kadmin: handle systemd setpgid failure

When running as a service under systemd, kadmin cannot successfully use
setpgid().  The call fails with EPERM. Do not treat this as a fatal
error; instead, allow kadmind to continue starting up.
Install compatibility symlinks for kadmin and ktutil.
kadm5: fix race in Makefile with kadm5_err.h

When running make with -j4, occasionally kadm5 fails due to a missing
header file kadm5_err.h. Fix the race condition.

Reported at https://bugzilla.redhat.com/1115164

Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com>
Use correct value for anonymous flags

The KDC Option and Ticket Flag for the anonymous extension were changed
from 14 to 16 due to a conflict with S4U2Proxy in version 11 of the anonymous
draft (now RFC6112). Fix the definitions
Recognize anonymous AS requests using bit 14

Check KDC Option bit 14 in addition to 16 when identifying anonymous
AS-REQs. This provides compatibility with older heimdal releases.
Include empty PKINIT-KX padata

rfc6112 requires kdcs implementing anonymous PKINIT to include an
empty PKINIT-KX padata in PREAUTH_REQUIRED messages.
Including this improves compatibility with MIT kerberos.
When using PKINIT with DH, compute session key

RFC6112 provides a method of computing a session key when the PKINIT DH
is used, and mandates it for anonymous pkinit. The session key is computed
using KRB-FX-CF2 from the reply key and a random key chosen by the kdc.
The random key is provided to the client, which is supposed to verify
that the session key was computed this way.
Document logic in _krb5_is_anon_request

describe why we look at the different bits and fields
Merge pull request #108 from ktdreyer/kadm5-make-race

kadm5: fix race in Makefile with kadm5_err.h
Use anon realm for anonymous PKINIT

When an AS request names the anonymous principal, use the anonymous
realm in the response and ticket.
version-script-client.map needs to be in dist

version-script-client.map needs to be in lib/kadm5's EXTRA_DIST,
otherwise make distcheck fails
Add travis config.
check for sys/errno.h
Check _kdc_db_fetch return value before dereference entry pointer

This fixes a segfault if the _kdc_db_fetch function does not find
the entry in the database (the entry pointer will be NULL if entry
is not found).

Signed-off-by: Samuel Cabrero <scabrero@zentyal.com>
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
Avoid kinit NPE when default cred not in keytab
Avoid appearance of if if else ambiguity
libkafs: derivation from non-DES key (rxkad-kdf)

Add support for the "rxkad-kdf" protocol for deriving rxkad session keys
from non-DES Kerberos session keys.  This allows rxkad to be used in
realms where the KDC is unwilling or unable to issue tickets with
single-DES session keys.
resurrect password change support again
Merge pull request #112 from jhutz/rxkad-kdf

libkafs: derivation from non-DES key (rxkad-kdf)
rename roken base64, fixes #107