Improved krb5_aname_to_lname() and krb5_kuserok() in master

I've just pushed improvements to krb5_kuserok() to master.  A few days
ago I pushed improvements to krb5_aname_to_lname().

Admins can now have full control over how these two functions behave via:

 - plugins (write your own!)
 - new configuration options for several built-in plugins
 - krb5.conf compatibility with MIT (not including aname2lname sed RULEs)

The new configuration parameters are:

[libdefaults] k5login_directory       (MIT compat)
[libdefaults] k5login_authoritative   (MIT compat)
[libdefaults] kuserok                    (new)
[libdefaults] aname2lname-text-db (new)

[realms] REALM auth_to_local_names (MIT compat)
[realms] REALM auth_to_local             (MIT compat)

One can now provide a database of aname2lname mappings via
aname2lname-text-db as well as via auth_to_local_names and
auth_to_local = DB:/path/to/db.

One can specify the use of MIT or Heimdal default behaviors for
krb5_aname_to_lname().  Don't like Heimdal's convention for root/*
principals?  You can now turn it off.

It is now also possible to configure krb5_aname_to_lname() to not
perform any mappings, via the NONE rule.

Similarly krb5_kuserok() can be configured to behave just like MIT's,
and it can be configured to always return FALSE.  It can also be
configured to use k5login files from a system location.

Finally, there are now tests for most of the new functionality
(checking user k5login support is not fully tested as the testsuite
should not modify any user's .k5login files).

Nico
--