[Dovecot] GSSAPI Cross-Realm Patch

[Zachary Kotlarek]

I've written a GSSAPI cross-realm auth patch for people not lucky enough 
to have the __gss_userok function, though it should apply pretty cleanly 
with that patch in place as well.

The patch is available at:
http://zinux.cynicbytrade.com/svn/servers/dovecot/cross-realm.diff.bz2

It works for me on MIT-kerb, and I tested compilation against heimdal, 
but I don't have a cross-realm setup to test functionality under heimdal 
(though I also have no reason to think it wouldn't work).

Since neither MIT nor heimdal provide a gss_userok() function, I used 
the krb5_userok() function. So if you're using a mechanism other than 
krb5 this won't work. But it's the same thing that OpenSSH and the apps 
distributed with heimdal do, so it seemed relatively safe.

I also choose to append the krb5_userok() check rather than replace the 
gss_compare_name() check -- that way same-realm auth works for non-krb5 
mechanisms, and my new code doesn't get called unless the same-realm 
check fails. If you don't care about other mechanisms it would be faster 
to bypass the gss_compare_name() check entirely.

If this is something you'd like to mainline I'd be happy to standardize 
the coding style -- just point me to a style definition document. And if 
it doesn't hit the mainline I expect to maintain it for the foreseeable 
future, with updates at the same URL.

     Zach