* This broke corner cases when used with
      default_tkt_types = des-cbc-crc
   and DES enabled on an AD domain.
 * This is fixed in kerberos instead, in a more correct way
   and in a way which we cannot replicate.

This simplifies configuration by eliminating the need to
specifiy both krb5_keytab and ldap_krb5_keytab if the keytab is
not located at /etc/krb5.keytab

This patch adds support for checking whether a user is expired or
disabled in AD.

These new providers take advantage of existing code for the KRB5
provider, providing sensible defaults for operating against an
Active Directory 2008 R2 or later server.

This new identity provider takes advantage of existing code for
the LDAP provider, but provides sensible defaults for operating
against an Active Directory 2008 R2 or later server.

This will eliminate ambiguity for the AD provider

This will reduce code duplication between the krb5, ipa and ad
providers

This function is not supposed to return any newly-allocated memory
directly. It was actually leaking the memory for krb5_servers if
krb5_kdcip was being used, though it was undetectable because it
was allocated on the provided memctx.

This patch removes the memctx parameter and allocates krb5_servers
temporarily on NULL and ensures that it is freed on all exit
conditions. It is not necessary to retain this memory, as
dp_opt_set_string() performs a talloc_strdup onto the appropriate
context internally.

It also updates the DEBUG messages for this function to the
appropriate new macro levels.