Add upgrade warning about keyring permissions

Retroactively add a warning to NEWS about the permission change
required for the keyring when upgrading from older versions of
WebAuth.  Clarify keyring permissions in INSTALL.

Change-Id: Ifb138231f7483d87af120e94a5c5ee5c0d8f249e
Reviewed-on: https://gerrit.stanford.edu/1474
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix formatting of the WebAuthCookiePath example

Change-Id: I0405b6c8306eedb69f8927090655851c3be2d863
Reviewed-on: https://gerrit.stanford.edu/1475
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Check the username parameter in WebLogin multifactor pages

In WebLogin, verify that the username form field was sent before
attempting to do multifactor operations and return an error if it
isn't, avoiding undefined variable warnings and other errors deeper in
the WebLogin code.

Change-Id: Id137ce0ce836477e738d386b17b13122c575c6b4
Reviewed-on: https://gerrit.stanford.edu/1476
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix AuthType StanfordAuth

Support for AuthType StanfordAuth (for backward compatibility with
WebAuth 2.5) was broken in WebAuth 4.6.0, causing mod_webauth to
reject all accesses to resources protected with that AuthType.  This
has been fixed in this release.

Change-Id: I52f97f8d6a58aa512faf39934295aa93285630d3
Reviewed-on: https://gerrit.stanford.edu/1482
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Improve WebLogin logic for showing password expiration warning

Show the expiring password warning in WebLogin if the browser request
was a POST.  Previously, it was skipped if the user had a REMOTE_USER
preference or if the browser presented a single sign-on cookie.  This
was too conservative, not warning in cases when REMOTE_USER failed,
when the browser presented an expired single sign-on cookie (systems
that are suspended rather than shut down, for example), and when the
user has to do multifactor authentication.  Checking for a POST is a
closer match for when we can force a confirmation screen without too
much user disruption.

Change-Id: Iacfe1b3d5f5962fe303157e6d9f8ce6be47f33eb
Reviewed-on: https://gerrit.stanford.edu/1483
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update Perl module versions for 4.6.1

Change-Id: I1a52ee531d1ad49f47c58d20c1f1b224b98d967e
Reviewed-on: https://gerrit.stanford.edu/1484
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Avoid gcc warnings when built without remctl support

GCC 4.8 warns about use of uninitialized variables when the userinfo
code is built without remctl support since it doesn't realize we
never reach the problematic code.  Initialize the relevant variables
to NULL to unconfuse it.

Change-Id: I689fc1ab3c8f7d7329ad16e2bb5c3e9603bfb49d
Reviewed-on: https://gerrit.stanford.edu/1485
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Build correctly when remctl support is disabled

The new remctl-based password change protocol broke the build of
the library when remctl support was not enabled due to an
incorrectly-named stub function.  Fix the function name and
diagnose attempting to configure remctl-based password change
without support for it earlier in the code path.

Thanks to Peter Wienemann for the report.

Change-Id: I120418bb8aaff7c6c406ef6965fcdd5e6ab1900d
Reviewed-on: https://gerrit.stanford.edu/1486
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Skip Perl tests of remctl password change if support missing

Check if remctl-based password change is failing because the
library was not built with remctl support and skip those tests
in that case.

Change-Id: I5ea5cc962713f050bfa8ad90653f5644e6efd926
Reviewed-on: https://gerrit.stanford.edu/1487
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Never bypass the confirm page if WebKDC lists permitted_authz

To: webauth-info@mailman.stanford.edu
Date: Tue, 8 Jul 2014 11:26:18 -0400 (8 hours, 12 minutes, 35 seconds ago)

Override the value of BYPASS_CONFIRM if the WebKDC returns a list
of permitted_authz identities.  Without this, users are unable to
assert an authz identity.

Change-Id: I777742aaf46b12d6fd1c8abc37b01ece68656067
Reviewed-on: https://gerrit.stanford.edu/1512
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add NEWS entry for the WebLogin authorization change

Change-Id: I725c5aef03e8cc965eb25a8c54143a8da0d524a6
Reviewed-on: https://gerrit.stanford.edu/1513
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add NEWS entry for remctl compilation fixes

Change-Id: I62177bb1fa89fc77d8fa777f6f51ce92c1aa2216
Reviewed-on: https://gerrit.stanford.edu/1514
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update WebKDC to WebLogin protocol for new factor information

Add support for passing additional information about each
configured factor to enable better prompting in WebLogin.  Provide
a device ID and a mechanism for WebLogin to return it to the
WebKDC when requesting authentication.

Change-Id: I8bf0d35216e5861d0173359b992ed6f24207fd76
Reviewed-on: https://gerrit.stanford.edu/1533
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Suppress Perl warning on remctl password change tests

When remctl is supported, $error contains an undefined value,
which was producing spurious Perl warnings.

Change-Id: I99cf92d53c0a82c00570da802ba1beb817d6deb8
Reviewed-on: https://gerrit.stanford.edu/1535
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add new mp and v factors

Add new factors mp (mobile push) and v (voice), which count as
separate classes for determining multifactor.  This means the
combination of those factors with any other factor class will result
in a synthensized multifactor factor.

Change-Id: I6911b6b70376fbab6d63445a98653f41e4a749a2
Reviewed-on: https://gerrit.stanford.edu/1536
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix various grammar and wording issues in the protocol spec

Clarify the contents of the token returned to the WAS from the
WebKDC and the reason for having the session key both outside and
inside the encrypted token.  Fix various other grammar and wording
mistakes, including using a more appropriate preposition than "in"
for specifying the key used for an encryption.

Thanks to Adam Lewenberg for the review.

Change-Id: I3cdea8b61c5029684b9cd75140f113a23d3e5806
Reviewed-on: https://gerrit.stanford.edu/1537
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Warn about credential delegation to load-balanced pools

Warn in the mod_webauth documentation that, when using credential
delegation to a load-balanced pool, all members of that pool must have
the same Kerberos identity.

Change-Id: Ib7ec41f1663d29ef8b32f28c0b39fbb4d35f256e
Reviewed-on: https://gerrit.stanford.edu/1538
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add a test for StanfordAuth

Verify in the test suite that StanfordAuth works, and that
SU_AUTH_USER and SU_AUTH_AGE are set properly.

Change-Id: I7dfdc7e76e2c3f706549d7e130356f2ddce01b4d
Reviewed-on: https://gerrit.stanford.edu/1539
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add FAST support, fix WebKdcKerberosFactors

Add a new configuration directive, WebKdcFastArmorCache, for
mod_webkdc.  If set, this specifies the path to a Kerberos ticket
cache that can (and must) be used for FAST (Flexible Authentication
Secure Tunneling) protection of Kerberos password authentications.
The Kerberos KDC must also support FAST in order to safely enable this
option.  Based on a patch by Jakob Uhd Jepsen (One.com A/S).

Fix parsing of the WebKdcKerberosFactors configuration directive.

Change-Id: Ib2849b267e83e07d376eb4ab2dd64db75cb1e7b7
Reviewed-on: https://gerrit.stanford.edu/1540
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add webauth_krb5_set_fast_armor_path to library exports

Also document the addition of the new public interface in NEWS.

Change-Id: I4a565ebfe7a358e0c16ac6c1277bc95dfbe714e1
Reviewed-on: https://gerrit.stanford.edu/1541
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>