auth: Moved all passdb/userdb template handling to auth_passdb/userdb. This is because passdb_find() and userdb_find() attempts to avoid duplicating passdbs and userdbs when they have identical driver+args. This deduplication is useful when using multiple protocol { .. } blocks that duplicate some passdb/userdb backends. For example we might want to have only a single SQL connection regardless of how the protocol-specific passdbs and userdbs are being set up. All the default/override_fields and result_* settings aren't relevant to the passdb/userdb backends, so removing them will again allow the deduplication to work correctly.

auth: Moved cache_key from passdb_module to auth_passdb. This is in preparation for the next changeset, which moves default/override_fields also to auth_passdb.

auth: Added userdb result_success/failure/tempfail and skip settings, similar to passdb's.

auth: Added passdb { result_* and skip } settings. passdb { skip = never | authenticated | unauthenticated } can be used to skip over a passdb lookup based on previous passdb lookups. passdb { result_success, result_failure, result_internalfail } can be used to specify what to do on those conditions. Choices as continue, continue-ok, continue-fail, return, return-ok, return-fail. The -ok and -fail variants update the current "success" flag, while continue/return uses the current flag. The authentication succeeds only if the success flag is set after the last lookup. The continue variants continue to the next passdb, while return variants finish the lookup immediately.

Marked functions parameters that are allowed to be NULL. Some APIs were also changed. The non-obvious APIs where NULL parameter was changed to "" are master_service_init() and auth_master_user_list_init(). These checks can currently be enabled only on a patched clang: http://llvm.org/bugs/show_bug.cgi?id=6786

auth: Changed how auth deinitilization works. --HG-- branch : HEAD

auth: Fixed support for per-service auth settings. --HG-- branch : HEAD

auth: Initial support for per-protocol auth settings. Currently the list of services is hard-coded. This should be changed so that config lookup returns the service names. --HG-- branch : HEAD

auth: Moved mechanism list out of struct auth. It could have been good there, except mechanism list is sent before there's any knowledge of what type of client is on the other side. Maybe in future different mechanism list could be given based on the unix socket name. --HG-- branch : HEAD

auth: Removed unused pool parameter from struct auth_passdb/auth_userdb. --HG-- branch : HEAD

auth: Cleaned up struct auth_passdb/auth_userdb. --HG-- branch : HEAD

auth: auth_penalty is now a global single instance. --HG-- branch : HEAD

auth: auth_userdb and auth_passdb no longer has pointer to struct auth. --HG-- branch : HEAD

auth: Moved some variables generated from settings to struct auth_settings. --HG-- branch : HEAD

auth: Connect to anvil-auth-penalty before dropping root privileges. --HG-- branch : HEAD

Initial commit for config rewrite. --HG-- branch : HEAD

Added auth_failure_delay setting. --HG-- branch : HEAD

Allocate auth_realms from auth pool instead of from data stack. --HG-- branch : HEAD

Changed .h ifdef/defines to use <NAME>_H format. --HG-- branch : HEAD

Changed plugin handling. We'll just load and call _init() functions for all plugins in $moduledir/auth/. --HG-- branch : HEAD

Added auth_gssapi_hostname setting. --HG-- branch : HEAD

Moved the <hidden> string into a macro. Hide the password also from LDAP replies. --HG-- branch : HEAD

Added auth_username_format setting. --HG-- branch : HEAD

Added auth_master_user_separator setting which allows giving the master username inside the normal username. --HG-- branch : HEAD

Removed master_no_passdb setting. Added pass setting which can be used to do the same thing, and other things. Now setting pass=yes to a passdb continues to next passdb if the lookup succeeded. This allows eg. requiring the user to be in multiple passdbs, or doing a username conversion before running the actual userdb, etc. --HG-- branch : HEAD

Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. --HG-- branch : HEAD

Added auth_debug_passwords setting. If it's not enabled, hide all password strings from logs. --HG-- branch : HEAD

deinit, unref, destroy, close, free, etc. functions now take a pointer to their data pointer, and set it to NULL. This makes double-frees less likely to cause security holes. --HG-- branch : HEAD

Added "bool" type and changed all ints that were used as booleans to bool. --HG-- branch : HEAD

Added ssl_username_from_cert setting. Not actually tested yet.. --HG-- branch : HEAD

Added deny password databases. --HG-- branch : HEAD

Replaced userdb/passdb settings with blocks so it's possible to give multiple ones. Plaintext password mechanisms now support handling multiple passdbs, but others don't yet. Also fixed a few memory leaks. --HG-- branch : HEAD

Restructuring of auth code. Balancer auth processes were a bad idea. Usually the balancer itself took as much CPU as the actual workers because it acted as a proxy. Now auth worker means different thing: they're used to execute blocking passdb and userdb queries. Currently just MySQL (PAM and checkpassword in TODO). --HG-- branch : HEAD

Changed the way multiple auth processes are handled. It no longer uses a pid appended to socket name but instead there's a balancer process which proxies the requests to worker processes. --HG-- branch : HEAD

Added auth_request_log_*(). --HG-- branch : HEAD

Reorganized the code to have less global/static variables. --HG-- branch : HEAD

We have now separate "userdb" and "passdb". They aren't tied to each others in any way, so it's possible to use whatever user database with whatever password database. Added "static" userdb, which uses same uid/gid for everyone and generates home directory from given template. This could be useful with PAM, although insecure since everyone uses same uid. Not too well tested, and userdb/passdb API still needs to be changed to asynchronous for sql/ldap/etc lookups. --HG-- branch : HEAD

Naming change for function typedefs. --HG-- branch : HEAD

Initial support for Cyrus SASL 2 library. I couldn't get it to work yet though :) --HG-- branch : HEAD

Naming style changes, finally got tired of most of the typedefs. Also the previous enum -> macro change reverted so that we don't use the highest bit anymore, that's incompatible with old indexes so they will be rebuilt. --HG-- branch : HEAD

t_strsplit() returns now const char **, which removes a few nasty casts. Removed a few unneded functions and did some small cleanups. --HG-- branch : HEAD

Instead of just trusting randomness of authentication cookies between auth<->master<->login process IPC, master now doesn't accept any cookies from login process which weren't created by it (identified by PID). When login process dies, all it's pending cookies are also removed, so I can't see even a theoretical possiblity anymore for exploited login process to authenticate as someone else. Also fixed some int -> unsigned int. --HG-- branch : HEAD

s/user_data/context/ and some s/Data/Context/ --HG-- branch : HEAD

Initial revision --HG-- branch : HEAD