vendor/pam-krb5/4.11vendor/pam-krb5

254 files changed, 29790 insertions, 0 deletions

diff --git a/.clang-format b/.clang-format
new file mode 100644
index 000000000000..da1e4e8030d3
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,30 @@
+# Configuration for clang-format automated reformatting.  -*- yaml -*-
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Copyright 2020-2021 Russ Allbery <eagle@eyrie.org>
+#
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice
+# and this notice are preserved.  This file is offered as-is, without any
+# warranty.
+#
+# SPDX-License-Identifier: FSFAP
+
+---
+Language: Cpp
+BasedOnStyle: LLVM
+AlignConsecutiveMacros: true
+AlignEscapedNewlines: Left
+AllowShortEnumsOnASingleLine: false
+AlwaysBreakAfterReturnType: AllDefinitions
+BreakBeforeBinaryOperators: NonAssignment
+BreakBeforeBraces: WebKit
+ColumnLimit: 79
+IndentPPDirectives: AfterHash
+IndentWidth: 4
+IndentWrappedFunctionNames: false
+MaxEmptyLinesToKeep: 2
+SpaceAfterCStyleCast: true
+---
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000000..5ace4600a1f2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
new file mode 100644
index 000000000000..6120a6cf8f58
--- /dev/null
+++ b/.github/workflows/build.yaml
@@ -0,0 +1,44 @@
+name: build
+
+on:
+  push:
+    branches-ignore:
+      - "debian/**"
+      - "pristine-tar"
+      - "ubuntu/**"
+      - "upstream/**"
+    tags:
+      - "release/*"
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    env:
+      AUTHOR_TESTING: 1
+      C_TAP_VERBOSE: 1
+
+    strategy:
+      fail-fast: false
+      matrix:
+        kerberos:
+          - "mit"
+          - "heimdal"
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: install
+        run: sudo ci/install
+      - name: kdc-setup-mit
+        run: sudo ci/kdc-setup-mit
+        if: matrix.kerberos == 'mit'
+      - name: kdc-setup-heimdal
+        run: sudo ci/kdc-setup-heimdal
+        if: matrix.kerberos == 'heimdal'
+      - name: test
+        run: ci/test
+        env:
+          KERBEROS: ${{ matrix.kerberos }}
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 000000000000..9c3abee30255
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,344 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Comment: This file documents the copyright statements and licenses for
+ every file in this package in a machine-readable format.  For a less
+ detailed, higher-level overview, see README.
+ .
+ For any copyright year range specified as YYYY-ZZZZ in this file, the
+ range specifies every single year in that closed interval.
+
+Files: *
+Copyright: 1999-2000 Frank Cusack <fcusack@fcusack.com>
+  2005 Andres Salomon <dilinger@debian.org>
+  2005-2010, 2014-2015, 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
+  2008-2014 The Board of Trustees of the Leland Stanford Junior University
+License: BSD-3-clause or GPL-1+
+
+Files: .clang-format docs/pam_krb5.5 docs/pam_krb5.pod pam-util/vector.c
+ pam-util/vector.h portable/asprintf.c portable/dummy.c
+ portable/issetugid.c portable/kadmin.h portable/krb5-extra.c
+ portable/krb5.h portable/macros.h portable/mkstemp.c portable/pam.h
+ portable/pam_syslog.c portable/pam_vsyslog.c portable/reallocarray.c
+ portable/stdbool.h portable/strndup.c portable/system.h tests/README
+ tests/TESTS tests/config/README tests/data/cppcheck.supp
+ tests/fakepam/README tests/pam-util/vector-t.c tests/portable/asprintf-t.c
+ tests/portable/mkstemp-t.c tests/portable/strndup-t.c
+Copyright: 2005-2012, 2014-2021 Russ Allbery <eagle@eyrie.org>
+  2006-2014 The Board of Trustees of the Leland Stanford Junior University
+License: all-permissive
+ Copying and distribution of this file, with or without modification, are
+ permitted in any medium without royalty provided the copyright notice and
+ this notice are preserved.  This file is offered as-is, without any
+ warranty.
+
+Files: Makefile.in
+Copyright: 1994-2021 Free Software Foundation, Inc.
+  1999-2000 Frank Cusack <fcusack@fcusack.com>
+  2005 Andres Salomon <dilinger@debian.org>
+  2005-2007, 2014, 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
+  2009, 2011-2012
+    The Board of Trustees of the Leland Stanford Junior University
+License: FSF-unlimited, and BSD-3-clause or GPL-1+
+
+Files: aclocal.m4 m4/ltoptions.m4 m4/ltsugar.m4 m4/ltversion.m4
+ m4/lt~obsolete.m4
+Copyright: 1996-2021 Free Software Foundation, Inc.
+License: FSF-unlimited
+
+Files: build-aux/ar-lib build-aux/compile build-aux/depcomp
+ build-aux/missing
+Copyright: 1996-2021 Free Software Foundation, Inc.
+License: GPL-2+ with Autoconf exception or BSD-3-clause or GPL-1+
+
+Files: build-aux/config.guess build-aux/config.sub
+Copyright: 1992-2018 Free Software Foundation, Inc.
+License: GPL-3+ with Autoconf exception or BSD-3-clause or GPL-1+
+
+Files: build-aux/install-sh
+Copyright: 1994 X Consortium
+License: X11
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to permit
+ persons to whom the Software is furnished to do so, subject to the
+ following conditions:
+ .
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+ .
+ Except as contained in this notice, the name of the X Consortium shall
+ not be used in advertising or otherwise to promote the sale, use or other
+ dealings in this Software without prior written authorization from the X
+ Consortium.
+
+Files: build-aux/ltmain.sh
+Copyright: 1996-2015 Free Software Foundation, Inc.
+License: GPL-2+ with Libtool exception or BSD-3-clause or GPL-1+, and GPL-3+ with Libtool exception or BSD-3-clause or GPL-1+, and GPL-3+
+
+Files: ci/install ci/kdc-setup-heimdal ci/kdc-setup-mit ci/test
+ pam-util/args.c pam-util/args.h pam-util/logging.c pam-util/logging.h
+ pam-util/options.c pam-util/options.h tests/data/generate-krb5-conf
+ tests/data/valgrind.supp tests/docs/pod-spelling-t tests/docs/pod-t
+ tests/docs/spdx-license-t tests/fakepam/config.c tests/fakepam/data.c
+ tests/fakepam/general.c tests/fakepam/internal.h tests/fakepam/kuserok.c
+ tests/fakepam/logging.c tests/fakepam/pam.h tests/fakepam/script.c
+ tests/fakepam/script.h tests/pam-util/args-t.c tests/pam-util/fakepam-t.c
+ tests/pam-util/logging-t.c tests/pam-util/options-t.c tests/runtests.c
+ tests/style/obsolete-strings-t tests/tap/basic.c tests/tap/basic.h
+ tests/tap/kadmin.c tests/tap/kadmin.h tests/tap/kerberos.c
+ tests/tap/kerberos.h tests/tap/libtap.sh tests/tap/macros.h
+ tests/tap/perl/Test/RRA.pm tests/tap/perl/Test/RRA/Automake.pm
+ tests/tap/perl/Test/RRA/Config.pm tests/tap/process.c tests/tap/process.h
+ tests/tap/string.c tests/tap/string.h tests/valgrind/logs-t
+Copyright: 2000-2002, 2004-2021 Russ Allbery <eagle@eyrie.org>
+  2001-2002, 2004-2014
+    The Board of Trustees of the Leland Stanford Junior University
+License: Expat
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to permit
+ persons to whom the Software is furnished to do so, subject to the
+ following conditions:
+ .
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT
+ OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
+ THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Files: configure
+Copyright: 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, Inc.
+License: FSF-configure, and GPL-2+ with Libtool exception or BSD-3-clause or GPL-1+
+
+Files: m4/cc-flags.m4
+Copyright: 2006, 2009, 2016 Internet Systems Consortium, Inc.
+  2016-2021 Russ Allbery <eagle@eyrie.org>
+License: ISC
+ Permission to use, copy, modify, and distribute this software for any
+ purpose with or without fee is hereby granted, provided that the above
+ copyright notice and this permission notice appear in all copies.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
+ SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+Files: m4/clang.m4 m4/kadm5clnt.m4 m4/krb5-config.m4 m4/krb5-pkinit.m4
+ m4/krb5.m4 m4/ld-version.m4 m4/lib-depends.m4 m4/lib-helper.m4
+ m4/lib-pathname.m4 m4/pam-const.m4
+Copyright: 2005-2014
+    The Board of Trustees of the Leland Stanford Junior University
+  2007, 2015, 2018, 2020-2021 Russ Allbery <eagle@eyrie.org>
+  2007-2008 Markus Moeller
+  2008-2010 Free Software Foundation, Inc.
+License: unlimited
+ This file is free software; the authors give unlimited permission to copy
+ and/or distribute it, with or without modifications, as long as this
+ notice is preserved.
+
+Files: m4/libtool.m4
+Copyright: 1996-2001, 2003-2015 Free Software Foundation, Inc.
+License: FSF-unlimited, and GPL-2+ with Libtool exception or BSD-3-clause or GPL-1+
+
+Files: portable/krb5-profile.c
+Copyright: 1985-2005 the Massachusetts Institute of Technology
+License: MIT-Kerberos
+ Export of this software from the United States of America may require
+ a specific license from the United States Government.  It is the
+ responsibility of any person or organization contemplating export to
+ obtain such a license before exporting.
+ .
+ WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ distribute this software and its documentation for any purpose and
+ without fee is hereby granted, provided that the above copyright
+ notice appear in all copies and that both that copyright notice and
+ this permission notice appear in supporting documentation, and that
+ the name of M.I.T. not be used in advertising or publicity pertaining
+ to distribution of the software without specific, written prior
+ permission.  Furthermore if you modify this software you must label
+ your software as modified software and not distribute it in such a
+ fashion that it might be confused with the original MIT software.
+ M.I.T. makes no representations about the suitability of this software
+ for any purpose.  It is provided "as is" without express or implied
+ warranty.
+ .
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ .
+ Individual source code files are copyright MIT, Cygnus Support,
+ OpenVision, Oracle, Sun Soft, FundsXpress, and others.
+ .
+ Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira,
+ and Zephyr are trademarks of the Massachusetts Institute of Technology
+ (MIT).  No commercial use of these trademarks may be made without
+ prior written permission of MIT.
+ .
+ "Commercial use" means use of a name in a product or other for-profit
+ manner.  It does NOT prevent a commercial firm from referring to the
+ MIT trademarks in order to convey information (although in doing so,
+ recognition of their trademark status should be given).
+
+License: BSD-3-clause or GPL-1+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are
+ met:
+ .
+ 1. Redistributions of source code must retain the above copyright
+    notice, and the entire permission notice in its entirety, including
+    the disclaimer of warranties.
+ .
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ .
+ 3. The name of the author may not be used to endorse or promote products
+    derived from this software without specific prior written permission.
+ .
+ ALTERNATIVELY, this product may be distributed under the terms of the
+ GNU General Public License, in which case the provisions of the GPL
+ are required INSTEAD OF the above restrictions.  (This clause is
+ necessary due to a potential bad interaction between the GPL and the
+ restrictions contained in a BSD-style copyright.)
+ .
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ DAMAGE.
+
+License: FSF-configure
+ This script is free software; the Free Software Foundation gives unlimited
+ permission to copy, distribute and modify it.
+
+License: FSF-unlimited
+ This file is free software; the Free Software Foundation gives unlimited
+ permission to copy and/or distribute it, with or without modifications, as
+ long as this notice is preserved.
+ .
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+
+License: GPL-2+ with Autoconf exception
+ This file is free software; you can redistribute it and/or modify it
+ under the terms of the GNU General Public License as published by the
+ Free Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+ .
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
+ Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License along
+ with this program.  If not, see <https://www.gnu.org/licenses/>.
+ .
+ As a special exception to the GNU General Public License, if you
+ distribute this file as part of a program that contains a configuration
+ script generated by Autoconf, you may include it under the same
+ distribution terms that you use for the rest of that program.
