Update kadmin set_string document

Added 'otp' as an acceptable attribute name.  Added examples.
Also, x-ref kadmin document from otp.rst.
Avoid duplicate "/etc/krb5.conf" in profile path

If configure gets run with --sysconfdir=/etc, "/etc/krb5.conf" shows
up twice in the profile path, which causes its contents to be read
twice.  This can cause some confusing and possibly problematic
behavior.

Add some logic to configure.in to avoid adding the duplicate entry for
"/etc/krb5.conf".

Reported independently by Denis Vlasenko and Fredrik Tolf.

ticket: 3277
tags: pullup
target_version: 1.12.2
Minimize race conditions in t_iprop.py

Augment kpropd's debugging output so we can see the starting and
ending serial numbers of a sync, and check them in t_iprop.py's
wait_for_prop to make sure we're observing the correct sync each time.
Try to make sure we only send SIGUSR1 when kpropd is actually
sleeping, by waiting for it to print its pre-sleep message to stderr
after a full dump and after each sync.  This isn't perfect, as there
is a short window between printing to stderr and actually sleeping,
but we can't do any better until kpropd has a more reliable mechanism
for triggering immediate updates.
Assume <stdint.h> and fixed-width types

Make unconditional use of <stdint.h> and fixed-width types such as
uint32_t.  k5-plugin.h doesn't use any special integer types, so
remove the conditional include block there.  Nothing uses
INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
Get rid of builtin AES uitypes.h

Remove uitypes.h and just include stdint.h; all we need from it is
uint{8,16,32}_t.
Stop generating gssapi_krb5.h

We started generating gssapi_krb5.h from gssapi_krb5.hin when we
needed to use a 64-bit type for lucid contexts.  Since we can now
assume a standard name for 64-bit types, we can stop generating the
header.
Eliminate internal fixed-width type wrappers

Directly use stdint.h names for integer types in preference to the
various internal names we have made up for them.
In kdb5_util dump, only lock DB for iprop dumps

Revert #7384, as there are no longer policy refcounts.  For iprop
dumps we want to make sure that the reported serial number matches the
DB state (although we could perhaps relax that requirement with enough
analysis), but for non-iprop dumps we don't need any transactional
guarantees.

Also use the correct constant name for the locking mode (the numeric
value is the same, fortunately), and only unlock the database if we
successfully locked it.

ticket: 7869 (new)
Use portable transport enumerator for k5_sendto

In k5_sendto and k5_locate_server, replace "socktype" parameters with
a new enumerator k5_transport, so that we can add new transports which
are not in the socket type namespace.

[ghudson@mit.edu: renamed type to k5_transport; clarified commit
message]
[kaduk@mit.edu: use 'transport' for the name of variables of type k5_transport]
[nalin@redhat.com: update the test program]
Build support for HTTPS transport
Remaining cm read/write mutator functions
Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGE
Dispatch-style protocol switching for transport
HTTPS transport (Microsoft KKDCPP implementation)
Track the realm name for MS-KKDCP

Always pass a realm name to set_conn_state_msg_length(), to ensure that
we include the not-actually-optional target-domain field if we're using
MS-KKDCP.
Don't try to zero the byte after the buffer
Be more exacting about the reply content-length
Differentiate HTTPS and TCP trace messages
Remove a check on the kpasswd server's address

This test breaks when we're sending password changes over HTTP, and most
likely under NAT, too.
Add http_anchors, _revoke, and _hostname settings

Add http_anchors, http_revoke, http_hostname and
http_require_crl_checking settings, mimicking both the locations and
effects of their similarly-named PKINIT counterparts, but affecting
HTTPS connections to KDC proxy servers.