kx509: Create certs for principals with slashes

kx509 fails to create certs for principals with slashes in them.  For
example:

    client% kinit foo/admin
    foo/admin@EXAMPLE.COM's Password:
    client% kx509
    Timed out waiting on KCA

The KCA reports: "Principal is not a user."  However, there is a use
case set out in this post:

https://thestaticvoid.com/post/2012/10/25/protecting-puppet-with-kerberos/

that would create a kx509 cert for a host principal for authenticating
against a secure HTTP service.  This commit modifies the certificate
creation code to allow principals with slashes in them.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
kx509: Prevent double free

Patchset 750a09bca2183415be3ca3b8784e3417f484794b introduced the
potential for a double free of 'name'.

Change-Id: I23bd4ddb7d9b41cbb3948ab06245f4052b309971
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
add --policy documentation

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Fix kx509 to include realm

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Add option to require initial kca_service tickets

Default to TRUE, and allow setting it on a per-realm basis.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Document kx509 parameters

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Add heimdal-kadm-{client,server} with kadm-{client,server} depending on
them.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Add kx509 parameters to verify_krb5_conf.c

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Issue #491: bus error in resolve_origin()

resolve_origin attempts to insert '\0' into a field from a DL_info
struct, causes BUS error.

Signed-off-by: Nicolas Williams <nico@cryptonector.com>
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Minor WIN32/POSIX bug in resolve_origin()

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Add symbol versioning for libkadm5clnt

In order to support plugins for kadmin that use libkadm5srv, the
libkadm5clnt library has to be versioned to avoid hijacking all
of the function calls that should go to the server library.  Omit
the _kadm5_ clients from the public interface, and version
everything else.

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
gm_mech_oid must be set

mechanism credentials created by dynamically loaded mechanisms do not work
because the gm_mech_oid field is unset for such mechanisms (instead, only
gm_mech.gm_mech_oid is).

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
set m->gm_mech.gm_name

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Fix k5login_authoritative

In the previous implementation when .k5login or .k5login.d existed
and k5login_authoritative was false, no further plugins were tried.
Also when k5login_authoritative was true and .k5login did not match,
the directory was never tried.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Fix handling of SIGINT/SIGTERM in kcm.

Debian-Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654349
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Update .gitignore with generated files.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
roken-h-process: use Getopt::Std, getopts.pl is deprecated

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
fix the kswitch(1) manual prologue

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
make sure h is set at when we find a match, from [GITHUB #54]

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Fix compiling hdb ldap as a module

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>