+Comment: The option described in the license has been accepted and these
+ files are distributed under the same terms as the package as a whole, as
+ described at the top of this file.
+
+License: GPL-2+ with Libtool exception
+ This file is part of GNU Libtool.
+ .
+ GNU Libtool is free software; you can redistribute it and/or modify it
+ under the terms of the GNU General Public License as published by the
+ Free Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+ .
+ As a special exception to the GNU General Public License, if you
+ distribute this file as part of a program or library that is built using
+ GNU Libtool, you may include this file under the same distribution terms
+ that you use for the rest of that program.
+ .
+ GNU Libtool is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
+ Public License for more details.
+Comment: The option described in the license has been accepted and these
+ files are distributed under the same terms as the package as a whole, as
+ described at the top of this file.
+
+License: GPL-3+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+License: GPL-3+ with Autoconf exception
+ This file is free software; you can redistribute it and/or modify it
+ under the terms of the GNU General Public License as published by the
+ Free Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+ .
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
+ Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, see <https://www.gnu.org/licenses/>.
+ .
+ As a special exception to the GNU General Public License, if you
+ distribute this file as part of a program that contains a configuration
+ script generated by Autoconf, you may include it under the same
+ distribution terms that you use for the rest of that program.  This
+ Exception is an additional permission under section 7 of the GNU General
+ Public License, version 3 ("GPLv3").
+Comment: The option described in the license has been accepted and these
+ files are distributed under the same terms as the package as a whole, as
+ described at the top of this file.
+
+License: GPL-3+ with Libtool exception
+ GNU Libtool is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+ .
+ As a special exception to the GNU General Public License, if you
+ distribute this file as part of a program or library that is built
+ using GNU Libtool, you may include this file under the same
+ distribution terms that you use for the rest of that program.
+ .
+ GNU Libtool is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+Comment: The option described in the license has been accepted and these
+ files are distributed under the same terms as the package as a whole, as
+ described at the top of this file.
+
diff --git a/Makefile.am b/Makefile.am
new file mode 100644
index 000000000000..ef28c36ad045
--- /dev/null
+++ b/Makefile.am
@@ -0,0 +1,210 @@
+# Automake makefile for pam-krb5.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2005-2007, 2014, 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
+# Copyright 2009, 2011-2012
+#     The Board of Trustees of the Leland Stanford Junior University
+# Copyright 2005 Andres Salomon <dilinger@debian.org>
+# Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+ACLOCAL_AMFLAGS = -I m4
+EXTRA_DIST = .clang-format .gitignore .github LICENSE README.md bootstrap   \
+	ci/README.md ci/files/heimdal/heimdal-kdc			    \
+	ci/files/heimdal/kadmind.acl ci/files/heimdal/kdc.conf		    \
+	ci/files/heimdal/krb5.conf ci/files/heimdal/pki-mapping		    \
+	ci/files/mit/extensions.client ci/files/mit/extensions.kdc	    \
+	ci/files/mit/kadm5.acl ci/files/mit/kdc.conf ci/files/mit/krb5.conf \
+	ci/kdc-setup-heimdal ci/kdc-setup-mit ci/install ci/test	    \
+	docs/docknot.yaml docs/pam_krb5.pod module/pam_krb5.map		    \
+	module/pam_krb5.sym tests/README tests/TESTS tests/config/README    \
+	tests/data/cppcheck.supp tests/data/generate-krb5-conf		    \
+	tests/data/krb5-pam.conf tests/data/krb5.conf tests/data/perl.conf  \
+	tests/data/scripts tests/data/valgrind.supp			    \
+	tests/docs/pod-spelling-t tests/docs/pod-t			    \
+	tests/docs/spdx-license-t tests/fakepam/README tests/tap/libtap.sh  \
+	tests/tap/perl/Test/RRA.pm tests/tap/perl/Test/RRA/Automake.pm	    \
+	tests/tap/perl/Test/RRA/Config.pm tests/style/obsolete-strings-t    \
+	tests/valgrind/logs-t
+
+# Everything we build needs the Kerbeors headers and library flags.
+AM_CPPFLAGS = $(KRB5_CPPFLAGS)
+AM_LDFLAGS  = $(KRB5_LDFLAGS)
+
+noinst_LTLIBRARIES = pam-util/libpamutil.la portable/libportable.la
+portable_libportable_la_SOURCES = portable/dummy.c portable/kadmin.h	    \
+        portable/krb5.h portable/macros.h portable/pam.h portable/stdbool.h \
+        portable/system.h
+portable_libportable_la_LIBADD = $(LTLIBOBJS)
+pam_util_libpamutil_la_SOURCES = pam-util/args.c pam-util/args.h	\
+	pam-util/logging.c pam-util/logging.h pam-util/options.c	\
+	pam-util/options.h pam-util/vector.c pam-util/vector.h
+
+if HAVE_LD_VERSION_SCRIPT
+    VERSION_LDFLAGS = -Wl,--version-script=${srcdir}/module/pam_krb5.map
+else
+    VERSION_LDFLAGS = -export-symbols ${srcdir}/module/pam_krb5.sym
+endif
+
+pamdir = $(libdir)/security
+pam_LTLIBRARIES = module/pam_krb5.la
+module_pam_krb5_la_SOURCES = module/account.c module/alt-auth.c		\
+	module/auth.c module/cache.c module/context.c module/fast.c	\
+	module/internal.h module/options.c module/password.c		\
+	module/prompting.c module/public.c module/setcred.c		\
+	module/support.c
+module_pam_krb5_la_LDFLAGS = -module -shared \
+	-avoid-version $(VERSION_LDFLAGS) $(AM_LDFLAGS)
+module_pam_krb5_la_LIBADD = pam-util/libpamutil.la portable/libportable.la \
+	$(KRB5_LIBS)
+dist_man_MANS = docs/pam_krb5.5
+
+# The manual page is normally generated by the bootstrap script, but add a
+# Makefile rule to regenerate it if it is modified.
+docs/pam_krb5.5: $(srcdir)/docs/pam_krb5.pod
+	pod2man --release="$(VERSION)" --center=pam-krb5 -s 5 \
+	    $(srcdir)/docs/pam_krb5.pod > $@
+
+# Work around the GNU Coding Standards, which leave all the Autoconf and
+# Automake stuff around after make maintainer-clean, thus making that command
+# mostly worthless.
+DISTCLEANFILES = config.h.in~ configure~
+MAINTAINERCLEANFILES = Makefile.in aclocal.m4 build-aux/compile		    \
+	build-aux/config.guess build-aux/config.sub build-aux/depcomp	    \
+	build-aux/install-sh build-aux/ltmain.sh build-aux/missing	    \
+	config.h.in configure docs/pam_krb5.5 m4/libtool.m4 m4/ltoptions.m4 \
+	m4/ltsugar.m4 m4/ltversion.m4 m4/lt~obsolete.m4
+
+# Separate target for a human to request building everything with as many
+# compiler warnings enabled as possible.
+warnings:
+	$(MAKE) V=0 AM_CFLAGS='$(WARNINGS_CFLAGS) $(AM_CFLAGS)' \
+	    KRB5_CPPFLAGS='$(KRB5_CPPFLAGS_WARNINGS)'
+	$(MAKE) V=0 AM_CFLAGS='$(WARNINGS_CFLAGS) $(AM_CFLAGS)' \
+	    KRB5_CPPFLAGS='$(KRB5_CPPFLAGS_WARNINGS)' $(check_PROGRAMS)
+
+# The bits below are for the test suite, not for the main package.
+check_PROGRAMS = tests/runtests tests/module/alt-auth-t			    \
+	tests/module/bad-authtok-t tests/module/basic-t			    \
+	tests/module/cache-cleanup-t tests/module/cache-t		    \
+	tests/module/expired-t tests/module/fast-anon-t tests/module/fast-t \
+	tests/module/long-t tests/module/no-cache-t tests/module/pam-user-t \
+	tests/module/password-t tests/module/pkinit-t tests/module/realm-t  \
+	tests/module/stacked-t tests/module/trace-t tests/pam-util/args-t   \
+	tests/pam-util/fakepam-t tests/pam-util/logging-t		    \
+	tests/pam-util/options-t tests/pam-util/vector-t		    \
+	tests/portable/asprintf-t tests/portable/mkstemp-t		    \
+	tests/portable/strndup-t
+tests_runtests_CPPFLAGS = -DC_TAP_SOURCE='"$(abs_top_srcdir)/tests"' \
+	-DC_TAP_BUILD='"$(abs_top_builddir)/tests"'
+check_LIBRARIES = tests/fakepam/libfakepam.a tests/tap/libtap.a
+tests_fakepam_libfakepam_a_SOURCES = tests/fakepam/config.c		   \
+	tests/fakepam/data.c tests/fakepam/general.c			   \
+	tests/fakepam/internal.h tests/fakepam/kuserok.c		   \
+	tests/fakepam/logging.c tests/fakepam/pam.h tests/fakepam/script.c \
+	tests/fakepam/script.h
+tests_tap_libtap_a_CPPFLAGS = $(KADM5CLNT_CPPFLAGS) $(AM_CPPFLAGS)
+tests_tap_libtap_a_SOURCES = tests/tap/basic.c tests/tap/basic.h	\
+	tests/tap/kadmin.c tests/tap/kadmin.h tests/tap/kerberos.c	\
+	tests/tap/kerberos.h tests/tap/macros.h tests/tap/process.c	\
+	tests/tap/process.h tests/tap/string.c tests/tap/string.h
+
+# The list of objects and libraries used for module testing by programs that
+# link with the fake PAM library or with both it and the module.
+MODULE_OBJECTS = module/account.lo module/alt-auth.lo module/auth.lo	   \
+	module/cache.lo module/context.lo module/fast.lo module/options.lo \
+	module/password.lo module/prompting.lo module/public.lo		   \
+	module/setcred.lo module/support.lo pam-util/libpamutil.la	   \
+	tests/fakepam/libfakepam.a
+
+# The test programs themselves.
+tests_module_alt_auth_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_bad_authtok_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_basic_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_cache_cleanup_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_cache_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_expired_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a	\
+	portable/libportable.la $(KADM5CLNT_LDFLAGS) $(KADM5CLNT_LIBS)	\
+	$(KRB5_LIBS)
+tests_module_fast_anon_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_fast_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_long_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_no_cache_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_pam_user_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_password_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_pkinit_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_realm_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_stacked_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_module_trace_t_LDADD = $(MODULE_OBJECTS) tests/tap/libtap.a \
+	portable/libportable.la $(KRB5_LIBS)
+tests_pam_util_args_t_LDADD = pam-util/libpamutil.la	\
+	tests/fakepam/libfakepam.a tests/tap/libtap.a	\
+	portable/libportable.la $(KRB5_LIBS)
+tests_pam_util_fakepam_t_LDADD = tests/fakepam/libfakepam.a	\
+	tests/tap/libtap.a portable/libportable.la
+tests_pam_util_logging_t_LDADD = pam-util/libpamutil.la	\
+	tests/fakepam/libfakepam.a tests/tap/libtap.a	\
+	portable/libportable.la $(KRB5_LIBS)
+tests_pam_util_options_t_LDADD = pam-util/libpamutil.la	\
+	tests/fakepam/libfakepam.a tests/tap/libtap.a	\
+	portable/libportable.la $(KRB5_LIBS)
+tests_pam_util_vector_t_LDADD = pam-util/libpamutil.la	\
+	tests/fakepam/libfakepam.a tests/tap/libtap.a	\
+	portable/libportable.la
+tests_portable_asprintf_t_SOURCES = tests/portable/asprintf-t.c \
+	tests/portable/asprintf.c
+tests_portable_asprintf_t_LDADD = tests/tap/libtap.a portable/libportable.la
+tests_portable_mkstemp_t_SOURCES = tests/portable/mkstemp-t.c \
+	tests/portable/mkstemp.c
+tests_portable_mkstemp_t_LDADD = tests/tap/libtap.a portable/libportable.la
+tests_portable_strndup_t_SOURCES = tests/portable/strndup-t.c \
+	tests/portable/strndup.c
+tests_portable_strndup_t_LDADD = tests/tap/libtap.a portable/libportable.la
+
+check-local: $(check_PROGRAMS)
+	cd tests && ./runtests -l '$(abs_top_srcdir)/tests/TESTS'
+
+# Used by maintainers to check the source code with cppcheck.
