Update .gitignore to ignore all test binaries and output.
Merge pull request #94 from jelmer/ignore-test-output

Update .gitignore to ignore all test binaries and output.
kinit: get_switched_ccache

Provide a new internal function called get_switched() to encapsulate
the algorithm for selecting a credential cache when the selected
ccache type supports switching.  There is no change in behavior for
UNIX which always calls krb5_cc_new_unique().  However, on Windows
alternate behavior is provided when the ccache type is API or MSLSA.

For the API ccache the default ccache name is stored in the Windows
registry which is shared across all logon sessions belonging to a
user.  For users that are members of the Administrators group this
includes both the UAC restricted and elevated sessions sharing the
same desktop.  It is very disconcerting when the elevated session obtains
credentials for the same client principal as the restricted session
and then all apps in the restricted session lose access to their
credential cache.   For Windows, the API credential caches are named
after the principal that is stored within them.  It provides for a
better end user experience.

For the MSLSA ccache tickets belonging to multiple principals are
all stored within the MSLSA ccache.  As a result, all attempts to
switch ccache names default back to the one and only one name.

Change-Id: I7865cd044cff01ff38ab107ec0961e42788fa073
roken: Windows ELOOP definition

Microsoft VC 2010 defines ELOOP as 114

Change-Id: Iba6cfd83e4a9ea1d43ed8aff7893d557648fc7e5
klist: fix spelling in comments
Merge pull request #99 from ktdreyer/klist-spelling-comments

klist: fix spelling in comments
kadmin: handle systemd setpgid failure

When running as a service under systemd, kadmin cannot successfully use
setpgid().  The call fails with EPERM. Do not treat this as a fatal
error; instead, allow kadmind to continue starting up.
Remove kerberos 4 references from kimpersonate.8.
Merge pull request #101 from jelmer/kimpersonate-no-kerb4

Remove kerberos 4 references from kimpersonate.8.
afslog.1: Remove documentation for removed no-v4 argument.
Remove references to KRBTKFILE from login.1 and kinit.1.
Merge pull request #102 from jelmer/manpages-no-krb4

Remove references to Kerberos 4 from manpages.
Move kadmin and ktutil to /usr/bin.
Merge pull request #104 from jelmer/kadmin-ktutil-to-usr-bin

Move kadmin and ktutil to /usr/bin.
Install compatibility symlinks for kadmin and ktutil.
asn1: check overflow against SIZE_MAX not +1

A comparison of (len > len + 1) is permitted to be optimized out
as dead code because it can't be true.  Overflowing is an exceptional
condition that results in undefined behavior.  The correct conditional
is (len == SIZE_MAX) when len is size_t.

Change-Id: Ia5586556a973d9fa5228430c4304ea9792c996bb
kadm5: fix race in Makefile with kadm5_err.h

When running make with -j4, occasionally kadm5 fails due to a missing
header file kadm5_err.h. Fix the race condition.

Reported at https://bugzilla.redhat.com/1115164

Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com>
Use correct value for anonymous flags

The KDC Option and Ticket Flag for the anonymous extension were changed
from 14 to 16 due to a conflict with S4U2Proxy in version 11 of the anonymous
draft (now RFC6112). Fix the definitions
Recognize anonymous AS requests using bit 14

Check KDC Option bit 14 in addition to 16 when identifying anonymous
AS-REQs. This provides compatibility with older heimdal releases.
Include empty PKINIT-KX padata

rfc6112 requires kdcs implementing anonymous PKINIT to include an
empty PKINIT-KX padata in PREAUTH_REQUIRED messages.
Including this improves compatibility with MIT kerberos.