Consolidate DB option documentation

Document DB options in the kadmin/kadmin.local man page, in their own
section.  Refer to that section from the documentation of the -x
parameter of each other command which supports DB options.  Add
documentation for the "dbname" DB2 option.

ticket: 7946 (new)
target_version: 1.12.2
tags: pullup
Fix several memory leaks in LDAP KDB modules

Fix memory leaks discovered by running valgrind over kdbtest, and some
related leaks.  Many of them result from not calling ldap_msgfree
after an unsuccessful search (as the OpenLDAP documentation requires)
or after an exception following a search, so many of the fixes move or
add ldap_msgfree calls to cleanup labels.

ldap_osa_free_princ_ent was not used, and could not be used because it
frees the container while krb5_lookup_tl_kadm_data uses a
caller-allocated container.  Change it to leave the container alone,
but to correctly destroy xdrs.  Use it in krb5_ldap_put_principal
where princ_ent was leaked.

In krb5_ldap_put_principal, subtreelist is declared twice in interior
scopes and not properly freed; move it to function scope and free it
up in the cleanup label.  Also in krb5_ldap_put_principal, avoiding
decoding multiple KBR5_TL_KADM_DATA values (which we don't expect to
see) as later decodes would cause earlier decodes to leak.

In krb5_encode_krbsecretkey, fix a leak of the krb5_data container and
also add an error check when calling asn1_encode_sequence_of_keys;
otherwise we would dereference a null pointer if we run out of memory
encoding keys (very unlikely).

ticket: 7941 (new)
target_version: 1.12.2
tags: pullup
Modernize some LDAP sources

Bring ldap_misc.c up to date with current practices and make limited
changes to other files.  Of note:

* krb5_decode_krbsecretkey was freeing its bvalues argument; make that
  the caller's responsibility.
* Make is_principal_in_realm and has_modify_increment return
  krb5_boolean, reversing the sense of their results.
* Remove broken code path in decode_tl_data when an integer value has
  a length other than 2 (which should never happen).
* Simplify krb5_ldap_readpassword and make it take filename/name
  parameters instead of an LDAP context.
* Make krb5_ldap_bind (renamed to authenticate) responsible for
  setting a useful error message, so that its caller doesn't assume
  knowledge of the bind parameters.
* Make krb5_ldap_initialize (renamed to initialize_server) responsible
  for updating the handle list, and remove the otherwise unused
  krb5_update_ldap_handle.
* Remove remaining skeletal certificate support, including the unused
  has_sasl_external_mech function.
* Remove unused krb5_get_containerdn and KDB_TL_CONTAINERDN.
* Remove kdb_xdr.h; all of its prototypes were for functions that
  don't exist in the module or were duplicated in other headers.
Add SASL support to LDAP KDB module

Add variables for the SASL mechanism, authcid, authzid, and realm.  If
a SASL mechanism is set, perform an interactive bind with that
mechanism.  If <sasl/sasl.h> is found at build time, provide the
authcid, authzid, and realm in the interaction function, and provide a
SASL secret read from the service password file (under the authcid) if
we found one.

Based on a patch from Zoran Pericic <zpericic@netst.org>.

ticket: 7944 (new)
Add tests for LDAP SASL support

In t_kdb.py, add a test case for EXTERNAL, and a test case for
DIGEST-MD5 if we built with the SASL header file and found the core
schema file.

ticket: 7944
Document LDAP SASL configuration

Document the LDAP SASL profile tags and DB options.  For consistency,
also condense the kdc.conf documentation for the two bind DN variables
into one entry.

ticket: 7944