+check-cppcheck:
+	cd $(abs_top_srcdir) &&						\
+	    find . -name .git -prune -o -name '*.[ch]' -print		\
+	    | cppcheck -q --force --error-exitcode=2 --file-list=-	\
+		--suppressions-list=tests/data/cppcheck.supp		\
+		--enable=warning,performance,portability,style
+
+# The full path to valgrind and its options, used when doing valgrind
+# testing.
+VALGRIND_COMMAND = $(PATH_VALGRIND) --leak-check=full			\
+        --trace-children=yes						\
+	--trace-children-skip=/bin/sh,*/generate-krb5-conf		\
+	--suppressions=$(abs_top_srcdir)/tests/data/valgrind.supp	\
+        --log-file=$(abs_top_builddir)/tests/tmp/valgrind/log.%p
+
+# Used by maintainers to run the main test suite under valgrind.
+check-valgrind: $(check_PROGRAMS)
+	rm -rf $(abs_top_builddir)/tests/tmp
+	mkdir $(abs_top_builddir)/tests/tmp
+	mkdir $(abs_top_builddir)/tests/tmp/valgrind
+	C_TAP_VALGRIND="$(VALGRIND_COMMAND)" tests/runtests \
+	    -l '$(abs_top_srcdir)/tests/TESTS'
+
+# Used by maintainers to reformat all source code using clang-format and
+# excluding some files.
+reformat:
+	find . -name '*.[ch]' \! -name krb5-profile.c -print \
+	    | xargs clang-format -style=file -i
diff --git a/NEWS b/NEWS
new file mode 100644
index 000000000000..b5c007ef9359
--- /dev/null
+++ b/NEWS
@@ -0,0 +1,1215 @@
+                      User-Visible pam-krb5 Changes
+
+pam-krb5 4.11 (2021-10-17)
+
+    Properly support calling pam_end with PAM_DATA_SILENT by not deleting
+    the underlying ticket cache.  This flag is used when the application
+    is closing the PAM session after a fork to free memory resources, but
+    doesn't intend to free resources external to the process because
+    another process may still depend on them.  Thanks to Andrew G. Morgan
+    for the report.  (GitHub #21)
+
+    Stop attempting to guess the correct PAM module installation path on
+    Linux systems when --prefix is set to /usr and instead document that
+    --libdir will probably need to be set explicitly.  The previous logic
+    is now broken on Debian usrmerge systems and the guesswork seems too
+    fragile to maintain.
+
+    Update to rra-c-util 10.0:
+
+    * Support Autoconf 2.71 without warnings.
+    * Tests written in Perl now require Perl 5.10 or later.
+
+pam-krb5 4.10 (2021-03-20)
+
+    When re-retrieving the authenticated principal from the current cache,
+    ensure the stored principal in the authentication context is always
+    either valid or NULL.  Otherwise, a failure of krb5_cc_get_principal
+    could result in a double free.  Thanks to Michael Muehle for the
+    report.
+
+    Update to rra-c-util 9.0:
+
+    * Check that at least one Kerberos header file was found and works.
+    * Use AS_ECHO in all Autoconf macros in preference to echo.
+    * Fix portability of reallocarray on NetBSD systems.
+    * Stop providing a replacement for a broken snprintf.
+
+    Update to C TAP Harness 4.7:
+
+    * Fix warnings with GCC 10.
+
+pam-krb5 4.9 (2020-03-30)
+
+    SECURITY: All previous versions of this module could overflow the
+    buffer provided by the underlying Kerberos library for the response to
+    a prompt by writing a single nul character past the end of the buffer.
+    (CVE-2020-10595)
+
+    Support use_pkinit with MIT Kerberos.  (Debian Bug#871699)
+
+    Reject passwords as long or longer than PAM_MAX_RESP_SIZE (normally
+    512 octets), since extremely long passwords can be used for a denial
+    of service attack via the Kerberos string to key function.  Thanks to
+    Florian Best for pointing out this issue and suggesting a good fix.
+
+    Use explicit_bzero instead of memset, where available, to overwrite
+    the memory used by PAM responses before freeing.  This reduces the
+    lifetime of passwords and other secrets in memory.
+
+    Return more accurate errors from the Kerberos prompter function if it
+    was unable to prompt for the password.  This may translate into better
+    debug log messages and, in some situations, returning the slightly
+    more accurate PAM_AUTHINFO_UNAVAIL instead of PAM_AUTH_ERR.
+
+    Fix an edge-case memory leak in pam_chauthtok when prompting for a new
+    password for an ignored user.
+
+    Ensure the module/basic test will run properly when the system
+    krb5.conf file does not specify a default realm.  Reported by TBK.
+
+    Update to rra-c-util 8.2:
+
+    * Fix support for configuring the test suite with a krb5.conf file.
+    * Drop support for Perl 5.6.
+    * Reformat all C source using clang-format 10.
+    * Remove bogus snprintf tests.
+    * Fix misplaced va_end in the pam-util putil_log_failure function.
+    * Skip checking for krb5-config on the path if a prefix was given.
+    * Add SPDX-License-Identifier headers to all substantial source files.
+
+    Update to C TAP Harness 4.6:
+
+    * Fixed malloc error checking in bstrndup.
+    * Fix (harmless) allocation error in runtests driver.
+    * Add support for valgrind testing via test list options.
+    * Report test failures as left and right, not wanted and seen.
+    * Fix is_string comparisons involving NULL pointers and "(null)".
+    * Add SPDX-License-Identifier headers to all substantial source files.
+
+pam-krb5 4.8 (2017-12-30)
+
+    When verifying that an expired password can still be used to get
+    kadmin/changepw credentials, correctly set the credential options for
+    getting password change credentials, not for getting initial
+    credentials.  This should fix password change issues when, for
+    example, krb5.conf requests that all tickets be proxiable but
+    kadmin/changepw doesn't allow proxiable credentials.  Thanks to
+    Florian Best for the bug report.
+
+    When built against recent versions of Heimdal with richer status codes
+    from PKINIT attempts, report to the user the reason for a PKINIT
+    failure.  Based on work by Henry Jacques.
+
+    Document the test suite configuration files required to run the PKINIT
+    tests.
+
+    Fix expired password tests to work with Heimdal 7.0.1 and later.
+
+    Better document that the default Kerberos library ticket cache
+    location is not used (and why), and how to set configuration
+    parameters in krb5.conf.  Thanks, Matthew Gabeler-Lee.  (Debian
+    Bug#872943)
+
+    Compile cleanly under GCC 7 and Clang warnings and Clang's static
+    analyzer.
+
+    Rename the script to bootstrap from a Git checkout to bootstrap,
+    matching the emerging consensus in the Autoconf world.
+
+    Update to rra-c-util 7.0:
+
+    * Fix new warnings in GCC 7.
+    * Support a warning build under Clang.
+    * Avoid zero-length allocations in reallocarray and vector.
+    * Probe for warning flags instead of hard-coding a list.
+    * New test for obsolete URLs and email addresses.
+    * Remove unused portable replacements for strlcpy and strlcat.
+    * Use C_TAP_SOURCE and C_TAP_BUILD environment variables in tests.
+    * Fix portability defines for anonymous principal strings.
+    * Clear errno on pam_modutil_getpwnam to improve other testing.
+    * Add portability defines for macOS's PAM implementation.
+    * Add new Autoconf macro to probe for pam_strerror const usage.
+    * Support Solaris 10's included Kerberos.
+
+    Update to C TAP Harness 4.2:
+
+    * Avoid zero-length allocations in breallocarray.
+    * Add is_blob and is_bool functions.
+    * Use C_TAP_SOURCE and C_TAP_BUILD environment variables in tests.
+    * Fix segfault in runtests with an empty test list.
+    * Display verbose test results with -v or C_TAP_VERBOSE.
+    * Test infrastructure builds cleanly with Clang warnings.
+
+pam-krb5 4.7 (2014-12-25)
+
+    Add a no_update_user option that disables the normal update of the
+    PAM_USER PAM variable after canonicalization of the username.  When
+    this is set, pam-krb5 will not convert full principal names to local
+    usernames where possible for the rest of the PAM stack.
+
+    Suppress spurious password prompt from Heimdal when authenticating
+    with PKINIT.
+
+    Map unknown realm errors from the Kerberos libraries to the PAM error
+    code PAM_AUTHINFO_UNAVAIL instead of PAM_AUTH_ERR.
+
+    Treat an KRB5_GET_IN_TKT_LOOP error as an incorrect password.  Heimdal
+    KDCs sometimes return it, and Heimdal kinit treats it this way.
+    Similarly, treat a KRB5_BAD_ENCTYPE error as an incorrect password,
+    since this error is returned by a Heimdal 1.6-rc2 KDC for incorrect
+    preauth from a MIT Kerberos 1.12.1 client.
+
+    Add the version number at which each module option was added with its
+    current meaning to the documentatation.
+
+    Update to rra-c-util 5.6:
+
+    * Suppress warnings from Kerberos headers in non-system paths.
+    * Fix probing for Heimdal's libroken to work with older versions.
+    * Fix Kerberos header detection if root or include paths are given.
+    * Pass --deps to krb5-config in the non-reduced-dependencies case.
+    * Provide a reallocarray replacement for platforms without it.
+    * Use reallocarray where appropriate.
+    * Drop checks for NULL before freeing pointers.
+    * Drop explicit pointer initialization to NULL and rely on calloc.
+    * Check the return status of snprintf and vsnprintf properly.
+    * Preserve errno if snprintf fails in vasprintf replacement.
+    * Suppress a dummy symbol in the client library that could leak.
+    * Fix syntax errors when building with a C++ compiler.
+    * Avoid test suite failures where tested functions are macros.
+
+    Update to C TAP Harness 3.2:
+
+    * Reopen standard input to /dev/null when running a test list.
+    * Don't leak extraneous file descriptors to tests.
+    * Suppress lazy plans and test summaries if the test failed with bail.
+    * bail and sysbail now exit with status 255 to match Test::More.
+    * runtests now treats the command line as a list of tests by default.
+    * The full test executable path can now be passed to runtests -o.
+    * Improved harness output for tests with lazy plans.
+    * Improved harness output to a terminal for some abort cases.
+    * Flush harness output after each test even when not on a terminal.
+
+pam-krb5 4.6 (2012-06-02)
+
+    Add an anon_fast option that attempts anonymous authentication
+    (generally implemented via anonymous PKINIT inside the Kerberos
+    library) and then, if successful, uses those credentials for FAST
+    armor.  If fast_ccache and anon_fast are both specified, anonymous
+    authentication will be used as a fallback if the specified FAST ticket
+    cache doesn't exist.  Based on patches from Yair Yarom.
+
+    Add a user_realm option to only set the realm for unqualified user
+    principals.  This differs from the existing realm option in that realm
+    also changes the default realm for authorization decisions and for
+    verification of credentials.  Update the realm option documentation to
+    clarify the differences and remove incorrect information.  Patch from
+    Roland C. Dowdeswell.
+
+    Add a no_prompt option to suppress the PAM module's prompt for the
+    user's password and defer all prompting to the Kerberos library.  This
+    allows the Kerberos library to have complete control of the prompting
+    process, which may be desirable if authentication mechanisms other
+    than password are in use.  Be aware that, with this option set, the
+    PAM module has no control over the contents of the prompt and cannot
+    store the user's password in the PAM data.  Based on a patch by Yair
+    Yarom.
+
+    Add a silent option to force the module to behave as if the
+    application had passed in PAM_SILENT and suppress text messages and
+    errors from the Kerberos library.  Patch from Yair Yarom.
