Suppress Perl warning on remctl password change tests

When remctl is supported, $error contains an undefined value,
which was producing spurious Perl warnings.

Change-Id: I99cf92d53c0a82c00570da802ba1beb817d6deb8
Reviewed-on: https://gerrit.stanford.edu/1535
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add new mp and v factors

Add new factors mp (mobile push) and v (voice), which count as
separate classes for determining multifactor.  This means the
combination of those factors with any other factor class will result
in a synthensized multifactor factor.

Change-Id: I6911b6b70376fbab6d63445a98653f41e4a749a2
Reviewed-on: https://gerrit.stanford.edu/1536
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix various grammar and wording issues in the protocol spec

Clarify the contents of the token returned to the WAS from the
WebKDC and the reason for having the session key both outside and
inside the encrypted token.  Fix various other grammar and wording
mistakes, including using a more appropriate preposition than "in"
for specifying the key used for an encryption.

Thanks to Adam Lewenberg for the review.

Change-Id: I3cdea8b61c5029684b9cd75140f113a23d3e5806
Reviewed-on: https://gerrit.stanford.edu/1537
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Warn about credential delegation to load-balanced pools

Warn in the mod_webauth documentation that, when using credential
delegation to a load-balanced pool, all members of that pool must have
the same Kerberos identity.

Change-Id: Ib7ec41f1663d29ef8b32f28c0b39fbb4d35f256e
Reviewed-on: https://gerrit.stanford.edu/1538
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add a test for StanfordAuth

Verify in the test suite that StanfordAuth works, and that
SU_AUTH_USER and SU_AUTH_AGE are set properly.

Change-Id: I7dfdc7e76e2c3f706549d7e130356f2ddce01b4d
Reviewed-on: https://gerrit.stanford.edu/1539
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add FAST support, fix WebKdcKerberosFactors

Add a new configuration directive, WebKdcFastArmorCache, for
mod_webkdc.  If set, this specifies the path to a Kerberos ticket
cache that can (and must) be used for FAST (Flexible Authentication
Secure Tunneling) protection of Kerberos password authentications.
The Kerberos KDC must also support FAST in order to safely enable this
option.  Based on a patch by Jakob Uhd Jepsen (One.com A/S).

Fix parsing of the WebKdcKerberosFactors configuration directive.

Change-Id: Ib2849b267e83e07d376eb4ab2dd64db75cb1e7b7
Reviewed-on: https://gerrit.stanford.edu/1540
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add webauth_krb5_set_fast_armor_path to library exports

Also document the addition of the new public interface in NEWS.

Change-Id: I4a565ebfe7a358e0c16ac6c1277bc95dfbe714e1
Reviewed-on: https://gerrit.stanford.edu/1541
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Skip FAST tests if the KDC does not support FAST

Attempt a basic authentication with FAST, and skip the WebKDC
tests using FAST if that authentication fails.

Change-Id: Iba11997e7a9fffd6acaaf8680545a9ecff156de3
Reviewed-on: https://gerrit.stanford.edu/1542
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>