01afb13ad28de0927de37f8e1d12749bf49)

ticket: 7742 (new)
version_fixed: 1.11.4
status: resolved
Fix decoding of mkey kvno in mkey_aux tl-data

krb5_dbe_lookup_mkey_aux was decoding a 16-bit value directly into an
int, resulting in the wrong value on big-endian platforms.  The
consequences are mostly invisible because we ignore this field and try
all mkey_aux nodes in krb5_def_fetch_mkey_list.

(cherry picked from commit 64ec2941af1561ef06e7e885b2ffb65a675516ce)

ticket: 7746 (new)
version_fixed: 1.11.4
status: resolved
Improve LDAP KDB initialization error messages

In krb5_ldap_initialize, don't just blat the LDAP error into the
extended message; give an indication of which LDAP operation we were
trying to do and show what parameters we gave to it.

(Also, krb5_set_error_message can handle a null context argument, so
don't bother to check before calling.)

(cherry picked from commit 5a77bb85294f37d1dfa4c7faedfdfb0d7faaf8dc)

ticket: 7747 (new)
version_fixed: 1.11.4
status: resolved
Document master key rollover

Add a new section to database.rst documenting the procedure for
rolling the master key.

(cherry picked from commit e4b5d426a1e1e00367cc44a9619535ab71b20393)

ticket: 7748 (new)
version_fixed: 1.11.4
status: resolved
Clarify kpropd standalone mode documentation

The kpropd -S option is no longer needed to run kpropd in standalone
mode, but its functionality is not deprecated; standalone mode is
automatically activated when appropriate.  Clarify the kpropd
documentation on standalone mode to avoid giving the impression that
the mode is deprecated.

(cherry picked from commit bfec0671ca6df811453d46a2f47afc7168b980fc)

ticket: 7752 (new)
version_fixed: 1.11.4
status: resolved