Update kadmin set_string document

Added 'otp' as an acceptable attribute name.  Added examples.
Also, x-ref kadmin document from otp.rst.
Avoid duplicate "/etc/krb5.conf" in profile path

If configure gets run with --sysconfdir=/etc, "/etc/krb5.conf" shows
up twice in the profile path, which causes its contents to be read
twice.  This can cause some confusing and possibly problematic
behavior.

Add some logic to configure.in to avoid adding the duplicate entry for
"/etc/krb5.conf".

Reported independently by Denis Vlasenko and Fredrik Tolf.

ticket: 3277
tags: pullup
target_version: 1.12.2
Minimize race conditions in t_iprop.py

Augment kpropd's debugging output so we can see the starting and
ending serial numbers of a sync, and check them in t_iprop.py's
wait_for_prop to make sure we're observing the correct sync each time.
Try to make sure we only send SIGUSR1 when kpropd is actually
sleeping, by waiting for it to print its pre-sleep message to stderr
after a full dump and after each sync.  This isn't perfect, as there
is a short window between printing to stderr and actually sleeping,
but we can't do any better until kpropd has a more reliable mechanism
for triggering immediate updates.
Assume <stdint.h> and fixed-width types

Make unconditional use of <stdint.h> and fixed-width types such as
uint32_t.  k5-plugin.h doesn't use any special integer types, so
remove the conditional include block there.  Nothing uses
INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
Get rid of builtin AES uitypes.h

Remove uitypes.h and just include stdint.h; all we need from it is
uint{8,16,32}_t.
Stop generating gssapi_krb5.h

We started generating gssapi_krb5.h from gssapi_krb5.hin when we
needed to use a 64-bit type for lucid contexts.  Since we can now
assume a standard name for 64-bit types, we can stop generating the
header.
Eliminate internal fixed-width type wrappers

Directly use stdint.h names for integer types in preference to the
various internal names we have made up for them.
In kdb5_util dump, only lock DB for iprop dumps

Revert #7384, as there are no longer policy refcounts.  For iprop
dumps we want to make sure that the reported serial number matches the
DB state (although we could perhaps relax that requirement with enough
analysis), but for non-iprop dumps we don't need any transactional
guarantees.

Also use the correct constant name for the locking mode (the numeric
value is the same, fortunately), and only unlock the database if we
successfully locked it.

ticket: 7869 (new)
Fix two omissions in stdint.h changes

Since we no longer prefix an "#include <stdint.h>" in the gssapi.h
preamble at build time, include it in gssapi.hin.

Update util/gss/kernel-lib/Makefile.in to account for gssapi_krb5.h
being in the source tree.
Missing type refs in docs due to stdint.h changes

References to krb5_int16.rst and krb5_ui_2.rst were missing, but
recently began causing sphinx-build errors because Doxygen started
generating them after the stdint.h changes.
Correct docs for "kdb5_util load" switches

Remove obsolete parenthetical statement in the description of the
"-update" switch to "kdb5_util load".  Using the "-update" flag to
load a second dump made using the "-ov" switch is no longer necessary
now that the "-r13" format is the default.  Add statement that the
"-b7" dump format was the default for versions prior to 1.2.2 (to
match the statement from "dump" section).

[tlyu@mit.edu: commit message]

ticket: 7865
tags: pullup
target_version: 1.12.2
Fix install rule for gssapi_krb5.h

Revert r16428 now that gssapi_krb5.h is in the source tree.
Conditionalize use of LDAP_OPT_DEBUG_LEVEL

The LDAP debug level option (#7551) causes a build failure with the
Solaris LDAP library, which does not have LDAP_OPT_DEBUG_LEVEL.

ticket: 7870 (new)
target_version: 1.12.2
tags: pullup
Check for malloc failure in process_chpw_request

ticket: 7866
target_version: 1.12.2
tags: pullup
Use preauth options when changing password

If we try to change the password in rb5_get_init_creds_password, we
must use all application-specified gic options which affect
preauthentication when getting the kadmin/changepw ticket.  Create a
helper function make_chpw_options which copies the application's
options, unsets the options we don't want, and sets options
appropriate for a temporary ticket.

ticket: 7868
Add tests for gic_pwd password change

ticket: 7868
Improve extended gic option support

The current extended gic option facility violates strict aliasing, is
not nestable (gic_opt_to_opte cannot be used on an extended options
structure casted back to krb5_get_init_creds_options), and requires
callers to use error-prone conversion functions.

Rewrite this code to use a new structure private to gic_opt.c, which
contains a krb5_get_init_creds_opt structure as its first member.  We
can cast between the extended structure and its first element without
violating strict aliasing (C99 6.7.2.1 paragraph 13 and the aggregate
type clause of 6.5 paragraph 7).  Define internal accessor functions
for the extended option fields.  Replace all uses of krb5_gic_opt_ext
in callers with krb5_get_init_creds_opt and the new accessors.  Bring
krb5_get_init_creds_opt_set_pa back into gic_opt.c (reverting
faa810c5b59fa33d9f7db837c5bb88df5436bb30) so that all of the code
which accesses the extended options structure can be in one file.

ticket: 6034
Modernize gic options code style
Fix clean-unix rule for gssapi_krb5.h

Don't delete gssapi_krb5.h now that it is not generated.

[ghudson@mit.edu: also remove from generate-files-mac rule and from
.gitignore]
Update iprop_master_ulogsize documentation

When we removed the maximum number of ulog entries (#7368), we did not
update the documentation for that parameter in kdc.conf.  Reported by
Richard Basch.

ticket: 7849
target_version: 1.12.2
tags: pullup