+
+    Add preliminary support for Kerberos trace logging via a trace option
+    that enables trace logging if supported by the underlying Kerberos
+    library.  The option takes as an argument the file name to which to
+    log trace output.  This option does not yet work with any released
+    version of Kerberos, but may work with the next release of MIT
+    Kerberos.
+
+    MIT Kerberos does not add a colon and space to its password prompts,
+    but Heimdal does.  pam-krb5 previously unconditionally added a colon
+    and space, resulting in doubled colons with Heimdal.  Work around this
+    inconsistency by not adding the colon and space if already present.
+
+    Fix alt_auth_map support to preserve the realm of the authentication
+    identity when forming the alternate authentication principal, matching
+    the documentation.
+
+    Document that the alt_auth_map format may contain a realm to force all
+    mapped principals to be in that realm.  In that case, don't add the
+    realm of the authentication identity.  Note that this can be used as a
+    simple way to attempt authentication in an alternate realm first and
+    then fall back to the local realm, although any complex attempt at
+    authentication in multiple realms should instead run the module
+    multiple times with different realm settings.
+
+    Avoid a NULL pointer dereference if krb5_init_context fails.
+
+    Fix initialization of time values in the module configuration on
+    platforms (like S/390X) where krb5_deltat is not equivalent to long.
+
+    Close a memory leak when search_k5login is set but the user has no
+    .k5login file.
+
+    Close several memory leaks in alt_auth_map support.
+
+    Suppress bogus error messages about unknown option for the realm
+    option.  The option was being parsed and honored despite the error.
+
+    Retry authentication under try_first_pass on several other errors in
+    addition to decrypt integrity check errors to handle a wider array of
+    possible "password incorrect" error messages from the KDC.
+
+    Update to rra-c-util 4.4:
+
+    * Replacement strndup now works with non-nul-terminated strings.
+    * New Kerberos test setup that simplifies writing tests.
+    * Add -D_FORTIFY_SOURCE=2 to the make warnings flags.
+    * Use --deps flag to krb5-config by default.
+    * Suppress __alloc_size__ attribute with older versions of gcc.
+    * Suppress attribute warnings for non-gcc compilers.
+
+    Update to C TAP Harness 1.12:
+
+    * Add bstrndup to the basic C TAP library.
+    * Only use feature-test macros when requested or built with gcc -ansi.
+    * New tests/tap/macros.h header with some common definitions.
+    * Drop is_double from the C TAP library to avoid requiring -lm.
+    * Avoid using local in the shell libtap.sh library.
+
+pam-krb5 4.5 (2011-12-24)
+
+    Suppress the notice that the password is being changed because it's
+    expired if force_first_pass or use_first_pass is set in the password
+    stack, indicating that it's stacked with another module that's also
+    doing password changes.  This is arguable, but without this change the
+    notification message of why the password is being changed shows up
+    confusingly in the middle of the password change interaction.  Based
+    on a patch by William Yang.
+
+    Some old versions of Heimdal (0.7.2 in OpenBSD 4.9, specifically)
+    reportedly return KRB5KDC_ERR_KEY_EXP for accounts with expired
+    keys even if the supplied password is wrong.  Work around this by
+    confirming that the PAM module can obtain tickets for kadmin/changepw
+    before returning a password expiration error instead of an invalid
+    password error.  Based on a patch by William Yang.
+
+    The location of the temporary root-owned ticket cache created during
+    the authentication process is now also controlled by the ccache_dir
+    option (but not the ccache option) rather than forced to be in /tmp.
+    This will allow system administrators to configure an alternative
+    cache directory so that pam-krb5 can continue working when /tmp is
+    full.
+
+    Report more specific errors in syslog if authorization checks (such as
+    .k5login checks) fail.
+
+    Pass a NULL principal to krb5_set_password with MIT client libraries
+    to prefer the older change password protocol for compatibility with
+    older KDCs.  This is not necessary on Heimdal since Heimdal's
+    krb5_set_password tries both protocols.
+
+    Improve logging and authorization checks when defer_pwchange is set
+    and a user authenticates with an expired password.
+
+    When probing for Kerberos libraries, always add any supplemental
+    libraries found to that point to the link command.  This will fix
+    configure failures on platforms without working transitive shared
+    library dependencies.
+
+    Close some memory leaks where unparsed Kerberos principal names were
+    never freed.
+
+    Restructure the code to work with OpenPAM's default PAM build
+    machinery, which exports a struct containing module entry points
+    rather than public pam_sm_* functions.  Thanks to Fredrik Pettai for
+    the information.
+
+    In debug logging, report symbolic names for PAM flags on PAM function
+    entry rather than the numeric PAM flags.  This helps with automated
+    testing and with debugging PAM problems on different operating
+    systems.
+
+    Include <krb5/krb5.h> if <krb5.h> is missing, which permits finding
+    the header file on NetBSD systems.  Thanks to Fredrik Pettai for the
+    report.
+
+    Replace the Kerberos compatibility layer with equivalent but
+    better-structured code from rra-c-util 4.0.
+
+    Avoid krb5-config and use manual library probing if --with-krb5-lib or
+    --with-krb5-include were given to configure.  This avoids having to
+    point configure at a nonexistent krb5-config to override its results.
+
+    Use PATH_KRB5_CONFIG instead of KRB5_CONFIG to locate krb5-config in
+    configure, to avoid a conflict with the variable used by the Kerberos
+    libraries to find krb5.conf.
+
+    Change references to Kerberos v5 to just Kerberos in the
+    documentation.  Kerberos v5 has been the default version of Kerberos
+    for over ten years now.
+
+    Update to rra-c-util 4.0:
+
+    * Add notices to all files copied over from rra-c-util.
+    * Include strings.h for additional POSIX functions where found.
+    * Fix detection of whether PAM uses const on FreeBSD.
+    * Update warning flags for make warnings for GCC 4.6.1.
+    * Limit symbol exports even on systems without GNU ld.
+    * Fix replacement mkstemp to use long long where available.
+    * Improve stripping of /usr/include from krb5-config results.
+    * Use issetugid where available, not the misnamed issetuidgid.
+
+    Update to C TAP Harness 1.9:
+
+    * Add bmalloc, bcalloc, brealloc, and bstrdup TAP library functions.
+    * Fix runtests to honor -s even if BUILD and -b aren't given.
+    * Add test_tmpdir and test_tmpdir_free to TAP library.
+    * runtests now frees all allocated resources on exit.
+
+pam-krb5 4.4 (2010-12-31)
+
+    Do not prompt for a password when try_pkinit is set and the module is
+    built against MIT Kerberos.  This fixes a spurious password prompt
+    introduced in 4.1, but partly reintroduces the bug fixed in 4.1 where
+    the user's password is not saved in the PAM data if the authentication
+    falls back to password when PKINIT fails.  This requires more work
+    to fix and will be addressed in a subsequent release.  Thanks to
+    Бранко Мајић (Branko Majic) for the report.
+
+    Reorganize the configuration section of the pam_krb5 man page to
+    divide the many PAM module options into sections.
+
+    When probing for <ibm_svc/krb5_svc.h> (part of AIX's bundled Kerberos
+    implementation), include <krb5.h> before attempting to include that
+    header to quiet confusing Autoconf warnings.  Reported by Wilfried
+    Weiss.
+
+    Update to rra-c-util 3.0:
+
+    * Fix compilation of the replacement snprintf for old systems.
+    * Look for krb5-config in /usr/kerberos/bin for Red Hat systems.
+    * Fix compilation with OpenBSD's Heimdal without separate libroken.
+
+pam-krb5 4.3 (2010-06-09)
+
+    Add a fast_ccache option that, if set, points to a Kerberos ticket
+    cache used for Flexible Authentication Secure Tunneling (FAST) to
+    protect the authentication.  FAST is a mechanism to protect Kerberos
+    against password guessing attacks and provide other security
+    improvements.  This option is only available when built against
+    Kerberos libraries with FAST support (currently only MIT Kerberos 1.7
+    or later).  Patch from Sam Hartman.
+
+    Fix error in freeing a previous alt_auth_map setting when parsing
+    configuration options.  Patch from Sam Hartman.
+
+    Fix the linker flags for Solaris with the native compiler.  Thanks,
+    Kevin Sumner.
+
+pam-krb5 4.2 (2009-11-25)
+
+    Add a new fail_pwchange option, which suppresses password changes for
+    expired passwords and treats expired passwords the same as incorrect
+    passwords.
+
+    Include all the new header files from the portability code so that
+    it will actually compile on non-Linux platforms.
+
+pam-krb5 4.1 (2009-11-20)
+
+    Return PAM_SUCCESS, not PAM_USER_UNKNOWN, for ignored users in
+    pam_setcred.  It's safe to return success when doing nothing in
+    pam_setcred because the stack has already been frozen after the
+    authentication step, and returning an error causes the stack to fail
+    on some other Linux PAM implementations.  Thanks, Ian Ward Comfort.
+
+    In the second pass through the password group, prompt for the new
+    password and store it in the PAM data even if the user is being
+    ignored.  This is required to allow this module to be stacked with
+    another module that uses use_authtok.  Without this behavior, the
+    second module won't be able to work for any ignored user since it will
+    see no saved password and use_authtok will reject the password change.
+
+    Fix return status from pam_sm_acct_mgmt if we were unable to retrieve
+    PAM_USER.
+
+    Log successful authentications to syslog with priority LOG_INFO,
+    including the Kerberos principal used for authentication.
+
+    Log failed authentication to syslog with priority LOG_NOTICE,
+    including roughly the same additional information that the Linux PAM
+    pam_unix logs by default.
+
+    Use pam_syslog for logging where available.  This means pam-krb5 log
+    messages will look like all other log messages for Linux PAM modules
+    on Linux.  Change the format of log messages on all platforms to
+    hopefully be somewhat clearer.
+
+    Rationalize logging.  The module should now follow the recommendations
+    of the Linux PAM Module Writers' Guide for log levels.  More errors
+    are logged at LOG_ERR instead of LOG_DEBUG, and system resource errors
+    are now logged at LOG_CRIT instead of LOG_ERR.
+
+    Add additional error and debug logging in places where significant
+    actions or failures may happen without previously being logged.  Also
+    add failure information from PAM or Kerberos libraries to messages
+    where appropriate.
+
+    Add replacement snprintf, vsnprintf, and mkstemp functions for
+    pointless portability to ancient systems.
+
+pam-krb5 4.0 (2009-11-13)
+
+    UPGRADE WARNING: If you were using pam_krb5 with the use_authtok
+    parameter in the password group, you will need to add use_first_pass
+    to your configuration to keep the same behavior.  See below for
+    details.
+
+    UPGRADE WARNING: If you used the use_authtok parameter in the
+    authentication group, you should change it to force_first_pass.
+
+    Previous versions of this module incorrectly implemented the standard
+    use_authtok parameter.  use_authtok applies only to the password group
+    and says to use the new password stored in the PAM data rather than
+    prompting for a new password.  It doesn't imply anything about where
+    to obtain the old password, but it was implemented as requiring both
+    the old and new password be in the PAM stack already.  This doesn't
+    work when stacked with pam_cracklib.  Change use_authtok to have the
+    correct meaning, which means that password group configurations may
+    need to add use_first_pass to use_authtok to get the desired behavior.
+
+    use_first_pass and try_first_pass no longer affect how the new
+    password is obtained during password changes.  To use a password
+    obtained by a previous module, use use_authtok instead.
+
+    A new option, force_first_pass, is now supported for both the
+    authentication and password groups.  It tells the module to always get
+    the user's current password from the PAM data and fail without
+    prompting if it isn't already set.  This is the meaning that
+    use_authtok previously had for the current password.
+
+    use_authtok no longer has any meaning for the authentication stack.
+    Use force_first_pass instead, which does the same as use_authtok used
+    to do.  use_authtok will be temporarily converted to force_first_pass
+    in the authentication group and log a diagnostic, but this will be
+    removed in the future.
+
+    Stop returning PAM_IGNORE from pam_setcred if the user is ignored or
+    didn't log in via Kerberos and instead return PAM_USER_UNKNOWN.  This
+    fixes problems with the Linux PAM library where returning PAM_IGNORE
+    would cause pam_setcred to fail even if other modules succeeded.
