Fix kpropd -x

A missing break in the switch statement caused kpropd -x to error out
with a usage message.

(cherry picked from commit 75b2ec88c4d75e7215322d2f0019307310cc9701)

ticket: 7854
version_fixed: 1.12.2
status: resolved
Properly reflect MS krb5 mech in SPNEGO acceptor

r25590 changed negotiate_mech() to return an alias into the acceptor's
mech set, with the unfortunate side effect of transforming the
erroneous Microsoft krb5 mech OID into the correct krb5 mech OID,
meaning that we answer with a different OID than the requested one.
Return an alias into the initiator's mech set instead, and store that
in mech_set field the SPNEGO context.  The acceptor code only uses
mech_set to hold the allocated storage pointed into by internal_mech,
so this change is safe.

(cherry picked from commit 8255613476d4c1583a5e810b50444f188fde871f)

ticket: 7858
version_fixed: 1.12.2
status: resolved
Test SPNEGO acceptor response to MS krb5 mech OID

In t_spnego.c, add code to make a SPNEGO request with the erroneous
Microsoft OID value and examine the response to make sure that it uses
the same OID value as the request did.  The token and tmp variables
were unused, so rename them to itok and atok for the purpose of the
new test code.

(cherry picked from commit 53cfb8327c452bd72a8e915338fb5ec838079cd3)

ticket: 7858
version_fixed: 1.12.2
status: resolved
Fix SAM-2 preauth when password argument is used

sam2_process accesses gak_data to get the password, so that it can do
string-to-key with the etype in the SAM-2 challenge.  When #7642
changed gic_pwd.c to use struct gak_password instead of krb5_data,
sam2_process wasn't altered to match.  We don't see a problem when the
password is read through the prompter (as with kinit), because the
password winds up in the storage field at the beginning of the
gak_password structure.  But when a password is supplied as a
parameter (as with ksu), the storage field is empty and we get the
wrong answer from sam2_process.

(cherry picked from commit 3bedfe7c3724b0d22c72d1684f1cf76cfb600fdd)

ticket: 7862
version_fixed: 1.12.2
status: resolved
Update doc build instructions

Documentation build instructions in doc/README were out of date.
Update them.

(cherry picked from commit bfc8f194ae431fc4fadaa431a2a636b4e9b025dd)

ticket: 7864
version_fixed: 1.12.2
status: resolved
Support referrals from Windows Server 2003

Although RFC 6806 Section 7 requires servers to indicate a client
referral in a WRONG_REALM message, Microsoft Windows Server 2003
returns this information in a message with error code
PRINCIPAL_UNKNOWN.  Failure to follow the referral in these messages
prevents referral chasing in Windows Server 2003 forests.  Detect
referral messages of this type by checking for a non-empty
client.realm field in the response, and activate the referral logic in
these cases.

[tlyu@mit.edu: style, comments, and commit message]

(cherry picked from commit 3093b92734adfe2deb9ad6bad5a221acc967fd8b)

ticket: 7856
version_fixed: 1.12.2
status: resolved
Avoid duplicate "/etc/krb5.conf" in profile path

If configure gets run with --sysconfdir=/etc, "/etc/krb5.conf" shows
up twice in the profile path, which causes its contents to be read
twice.  This can cause some confusing and possibly problematic
behavior.

Add some logic to configure.in to avoid adding the duplicate entry for
"/etc/krb5.conf".

Reported independently by Denis Vlasenko and Fredrik Tolf.

(back ported from commit 8df1965d1ccdbcb8d74a3e68ad35d7579db9ac44)

ticket: 3277
version_fixed: 1.12.2
status: resolved