Enforce minimum PBKDF2 iteration count

Also add a testing interface to allow weak iteration counts.
(Published test vectors use weak iteration counts.)

ticket: 7465
target_version: 1.12
tags: pullup
Add support to store time offsets in cc_keyring

The code follows the same model used for the memory ccache type.  Time
offsets are stored in each credential cache in a special key just like
the principal name.  Legacy session caches do not store timestamps as
legacy code would fail when iterating over the new offset key.

[ghudson@mit.edu: minor formatting changes; note legacy session
exception in commit message]

ticket: 7768 (new)
target_version: 1.12
tags: pullup
Set expiration time on keys and keyrings

By setting the timeout based on the credetial's timeout we let the
system automatically cleanup expired credentials.

[ghudson@mit.edu: simplified code slightly]

ticket: 7769 (new)
target_version: 1.12
tags: pullup
Remove a warning in AES string-to-key

On 32-bit platforms, the code to translate an iteration count of 0 to
2^32 can trigger a compiler warning.  Since we will basically never
accept an iteration count that high (right now we reject anything
above 2^24), just reject it out of hand.
Remove dangling --with-kdc-kdb-update references

This configure option hasn't done anything since 1.8, so don't mention
it in configure --help or the documentation.  The disable_last_success
and disable_lockout DB options are now used to turn it off.
Clarify lockout replication issues in docs

In the "KDC replication and account lockout" section of lockout.rst,
specifically call out kprop and incremental propagation as the
mechanisms which do not replicate account lockout state, and add a
note that KDCs using LDAP may not be affected by that section's
concerns.

ticket: 7773 (new)
target_version: 1.12
tags: pullup
Add another kadmin ACL test for backreferences

Add a test using backreferences which don't correspond directly to
principal components, to verify that *N refers to the Nth wildcard and
not the Nth component.
Correct kadm5.acl back-reference documentation

In kadm5.acl, *N in the target principal name refers to the Nth
wildcard in the acting principal pattern, not the Nth component.

ticket: 7774 (new)
target_version: 1.12
tags: pullup
Improve default ccache name API documentation

Document the lifetime and caching behavior of the
krb5_cc_default_name() return value.  Document that
krb5_cc_set_default_name() may be called with NULL to purge the cached
value.  Correct a typo in the krb5_cc_default() summary and explicitly
reference krb5_cc_default_name().

ticket: 7775 (new)
target_version: 1.12
tags: pullup
Added a new ccache doc to "Kerberos V5 concepts"

This is to add a short introductory document on credential
caches to the Concepts section of Kerberos documentation.

ticket: 7776 (new)
target_version: 1.12
tags: pullup
Edit ccache_def.rst

Re-fill to 70 columns.  Replace non-ascii apostrophes with ASCII ones.
Edit wording slightly.

ticket: 7776
Update doc for current kdb5_util dump version

kdb5_util.rst incorrectly describes the current default dump format
version as 6 when it should be 7.  Reported by Jeff D'Angelo.

ticket: 7777
target_version: 1.12
tags: pullup