+    Since pam_authenticate never returned PAM_IGNORE, this change should
+    not cause any differences in behavior.
+
+    Do not use issetugid on Solaris to determine when to avoid refreshing
+    the ticket cache named in KRB5CCNAME during pam_setcred.  Instead,
+    compare effective and real UID and GID and permit KRB5CCNAME to be
+    trusted if they match.  This allows setuid screensavers on Solaris to
+    refresh ticket caches and makes behavior on Solaris match other
+    platforms.  Using issetugid is arguably safer since it protects
+    programs that switch users via setuid to a user other than the calling
+    user but still should not trust the original environment, but such
+    programs are rare in the PAM context and should not be calling
+    pam_setcred anyway unless the calling user is permitted to generally
+    act as the target user.  Thanks, William Yang.
+
+    Do the same logging in pam_sm_open_session and pam_sm_close_session as
+    we do with the other functions.  This will mean pam_sm_open_session
+    calls will be logged as pam_sm_open_session, not as pam_sm_setcred as
+    before.
+
+    pam-krb5 is now built using Automake and Libtool to bring it more in
+    line with other software packages.  This means that it now relies on
+    Libtool to know how to generate a loadable module rather than
+    hand-configured linker rules.  This may improve portability on some
+    platforms and may hurt it on other platforms.
+
+    If configured with a prefix of /usr on Linux, use /lib, /lib32, or
+    /lib64 as an installation path based on the size of an integer in the
+    compilation environment rather than based on known 64-bit Linux
+    variants.
+
+    Update to rra-c-util 2.0:
+
+    * Sanity-check the results of krb5-config before proceeding.
+    * Fall back on manual probing if krb5-config results don't work.
+    * Don't break if the user clobbers CPPFLAGS at build time.
+
+pam-krb5 3.15 (2009-07-21)
+
+    Fix a segfault (null pointer dereference) if pam-krb5 is configured
+    with use_first_pass or use_authtok and there is no password stored in
+    the PAM stack.  Thanks to Jonathan Guthrie for the bug report.
+
+pam-krb5 3.14 (2009-07-18)
+
+    Return PAM_IGNORE instead of PAM_PERM_DENIED from pam_chauthtok for
+    ignored users.  This allows making the Kerberos PAM module mandatory
+    for password changes and still falling back to other PAM modules for
+    ignored users.  Thanks, Steve Langasek.
+
+    Always treat the empty password as an authentication failure rather
+    than passing it to the Kerberos libraries.  The Kerberos libraries
+    may treat it as equivalent to no password and prompt for a password
+    without our knowledge, leading to the user authenticating with a
+    different password than the one stored in the PAM stack.  This could
+    cause unexpected problems with some PAM configurations.  It's safer
+    to make the assumption that the empty password is always invalid and
+    reject it outside of the Kerberos libraries.  Thanks, Sanjay Sha.
+
+    Fix error handling if ticket cache initialization fails.
+    Authentication will still fail, but this avoids a segfault from a
+    double-free of the ticket cache structure.  The most common cause of
+    this problem was having the attempt to initialize the ticket cache
+    be blocked by AppArmor.  Thanks to Alex Mauer for the report.
+
+    Call krb5_free_error_string correctly, fixing a portability issue
+    when building against Heimdal.  Thanks, Andrew Drake.
+
+    Work around a deficiency in pam_putenv on FreeBSD 7.2 that doesn't
+    allow deleting environment variables, only setting them to empty
+    values.  Thanks, Andrew Elble.
+
+pam-krb5 3.13 (2009-02-11)
+
+    SECURITY: When built against MIT Kerberos, if pam_krb5 is called in a
+    setuid context (effective UID or GID doesn't match the real UID or
+    GID), use krb5_init_secure_context instead of krb5_init_context.  This
+    ignores environment variable settings for the local Kerberos
+    configuration and keytab.  Previous versions could allow a local
+    attacker to point a setuid program that used PAM authentication at a
+    different Kerberos configuration under the attacker's control,
+    possibly resulting in privilege escalation.  Heimdal handles this
+    logic within the Kerberos libraries and therefore was not affected.
+    (CVE-2009-0360)
+
+    SECURITY: Disable pam_setcred(PAM_REINITIALIZE_CREDS) for setuid
+    applications.  If pam_krb5 detects this call in a setuid context, it
+    now logs an error and returns success without doing anything.  Solaris
+    su calls pam_setcred with that option rather than PAM_ESTABLISH_CREDS
+    after authentication and without wiping the environment, leading
+    previous versions of pam_krb5 to trust the KRB5CCNAME environment
+    variable for the ticket cache location.  This permitted an attacker to
+    use previous versions of pam_krb5 to overwrite arbitrary files with
+    Kerberos credential caches that were left owned by the attacker.
+    Setuid screen lock programs may also be affected.  Discovered by Derek
+    Chan and reported by Steven Luo.  Thanks to Sam Hartman and Jeffrey
+    Hutzelman for additional analysis.  (CVE-2009-0361)
+
+    If a prefix of /usr is requested at configure time, install the PAM
+    module into /lib/security or /lib64/security on Linux, matching the
+    standard Linux-PAM module location.  Use lib64 instead of lib on
+    64-bit SPARC, PowerPC, and S390 Linux as well as x86_64.  Patch from
+    Peter Breitenlohner.
+
+    Fix a build problem when builddir != srcdir introduced in 3.11.  Patch
+    from Peter Breitenlohner.
+
+    Add support for the old Heimdal krb5_get_error_string interface.
+    Thanks, Chaskiel Grundman.
+
+    Add --with-krb5-include and --with-krb5-lib configure options to allow
+    more specific setting of paths if necessary.
+
+    If krb5-config isn't available, attempt to determine if the library
+    directory for the Kerberos libraries is lib32 or lib64 instead of lib
+    and set LDFLAGS accordingly.  Based on an idea from the CMU Autoconf
+    macros.
+
+pam-krb5 3.12 (2008-11-13)
+
+    Add alt_auth_map configuration option, which allows mapping of
+    usernames to alternative Kerberos principals, useful primarily for
+    using particular instances for access to a given PAM-authenticated
+    service.  Also added force_alt_auth and only_alt_auth options to
+    control when alternative Kerberos principals are used.  Patch from
+    Booker Bense.
+
+    Fix incorrect error handling for bad .k5login ownership when
+    search_k5login is set, leading to a NULL pointer dereference and a
+    segfault.  Thanks, Andrew Deason.
+
+    Fix double-free of the ticket cache structure if creation of the
+    ticket cache in the session module fails.  Thanks, Jens Jorgensen.
+
+    Log all syslog messages to LOG_AUTHPRIV, or LOG_AUTH if the system
+    doesn't define LOG_AUTHPRIV.  Thanks, Mark Painter.
+
+    Fix portability to AIX's bundled Kerberos.  Thanks, Markus Moeller.
+
+    When debugging is enabled, log an exit status of PAM_IGNORE as ignore
+    rather than failure.
+
+    Document that pam-krb5 must be listed in the session group as well as
+    the auth group for interactive logins or OpenSSH won't set up the
+    user's credential cache properly.
+
+    Document adding ignore=ignore to complex [] action configuration for
+    the session and account groups since the module now returns PAM_IGNORE
+    instead of PAM_SUCCESS for accounts that didn't use Kerberos.
+
+pam-krb5 3.11 (2008-07-10)
+
+    pam_setcred, pam_open_session, and pam_acct_mgmt now return PAM_IGNORE
+    for ignored users or non-Kerberos logins rather than PAM_SUCCESS.
+    This return code tells the PAM library to continue as if the module
+    were not present in the configuration and allows sufficient to be
+    meaningful for pam-krb5 in account and session groups.
+    pam_authenticate continues to return failure for ignored users;
+    PAM_IGNORE would arguably be more correct, but increases the risk of
+    security holes through incorrect configuration.
+
+    Support correct password expiration handling according to the PAM
+    standard (returning success from pam_authenticate and an error from
+    pam_acct_mgmt and completing the authentication after pam_chauthotk).
+    This is not the default since it opens security holes with broken
+    applications that don't call pam_acct_mgmt or ignore its exit status.
+    To enable it, set the PAM option defer_pwchange for applications known
+    to make the correct PAM calls and check return codes.
+
+    Add a new option to attempt change of expired passwords during
+    pam_authenticate if Kerberos authentication returns a password expired
+    error.  Normally, the Kerberos library will do this for you, but some
+    Kerberos libraries (notably Solaris) disable that code.  This option
+    allows simulation of the normal Kerberos library behavior on those
+    platforms.
+
+    Work around an apparent Heimdal bug when krb5_free_cred_contents is
+    called on an all-zero credential structure.  It's not clear what's
+    going on here and the Heimdal code looks correct, but avoiding the
+    call fixes the problem.
+
+    Warn if more than one of use_authtok, use_first_pass, and
+    try_first_pass is set and use the strongest of the one set.
+
+    Remove the workaround for versions of MIT Kerberos that didn't
+    initialize a krb5_get_init_creds_opt structure on opt_alloc.  This bug
+    was only present in early versions of 1.6; the correct fix is to
+    upgrade.
+
+    Add an additional header check for AIX's bundled Kerberos.
+
+    If KRB5_CONFIG was explicitly set in the environment, don't use a
+    different krb5-config based on --with-krb5.  If krb5-config isn't
+    executable, don't use it.  This allows one to force library probing by
+    setting KRB5_CONFIG to point to a nonexistent file.
+
+    Sanity-check the results of krb5-config before proceeding and error
+    out in configure if they don't work.
+
+    For Kerberos libraries without krb5-config, also check for networking
+    libraries (-lsocket and friends) before checking for Kerberos
+    libraries in case shared library dependencies are broken.
+
+    Fix Autoconf syntax error when probing for libkrb5support.  Thanks,
+    Mike Garrison.
+
+    Set an explicit visibility of hidden for all internal functions at
+    compile time if gcc is used to permit better optimization.  Hide all
+    functions except the official interfaces using a version script on
+    Linux.  This protects against leaking symbols into the application
+    namespace and provides some mild optimization benefit.
+
+    Fix the probing of PAM headers for const on Mac OS X.  This will
+    suppress some harmless compiler warnings there.  Thanks, Markus
+    Moeller.
+
+pam-krb5 3.10 (2007-12-28)
+
+    The workaround for krb5_get_init_creds_opt_alloc problems in MIT
+    Kerberos 1.6 broke PKINIT support with Heimdal.  Only apply that
+    workaround when building against the MIT Kerberos libraries.  Thanks
+    to Jaakko Pero for the detailed report.
+
+    If no_ccache is set, always exit successfully from pam_setcred or
+    pam_open_session, even if we couldn't retrieve module data.  Thanks,
+    Markus Moeller.
+
+    When keytab is set, properly handle failure to create a keytab cursor
+    and don't assume that the cursor is valid.  Thanks, Markus Moeller.
+
+    Define _ALL_SOURCE on AIX to get prototypes for snprintf.
+
+    Add additional portability glue and Autoconf probes to support
+    building against the version of Kerberos bundled with AIX.  Support
+    for this should be considered alpha in this release.  Thanks to Markus
+    Moeller for the initial patch.
+
+pam-krb5 3.9 (2007-11-12)
+
+    If use_authtok is set, fail even if we can retrieve the stored PAM
+    password if that password is set to NULL.  Apparently that can happen
+    in some cases, such as with pam_cracklib.  Thanks to Christian Holler
+    for the diagnosis and a patch.
+
+    Add a new clear_on_fail option for the password group.  If set, when a
+    password change fails, set PAM_AUTHTOK to NULL so that subsequent
+    modules in the PAM stack with use_authtok set will also fail.  Just
+    returning failure doesn't abort the stack on the second pass when
+    actual password changes are made.  This is not the default since it
+    interferes with other desirable PAM configurations.  It's useful
+    primarily when using the PAM stack to synchronize passwords between
+    multiple environments.  Thanks to Christian Holler and Tomas Mraz for
+    the analysis.
