o use krb5_init_secure_context() if we have it
o pass an encryption type of 0 to krb5_kt_read_service_key() instead of
ENCTYPE_DES_CBC_MD5 to let kerberos choose.
like we did before I messed things up ;-)
Use krb5_principal_get_comp_string() to do the same thing w/ Heimdal.
I'm not sure if the component should be 0 or 1 in this case.
#define ENCTYPE_DES_CBC_MD5 ETYPE_DES_CBC_MD5 for Heimdal since
older versions lack ENCTYPE_DES_CBC_MD5. This is gross and there
should be a configure check for this I guess.
changable at runtime (and on a global, per-host and per-user basis).
Both the names and the internal representation are still subject to change.
It was necessary to make sudo_user.runas but a char ** instead of a
char * since this value can be changed by a Defaults line. There is a
similar (but more complicated) issue with sudo_user.prompt but it
is handled differently at the moment.
Add a "-L" flag to list the name of options with their descriptions. This
may only be temporary.
Move some prototypes to parse.h
Be much less restrictive on what is allowed for a username.
add a flag to specify an auth method is running alone (the only
one). Pass auth methods their sudo_auth pointer, not the data
pointer. This allows us to get at the flags and tell if we are the
only auth method. That, in turn, allows the method to be able to
decide what should/should not be a fatal error. Currently only
rfc1938 uses it this way, which allows us to kill the OTP_ONLY
define and te hackery that went with it. With access to the
sudo_auth struct, methods can also get at a string holding their
cannonical name (useful in error messages).
the main loop. This allows auth routines to differentiate between
initialization that happens once vs. setup that needs to run each time
through the loop.
