Some LDAP servers allow binding with blank passwords. We should
not allow a blank password to authenticate the SSSD.

There was a faulty check in get_domain() that led to the
*_provider options being re-added, sometimes after options related
to them had already been set. If those options had a default
value, they would be overwritten by the default.

Fixes: https://fedorahosted.org/sssd/ticket/441

The PAM standard allows for messages of any length to be returned
to the client. We were discarding all messages of length greater
than 255. This patch dynamically allocates the message buffers so
we can pass the complete message.

This resolves https://fedorahosted.org/sssd/ticket/432

- use domain_to_basedn() to construct LDAP search paths for IPA HBAC
- move domain_to_basedn() to a separate file to simplify the build of
  a test

The krb5 options were out of sync, causing a runtime abort.

This option is needed for the rare case where a poll() call during
ldap_sasl_interactive_bind_s() is interrupted by a signal.
LDAP_OPT_RESTART enables the handling of the EINTR error instead of
returning an error.

In an environment with slave KDCs and a central server where password
changes are allowed the request for a new TGT immediately after the
password change should be made against this server, because the slave
server might not know the new password.

To achieve this the Kerberos localtor plugin now returns the address of
the kpasswd server as master_kdc.