+
+    Fix portability issues with Heimdal, versions of PAM that don't
+    provide pam_modutil_getpwnam, and compiler warnings when building
+    PKINIT support.  Thanks, Martin von Gagern.
+
+    Fix parsing of the keytab PAM option.  Thanks, Markus Moeller.
+
+    Return PAM_AUTHINFO_UNAVAIL instead of PAM_AUTH_ERR when unable to
+    resolve the Kerberos realm.  Thanks, Frank Cornelissen.
+
+    Add a new debugging section to the README.
+
+pam-krb5 3.8 (2007-09-30)
+
+    krb5_get_init_creds_opt_alloc doesn't initialize the returned
+    structure with the default flags in MIT Kerberos 1.6, which meant that
+    users with expired passwords were not being prompted to change their
+    password but just rejected.  Fixed by always calling _init before
+    setting the credential flags, regardless of the provenance of the opt
+    structure.  Thanks, Michael Richters.
+
+    Fix configure and Makefile glue so that Mac OS X and HP-UX have a
+    chance of working (still untested).
+
+    Add a make warnings target with aggressive gcc warning options.  Treat
+    negative minimum UIDs as zero so that UID comparisons can always be
+    done unsigned.  Add casts and unused attributes as needed.
+
+pam-krb5 3.7 (2007-09-29)
+
+    If given an explicit keytab path to use for credential verification,
+    use the first principal found in that keytab as the principal for
+    verification rather than the library default (which is normally the
+    host/* principal for the local system and may not be found in that
+    keytab).
+
+    When authenticating, don't store our context data until after
+    authentication has succeeded.  Otherwise, we may destroy the ticket
+    cache of a previous successful authentication.  This bug would only
+    affect configurations where pam_krb5 was run multiple times with
+    different settings, such as multiple realms.  Thanks to Dave Botsch
+    for the report.
+
+    Use pam_modutil_getpwnam instead of getpwnam if available for better
+    thread safety.
+
+    Don't store PAM data unless we're saving a ticket cache.  All other
+    calls use it for is to find the ticket cache, so without a cache it's
+    pointless and means we run the risk of stomping on ourselves in
+    multithreaded programs.
+
+    Still canonicalize the PAM user before returning when not saving a
+    ticket cache.
+
+    Fix determination of linker flags on non-x86_64 Linux.  Always link
+    with -fPIC when using GCC, just in case.
+
+    Add compilation options for Mac OS X and HP-UX (untested).
+
+    Use pam_krb5 instead of ctx for our PAM data name to reduce the
+    chances of collision.
+
+pam-krb5 3.6 (2007-09-18)
+
+    When the local user doesn't exist and search_k5login is enabled, fall
+    back to simple Kerberos authentication just as if the account existed
+    with no .k5login file.  This avoids trying to verify an all-zero
+    credentials structure, leading to non-expoloitable segfaults on x86_64
+    systems.  Be more careful in general about setting error codes in the
+    search_k5login implementation.
+
+    Explicitly clear the forwardable and proxiable options and don't ask
+    for renewable tickets when getting a ticket for the password changing
+    service.  Otherwise, system-wide defaults and PAM configuration will
+    apply to those tickets as well and the resulting ticket request may be
+    rejected based on KDC configuration.  Based on a patch by Sergio
+    Gelato.
+
+    Do username canonicalization earlier so that .k5login checking and
+    similar work uses the correct username but only change the PAM
+    username if authentication succeeds.  Document that username
+    canonicalization won't work with unmodified OpenSSH and with several
+    common PAM modules.  Thanks to R. Scott Bailey for the bug report and
+    analysis.
+
+    Add a prompt_principal option which, if set, causes the PAM module to
+    prompt the user for the Kerberos principal to use for authentication
+    before prompting for the password.
+
+    Try to determine whether the PAM headers use const in the prototypes
+    of such things as pam_get_item and adjust accordingly.  This should
+    address most compiler warnings on Solaris.  Thanks, Markus Moeller.
+
+    Change lib to lib64 on x86_64 Linux to allow for the magical $ISA
+    parameter in Red Hat's PAM configuration.  Hopefully this won't cause
+    problems elsewhere.
+
+    Support DESTDIR for make install.
+
+pam-krb5 3.5 (2007-04-10)
+
+    Don't try to chown non-FILE ticket caches, which among other things
+    breaks using pam-krb5 with Heimdal KCM caches.  Thanks, Jeremy
+    Jackson.
+
+    When logging session deletion via pam_setcred or pam_close_session,
+    don't look for the username in the PAM context after it's been freed.
+    Thanks, Markus Moeller.
+
+    Map more Kerberos status codes to PAM status codes for authentication
+    errors.
+
+pam-krb5 3.4 (2007-01-28)
+
+    More compilation fixes for Heimdal 0.7, which has a pkinit function
+    but takes a different number of arguments.  Thanks, Morgan LEFIEUX.
+
+    Never call error_message directly on Heimdal.  krb5_get_err_text can
+    cope with a NULL context and krb5-config on Heimdal doesn't include
+    -lcom_err.
+
+    Handle a NULL return from krb5_get_error_message, since that seems
+    possible in some edge cases.
+
+    Call krb5_get_error_message on Heimdal as well if it's available,
+    since it's supported by the 0.8 release candidates.
+
+pam-krb5 3.3 (2007-01-24)
+
+    Support the new MIT Kerberos error message functions.
+
+    Fix compilation errors in the Heimdal PKINIT support and don't be
+    confused by a similar function in the MIT Kerberos PKINIT branch.
+    Thanks to Douglas E. Engert for the testing and patch.
+
+    Fix compilation errors with Heimdal 0.7, which has some of the PKINIT
+    functions but doesn't define the same error codes.  Thanks, Morgan
+    LEFIEUX.
+
+    Initial support for the MIT Kerberos PKINIT branch, which uses a
+    different mechanism for configuring PKINIT support than Heimdal.  Also
+    support configuration of general preauth parameters for the MIT
+    preauth plugin system via the preauth_opt option.  Thanks to Douglas
+    E. Engert for the initial patch.
+
+    If use_pkinit is set in the PAM configuration and PKINIT isn't
+    available or cannot be forced, always fail authentication.
+
+pam-krb5 3.2 (2007-01-16)
+
+    This release fixes numerous bugs all identified by Douglas E. Engert
+    while testing with Heimdal and PKINIT support.  Thank you!
+
+    Rewrite the code to drop the credlist data structure since we only
+    ever have one set of credentials, allocate new krb5_creds objects, and
+    do proper memory management, which should plug some memory leaks of
+    the contents of krb5_creds objects.
+
+    Probe for the correct Heimdal function to set default initial
+    credential options.
+
+    Prefix the default cache path with "FILE:" to make the cache type
+    explicit.
+
+    Fix installation of the manual page when building from a different
+    directory than the source directory.
+
+    Fix several compilation errors with the PKINIT support with Heimdal
+    0.8rc1 or later.  This code should still be considered alpha-quality.
+
+pam-krb5 3.1 (2007-01-03)
+
+    Fix an infinite loop with failed Kerberos authentication and a doubled
+    colon that causes a syntax error with some compilers.  Thanks, Markus
+    Moeller.
+
+    Move the check for users we should ignore to pam_sm_authenticate
+    from pamk5_password_auth so that it's consistently done in the API
+    function.  This also avoids bogus log messages when authenticating as
+    an ignored user with debug enabled.
+
+pam-krb5 3.0 (2006-12-18)
+
+    Add preliminary PKINIT support, contributed by Douglas E. Engert.
+    I reorganized and refactored the code extensively and it therefore may
+    not compile; until it has received more testing, it should be
+    considered alpha-quality.  Currently, PKINIT support requires Heimdal
+    0.8rc1 or later.
+
+    Add a keytab configuration option to use a different keytab for
+    initial credential validation.
+
+    Add a ticket_lifetime configuration option to set the lifetime of
+    obtained credentials.
+
+    Add the banner and expose_account configuration options, which control
+    the prompts for authentication and password changing.  Provide more
+    informative prompts when changing passwords.
+
+    Work around a bug in MIT Kerberos prior to 1.4 causing the library to
+    cache the default realm and assume a particular realm even if the
+    default realm is later changed.  This bug prevented running two
+    instances of pam-krb5 with different realm settings in the same PAM
+    stack.  Thanks, Dave Botsch.
+
+    Honor PAM_SILENT when the Kerberos library prompts for more
+    information, passing to the application only prompts.
+
+    If PAM_USER is set to a fully-qualified principal that the Kerberos
+    library can map to a local account name, reset PAM_USER to that local
+    account name after authentication.
+
+    Avoid memory leaks in the Kerberos prompter by freeing the PAM
+    response strings.  We were already doing this elsewhere and the world
+    didn't end, so assume that it's safe for the PAM module to do this.
+    Also avoid memory leaks in some unusual error conditions.
+
+    Return unknown user rather than internal error when attempting
+    authentication of a user we're supposed to ignore.
+
+    When debug is enabled, report the principal for which we're attempting
+    authentication to help catch realm configuration errors.
+
+    Document the broken behavior of old versions of OpenSSH, which tell
+    PAM to refresh credentials rather than opening a session.  Thanks,
+    Michael C. Garrison.
+
+    Add a link to the distribution page to the pam-krb5 man page.
+
+    Extensive refactoring and reorganization of the code.
+
+pam-krb5 2.6 (2006-11-28)
+
+    Don't assume the pointer set by pam_get_user is usable over the life
+    of the PAM module; instead, save a local copy.
+
+    Avoid a use of already freed memory when debugging is enabled.
+
+    Use __func__ instead of __FUNCTION__ and provide a fallback for older
+    versions of gcc and for systems that support neither.  Should fix
+    compilation issues with Sun's C compiler.
+
+    On platforms where we know the appropriate compiler flags, try to
+    build the module so that symbols are resolved within the module in
+    preference to any externally available symbols.  Also add the
+    hopefully correct compiler flags for Sun's C compiler.
+
+pam-krb5 2.5 (2006-11-03)
+
+    Don't free the results of pam_get_item(PAM_AUTHTOK) when changing
+    passwords.  Thanks, Arne Nordmark.
+
+    Be a bit more thorough when checking authorization in
+    pam_sm_acct_mgmt.  Re-retrieve the value of user in case the
+    application changed it, and if we have a ticket cache (we may not even
+    after a successful authentication if no_ccache was specified),
+    retrieve the principal from it rather than using the principal from
+    the context.
+
+    Overwrite passwords with 0 before freeing them, just out of paranoia
+    (and because PAM also does this internally).
+
+pam-krb5 2.4 (2006-10-05)
+
+    Fix compilation problems with Heimdal.  Thanks, Matthijs Mohlmann and
+    Douglas Engert.
+
+    Check for memory allocation failures when parsing PAM options rather
+    than segfaulting.
+
+    Fix several places where an uninitialized context could have been
+    passed into the argument parsing function.
+
+    Refactor the code to read configuration from krb5.conf to be easier
+    to read and understand.  Parse renew_lifetime immediately and always
+    report an error rather than deferring time parsing until acquiring
+    tickets.
+
+    Log errors (not just authentication failures) at the LOG_ERR level
+    to match (some of) the recommendations of the Linux PAM documentation.
+
+    Log an error when an unknown option is passed via the PAM
+    configuration.
+
+pam-krb5 2.3 (2006-09-03)
+
+    Fix the interface between the Kerberos prompting function and the
+    PAM conversation function on Linux.  Prior to this fix, the PAM module
+    would only work on Solaris if Kerberos passed multiple prompts, which
+    happens when an account requires a password change.  Solaris and Linux
+    PAM implementations expect a different structure of pam_message
+    structs in the conversation function; use a workaround to cater to
+    both of them.  Based on a patch by Joachim Keltsch.
+
+    Implement retain_after_close, which specifies that the PAM module
+    should never destroy the user's ticket cache, even on session end.
