cc_mslsa: comment some impending cleanup

The function does_query_ticket_cache_ex2() will not be needed once
Windows Server 2003 drops out of support in approximately one year's
time.  Note the doom timer at its definition, to facilitate future
cleanup.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove unused function IsKerberosLogon()

There was one potential callsite, in lcc_resolve(), which
was disabled.  It is perfectly reasonable to want to use the
MSLSA cache on a non-domain-joined workstation, as it is now
a read-write cache type, so we need not concern ourselves whether
the logon was performed or may have been performed using kerberos.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove ENABLE_PURGING

It's been enabled for a long time.  We don't need to support
this anymore.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove debugging knob (?) PURGE_ALL

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Rename routines to avoid OS versions

We don't care about XP versus non-XP; just indicate which
revision of the data type is being used.

Standardize on the lowercase 'x' in "Ex", for both the "Ex" and
"Ex2" forms.

While here, adjust the function definition prototypes to match
current style.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Move realm conversion into helper

All the callers of UnicodeStringToMITPrinc() were already converting
a UnicodeString into a wchar* just to pass it in as the realm.

Simplify everyone's life by making the helper do the conversion.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Don't try to get a TGT in lcc_resolve()

We were only using it to get a client principal name, which can
be done using operations that require less privilege.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Don't get a TGT in get_principal

Use KERB_QUERY_TKT_CACHE_EX_RESPONSE for lcc_get_principal();
there's no real need to get a fully-fledged TGT, which is not
possible when UAC is enabled.

ticket: 7989
tags: pullup
target_version: 1.12.3
Try to scan_ccache() after leash picks a cache

We need to call scan_ccache() in order to notice that there
are credentials and read their expire time.

ticket: 7998 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll tries to get initial creds even when some are present
Leash: Add some KDC entries to the registry

Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.

ticket: 7999 (new)
queue: kfw
tags: pullup
target_version: 1.12.3
Let libgssapi see TGTs in the MSLSA cache

When the current user is a local administrator of a windows machine
where User Account Control (UAC) is enabled, the Windows LSA will
return a block of zeros as the session key for any TGT entry in the
MSLSA: cache.  The lcc_retrieve() implementation checks for such
"null" session keys and prevents them from escaping to callers (as
attempts to use them would encounger strange errors).  However,
when the TGT is the only entry in the cache, this filtering prevents
scan_ccache() from detecting that the cache contains non-expired
credentials (and that there is a TGT present).

Since scan_ccache() is only looking at metadata in the cache entries,
and does not need to actually use any tickets or session keys, set
the KRB5_TC_NOTICKET flag on the ccache before scanning it.  This
will allow the MSLSA implementation to return a cred for the TGT
entry and cause the GSSAPI credential selection algorithm to function
properly.

ticket: 8000 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll fails to detect TGTs in the MSLSA cache when UAC is enabled