+
+    Adjust for the differences in Solaris's PAM libraries:  Include
+    pam_appl.h everywhere for structure and type definitions, and add
+    portability workarounds for the return statuses missing from the
+    Solaris implementation.
+
+pam-krb5 2.2 (2006-08-28)
+
+    Allow the default realm to be overridden in the PAM options.
+
+    Use the realm, default or otherwise, when reading options from
+    krb5.conf so that realm-specific sections in [appdefaults] work
+    correctly.
+
+    Update the build and installation documentation for the new
+    Autoconf-based build system.  This should have been in the last
+    release but was missed.
+
+    Initialize ticket options correctly when built with Heimdal.
+
+    Fix a typo that caused the Heimdal support not to compile.  Thanks,
+    Matthijs Mohlmann.
+
+pam-krb5 2.1 (2006-08-26)
+
+    Strip off a FILE: prefix from the cache path before creating it in
+    case the user set ccache or ccache_dir with a cache type prefix.
+    Thanks to Björn Torkelsson for the patch.
+
+    Added an Autoconf script to distinguish between Heimdal and MIT
+    Kerberos and take care of other portability issues.  Rewrote the
+    Makefile accordingly.
+
+    Added portability and error reporting fixes for Heimdal, thanks to
+    Matthijs Mohlmann.
+
+pam-krb5 2.0 (2006-08-11)
+
+    Always use a disk cache for temporary storage of credentials between
+    authentication and setcred or session initialization.  This allows the
+    module to work correctly with OpenSSH ChallengeResponseAuthentication.
+
+    Add support for some PAM options that were supported by the
+    Sourceforge K5 PAM module, most notably minimum_uid and
+    renew_lifetime.
+
+    Support setting many PAM options from krb5.conf as well as on the PAM
+    command line, using the same application section as the Sourceforge
+    PAM module.  Use the profile reading functions provided by the
+    Kerberos libraries.
+
+    Add support for use_authtok, which is like use_first_pass except that
+    it will never prompt even if no password is currently set.
+
+    Add a search_k5login option to check the user's password against every
+    principal listed in .k5login, to support use of this module to
+    authenticate user access to shared accounts.
+
+    Add an ignore_k5login option that bypasses all checks of .k5login
+    files entirely and relies solely on krb5_aname_to_localname checks.
+
+    Re-add the ccache option to specify the exact file name of the ticket
+    cache, and allow for randomization using mkstemp even when this option
+    is used.
+
+    Only call krb5_kuserok (the .k5login check) when the account to which
+    the user is authenticating is a local account.  It's up to the
+    application to handle authorization checks for non-local accounts.
+
+    Support preliminary checks for password changing by using that to
+    obtain the user's current credentials.  Correctly handle saved
+    passwords from previous authentications or password changes when
+    changing passwords, and correctly set the saved passwords for
+    subsequent password changes in the PAM stack.
+
+    Only initialize the ticket cache once, no matter how many times
+    setcred is called.  This saves duplicate work and works around a bug
+    in X.org xdm that otherwise causes it to lose the PAM environment.
+
+    When reinitializing a ticket cache, never reinitialize the temporary
+    cache created by the authentication call.  Instead, fall back to the
+    default ticket cache name if KRB5CCNAME isn't set.
+
+    Improve support for no_ccache.  Now, it doesn't even generate a
+    temporary ticket cache during authentication but only uses an
+    in-memory credential list.
+
+    Do user ticket validation using the standard Kerberos library call
+    rather than rolling our own code.  This means that the user can now
+    set options in krb5.conf to control whether that call should fail if
+    the local keytab isn't readable or contains no usable keys.
+
+    Completely rewrite the man page.  Clean it up and make it more
+    readable and fully document all of the options.  Also rewrite the
+    README file and clean up the rest of the package documentation.
+
+    Don't create a ticket cache until after successful authentication.
+
+    Understand the FILE: prefix to Kerberos ticket cache names and compare
+    and chown ticket caches properly with that prefix.
+
+    Add a trailing nul to the password in the Kerberos prompter function,
+    since some code relies on it being there.
+
+    Review the return status of each PAM function and ensure that we only
+    return failure statuses that are supported for that function.
+
+    Rename all internal functions with a pamk5_* prefix to avoid
+    conflicting with any application or system library functions.
+
+    Eliminate global variables in the PAM module and do a better job at
+    cleaning up memory usage.  There are still a few places where the PAM
+    conversation functions may leak memory due to an incomplete
+    specification in the PAM API on who should free what memory.
+
+    The logging messages produced when debug is set should now be more
+    consistent and more complete.
+
+pam-krb5 1.2 (2005-09-27)
+
+    Don't reinitialize the ticket cache if the old and new cache have the
+    same name, since otherwise we end up destroying it.
+
+    Always set KRB5CCNAME, even when reinitializing.
+
+    When reinitializing, look for the ticket cache in the saved context
+    even if KRB5CCNAME isn't set.  OpenSSH calls it this way.
+
+    Drop the ccache option and add ccache_dir instead, which only
+    specifies the directory for ticket caches and is therefore easier to
+    implement.
+
+pam-krb5 1.1 (2005-08-31)
+
+    Add support for reinitialization/refreshing of credentials in
+    pam_sm_setcred.
+
+    Set PAM_AUTHTOK and PAM_OLDAUTHTOK when authenticating to better
+    support stacking this module with others.
+
+    Add an ignore_root option to not do anything when the account to which
+    the user is authenticating is root.  This allows one to log in via
+    console as root even when the network is down (thereby breaking the
+    PAM module in ways that login doesn't like due to timeouts in the
+    Kerberos libraries).
+
+    Store the entire context structure in PAM's memory rather than just
+    the name of the ticket cache so that we can pass around more data to
+    ourself.
+
+    Bring errors more in line with the official PAM specification.
+
+    Move prompt generation into the PAM module rather than letting the
+    Kerberos library generate the prompt.  This way we don't leak
+    principal information to the caller, and the non-standard prompt also
+    broke some applications like gksudo.
+
+    Support session management and destruction of the ticket cache on
+    close of session.
+
+    Don't require that the user have a local account on the system.
+
+    Include the user UID in the default ticket cache name so that rpc.gssd
+    and similar programs can find it.
diff --git a/README b/README
new file mode 100644
index 000000000000..3b7cb5c886dc
--- /dev/null
+++ b/README
@@ -0,0 +1,641 @@
+                              pam-krb5 4.11
+                 (PAM module for Kerberos authentication)
+               Maintained by Russ Allbery <eagle@eyrie.org>
+
+  Copyright 2005-2010, 2014-2015, 2017, 2020-2021 Russ Allbery
+  <eagle@eyrie.org>.  Copyright 2009-2011 The Board of Trustees of the
+  Leland Stanford Junior University.  Copyright 2005 Andres Salomon
+  <dilinger@debian.org>.  Copyright 1999-2000 Frank Cusack
+  <fcusack@fcusack.com>.  This software is distributed under a BSD-style
+  license.  Please see the section LICENSE below for more information.
+
+BLURB
+
+  pam-krb5 is a Kerberos PAM module for either MIT Kerberos or Heimdal.
+  It supports ticket refreshing by screen savers, configurable
+  authorization handling, authentication of non-local accounts for network
+  services, password changing, and password expiration, as well as all the
+  standard expected PAM features.  It works correctly with OpenSSH, even
+  with ChallengeResponseAuthentication and PrivilegeSeparation enabled,
+  and supports extensive configuration either by PAM options or in
+  krb5.conf or both.  PKINIT is supported with recent versions of both MIT
+  Kerberos and Heimdal and FAST is supported with recent MIT Kerberos.
+
+DESCRIPTION
+
+  pam-krb5 provides a Kerberos PAM module that supports authentication,
+  user ticket cache handling, simple authorization (via .k5login or
+  checking Kerberos principals against local usernames), and password
+  changing.  It can be configured through either options in the PAM
+  configuration itself or through entries in the system krb5.conf file,
+  and it tries to work around PAM implementation flaws in commonly-used
+  PAM-enabled applications such as OpenSSH and xdm.  It supports both
+  PKINIT and FAST to the extent that the underlying Kerberos libraries
+  support these features.
+
+  This is not the Kerberos PAM module maintained on Sourceforge and used
+  on Red Hat systems.  It is an independent implementation that, if it
+  ever shared any common code, diverged long ago.  It supports some
+  features that the Sourceforge module does not (particularly around
+  authorization), and does not support some options (particularly ones not
+  directly related to Kerberos) that it does.  This module will never
+  support Kerberos v4 or AFS.  For an AFS session module that works with
+  this module (or any other Kerberos PAM module), see pam-afs-session [1].
+
+  [1] https://www.eyrie.org/~eagle/software/pam-afs-session/
+
+  If there are other options besides AFS and Kerberos v4 support from the
+  Sourceforge PAM module that you're missing in this module, please let me
+  know.
+
+REQUIREMENTS
+
+  Either MIT Kerberos (or Kerberos implementations based on it) or Heimdal
+  are supported.  MIT Keberos 1.3 or later may be required; this module
+  has not been tested with earlier versions.
+
+  For PKINIT support, Heimdal 0.8rc1 or later or MIT Kerberos 1.6.3 or
+  later are required.  Earlier MIT Kerberos 1.6 releases have a bug in
+  their handling of PKINIT options.  MIT Kerberos 1.12 or later is
+  required to use the use_pkinit PAM option.
+
+  For FAST (Flexible Authentication Secure Tunneling) support, MIT
+  Kerberos 1.7 or higher is required.  For anonymous FAST support,
+  anonymous authentication (generally anonymous PKINIT) support is
+  required in both the Kerberos libraries and in the local KDC.
+
+  This module should work on Linux and build with gcc or clang.  It may
+  still work on Solaris and build with the Sun C compiler, but I have only
+  tested it on Linux recently.  There is beta-quality support for the AIX
+  NAS Kerberos implementation that has not been tested in years.  Other
+  PAM implementations will probably require some porting, although
+  untested build system support is present for FreeBSD, Mac OS X, and
+  HP-UX.  I personally can only test on Linux and rely on others to report
+  problems on other operating systems.
+
+  Old versions of OpenSSH are known to call pam_authenticate followed by
+  pam_setcred(PAM_REINITIALIZE_CRED) without first calling
+  pam_open_session, thereby requesting that an existing ticket cache be
+  renewed (similar to what a screensaver would want) rather than
+  requesting a new ticket cache be created.  Since this behavior is
+  indistinguishable at the PAM level from a screensaver, pam-krb5 when
+  used with these old versions of OpenSSH will refresh the ticket cache of
+  the OpenSSH daemon rather than setting up a new ticket cache for the
+  user.  The resulting ticket cache will have the correct permissions
+  (this is not a security concern), but will not be named correctly or
+  referenced in the user's environment and will be overwritten by the next
+  user login.  The best solution to this problem is to upgrade OpenSSH.
+  I'm not sure exactly when this problem was fixed, but at the very least
+  OpenSSH 4.3 and later do not exhibit it.
+
+  To bootstrap from a Git checkout, or if you change the Automake files
+  and need to regenerate Makefile.in, you will need Automake 1.11 or
+  later.  For bootstrap or if you change configure.ac or any of the m4
+  files it includes and need to regenerate configure or config.h.in, you
+  will need Autoconf 2.64 or later.  Perl is also required to generate
+  manual pages from a fresh Git checkout.
+
+BUILDING AND INSTALLATION
+
+  You can build and install pam-krb5 with the standard commands:
+
+      ./configure
+      make
+      make install
+
+  If you are building from a Git clone, first run ./bootstrap in the
+  source directory to generate the build files.  make install will
+  probably have to be done as root.  Building outside of the source
+  directory is also supported, if you wish, by creating an empty directory
+  and then running configure with the correct relative path.
+
+  The module will be installed in /usr/local/lib/security by default, but
+  expect to have to override this using --libdir.  The correct
+  installation path for PAM modules varies considerably between systems.
+  The module will always be installed in a subdirectory named security
+  under the specified value of --libdir.  On Red Hat Linux, for example,
+  --libdir=/usr/lib64 is appropriate to install the module into the system
+  PAM directory.  On Debian's amd64 architecture,
+  --libdir=/usr/lib/x86_64-linux-gnu would be correct.
+
+  Normally, configure will use krb5-config to determine the flags to use
+  to compile with your Kerberos libraries.  To specify a particular
+  krb5-config script to use, either set the PATH_KRB5_CONFIG environment
+  variable or pass it to configure like:
+
+      ./configure PATH_KRB5_CONFIG=/path/to/krb5-config
+
+  If krb5-config isn't found, configure will look for the standard
+  Kerberos libraries in locations already searched by your compiler.  If
+  the the krb5-config script first in your path is not the one
+  corresponding to the Kerberos libraries you want to use, or if your
+  Kerberos libraries and includes aren't in a location searched by default
+  by your compiler, you need to specify a different Kerberos installation
+  root via --with-krb5=PATH.  For example:
+
+      ./configure --with-krb5=/usr/pubsw
+
+  You can also individually set the paths to the include directory and the
+  library directory with --with-krb5-include and --with-krb5-lib.  You may
+  need to do this if Autoconf can't figure out whether to use lib, lib32,
+  or lib64 on your platform.
+
+  To not use krb5-config and force library probing even if there is a
+  krb5-config script on your path, set PATH_KRB5_CONFIG to a nonexistent
+  path:
+
+      ./configure PATH_KRB5_CONFIG=/nonexistent
+
+  krb5-config is not used and library probing is always done if either
+  --with-krb5-include or --with-krb5-lib are given.
+
+  Pass --enable-silent-rules to configure for a quieter build (similar to
+  the Linux kernel).  Use make warnings instead of make to build with full
+  compiler warnings (requires either GCC or Clang and may require a
+  relatively current version of the compiler).
+
+  You can pass the --enable-reduced-depends flag to configure to try to
+  minimize the shared library dependencies encoded in the binaries.  This
+  omits from the link line all the libraries included solely because other
+  libraries depend on them and instead links the programs only against
+  libraries whose APIs are called directly.  This will only work with
+  shared libraries and will only work on platforms where shared libraries
+  properly encode their own dependencies (this includes most modern
+  platforms such as all Linux).  It is intended primarily for building
+  packages for Linux distributions to avoid encoding unnecessary shared
+  library dependencies that make shared library migrations more difficult.
+  If none of the above made any sense to you, don't bother with this flag.
+
+TESTING
+
+  pam-krb5 comes with a comprehensive test suite, but it requires some
+  configuration in order to test anything other than low-level utility
+  functions.  For the full test suite, you will need to have a running KDC
+  in which you can create two test accounts, one with admin access to the
+  other.  Using a test KDC environment, if you have one, is recommended.
+
+  Follow the instructions in tests/config/README to configure the test
+  suite.
+
+  Now, you can run the test suite with:
+
+      make check
+
+  If a test fails, you can run a single test with verbose output via:
+
+      tests/runtests -o <name-of-test>
+
+  Do this instead of running the test program directly since it will
+  ensure that necessary environment variables are set up.
+
+  The default libkadm5clnt library on the system must match the
+  implementation of your KDC for the module/expired test to work, since
+  the two kadmin protocols are not compatible.  If you use the MIT library
+  against a Heimdal server, the test will be skipped; if you use the
+  Heimdal library against an MIT server, the test suite may hang.
+
+  Several module/expired tests are expected to fail with Heimdal 1.5 due
+  to a bug in Heimdal with reauthenticating immediately after a
+  library-mediated password change of an expired password.  This is fixed
+  in later releases of Heimdal.
+
+  To run the full test suite, Perl 5.10 or later is required.  The
+  following additional Perl modules will be used if present:
+
+  * Test::Pod
+  * Test::Spelling
+
+  All are available on CPAN.  Those tests will be skipped if the modules
+  are not available.
+
+  To enable tests that don't detect functionality problems but are used to
+  sanity-check the release, set the environment variable RELEASE_TESTING
+  to a true value.  To enable tests that may be sensitive to the local
+  environment or that produce a lot of false positives without uncovering
+  many problems, set the environment variable AUTHOR_TESTING to a true
+  value.
+
+CONFIGURING
+
+  Just installing the module does not enable it or change anything about
+  your system authentication configuration.  To use the module for all
+  system authentication on Debian systems, put something like:
+
+      auth  sufficient   pam_krb5.so minimum_uid=1000
+      auth  required     pam_unix.so try_first_pass nullok_secure
+
+  in /etc/pam.d/common-auth, something like:
+
+      session  optional  pam_krb5.so minimum_uid=1000
+      session  required  pam_unix.so
+
+  in /etc/pam.d/common-session, and something like:
+
+      account  required  pam_krb5.so minimum_uid=1000
+      account  required  pam_unix.so
+
+  in /etc/pam.d/common-account.  The minimum_uid setting tells the PAM
+  module to pass on any users with a UID lower than 1000, thereby
+  bypassing Kerberos authentication for the root account and any system
+  accounts.  You normally want to do this since otherwise, if the network
+  is down, the Kerberos authentication can time out and make it difficult
+  to log in as root and fix matters.  This also avoids problems with
+  Kerberos principals that happen to match system accounts accidentally
+  getting access to those accounts.
+
+  Be sure to include the module in the session group as well as the auth
+  group.  Without the session entry, the user's ticket cache will not be
+  created properly for ssh logins (among possibly others).
+
+  If your users should normally all use Kerberos passwords exclusively,
+  putting something like:
+
+      password sufficient pam_krb5.so minimum_uid=1000
+      password required   pam_unix.so try_first_pass obscure md5
+
+  in /etc/pam.d/common-password will change users' passwords in Kerberos
+  by default and then only fall back on Unix if that doesn't work.  (You
+  can make this tighter by using the more complex new-style PAM
+  configuration.)  If you instead want to synchronize local and Kerberos
+  passwords and change them both at the same time, you can do something
+  like:
+
+      password required   pam_unix.so obscure sha512
+      password required   pam_krb5.so use_authtok minimum_uid=1000
+
+  If you have multiple environments that you want to synchronize and you
+  don't want password changes to continue if the Kerberos password change
+  fails, use the clear_on_fail option.  For example:
+
+      password required   pam_krb5.so clear_on_fail minimum_uid=1000
+      password required   pam_unix.so use_authtok obscure sha512
+      password required   pam_smbpass.so use_authtok
+
+  In this case, if pam_krb5 cannot change the password (due to password
+  strength rules on the KDC, for example), it will clear the stored
+  password (because of the clear_on_fail option), and since pam_unix and
+  pam_smbpass are both configured with use_authtok, they will both fail.
+  clear_on_fail is not the default because it would interfere with the
+  more common pattern of falling back to local passwords if the user
+  doesn't exist in Kerberos.
+
+  If you use a more complex configuration with the Linux PAM [] syntax for
+  the session and account groups, note that pam_krb5 returns a status of
+  ignore, not success, if the user didn't log on with Kerberos.  You may
+  need to handle that explicitly with ignore=ignore in your action list.
+
+  There are many, many other possibilities.  See the Linux PAM
+  documentation for all the configuration options.
+
+  On Red Hat systems, modify /etc/pam.d/system-auth instead, which
+  contains all of the configuration for the different stacks.
+
+  You can also use pam-krb5 only for specific services.  In that case,
+  modify the files in /etc/pam.d for that particular service to use
+  pam_krb5.so for authentication.  For services that are using passwords
+  over TLS to authenticate users, you may want to use the ignore_k5login
+  and no_ccache options to the authenticate module.  .k5login
+  authorization is only meaningful for local accounts and ticket caches
+  are usually (although not always) only useful for interactive sessions.
+
+  Configuring the module for Solaris is both simpler and less flexible,
+  since Solaris (at least Solaris 8 and 9, which are the last versions of
+  Solaris with which this module was extensively tested) use a single
+  /etc/pam.conf file that contains configuration for all programs.  For
+  console login on Solaris, try something like:
+
+      login auth sufficient /usr/local/lib/security/pam_krb5.so minimum_uid=100
+      login auth required /usr/lib/security/pam_unix_auth.so.1 use_first_pass
+      login account required /usr/local/lib/security/pam_krb5.so minimum_uid=100
+      login account required /usr/lib/security/pam_unix_account.so.1
+      login session required /usr/local/lib/security/pam_krb5.so retain_after_close minimum_uid=100
+      login session required /usr/lib/security/pam_unix_session.so.1
+
+  A similar configuration could be used for other services, such as ssh.
+  See the pam.conf(5) man page for more information.  When using this
+  module with Solaris login (at least on Solaris 8 and 9), you will
+  probably also need to add retain_after_close to the PAM configuration to
+  avoid having the user's credentials deleted before they are logged in.
+
+  The Solaris Kerberos library reportedly does not support prompting for a
+  password change of an expired account during authentication.  Supporting
+  password change for expired accounts on Solaris with native Kerberos may
+  therefore require setting the defer_pwchange or force_pwchange option
+  for selected login applications.  See the description and warnings about
+  that option in the pam_krb5(5) man page.
+
+  Some configuration options may be put in the krb5.conf file used by your
+  Kerberos libraries (usually /etc/krb5.conf or /usr/local/etc/krb5.conf)
+  instead or in addition to the PAM configuration.  See the man page for
+  more details.
+
+  The Kerberos library, via pam-krb5, will prompt the user to change their
+  password if their password is expired, but when using OpenSSH, this will
+  only work when ChallengeResponseAuthentication is enabled.  Unless this
+  option is enabled, OpenSSH doesn't pass PAM messages to the user and can
+  only respond to a simple password prompt.
+
+  If you are using MIT Kerberos, be aware that users whose passwords are
+  expired will not be prompted to change their password unless the KDC
+  configuration for your realm in [realms] in krb5.conf contains a
+  master_kdc setting or, if using DNS SRV records, you have a DNS entry
+  for _kerberos-master as well as _kerberos.
+
+DEBUGGING
+
+  The first step when debugging any problems with this module is to add
+  debug to the PAM options for the module (either in the PAM configuration
+  or in krb5.conf).  This will significantly increase the logging from the
+  module and should provide a trace of exactly what failed and any
+  available error information.
+
+  Many Kerberos authentication problems are due to configuration issues in
+  krb5.conf.  If pam-krb5 doesn't work, first check that kinit works on
+  the same system.  That will test your basic Kerberos configuration.  If
+  the system has a keytab file installed that's readable by the process
+  doing authentication via PAM, make sure that the keytab is current and
+  contains a key for host/<system> where <system> is the fully-qualified
+  hostname.  pam-krb5 prevents KDC spoofing by checking the user's
+  credentials when possible, but this means that if a keytab is present it
+  must be correct or authentication will fail.  You can check the keytab
+  with klist -k and kinit -k.
+
+  Be sure that all libraries and modules, including PAM modules, loaded by
+  a program use the same Kerberos libraries.  Sometimes programs that use
+  PAM, such as current versions of OpenSSH, also link against Kerberos
+  directly.  If your sshd is linked against one set of Kerberos libraries
+  and pam-krb5 is linked against a different set of Kerberos libraries,
+  this will often cause problems (such as segmentation faults, bus errors,
+  assertions, or other strange behavior).  Similar issues apply to the
+  com_err library or any other library used by both modules and shared
+  libraries and by the application that loads them.  If your OS ships
+  Kerberos libraries, it's usually best if possible to build all Kerberos
+  software on the system against those libraries.
+
+IMPLEMENTATION NOTES
+
+  The normal sequence of actions taken for a user login is:
+
+      pam_authenticate
+      pam_setcred(PAM_ESTABLISH_CRED)
+      pam_open_session
+      pam_acct_mgmt
+
+  and then at logout:
+
+      pam_close_session
+
+  followed by closing the open PAM session.  The corresponding pam_sm_*
+  functions in this module are called when an application calls those
+  public interface functions.  Not all applications call all of those
+  functions, or in particularly that order, although pam_authenticate is
+  always first and has to be.
+
+  When pam_authenticate is called, pam-krb5 creates a temporary ticket
+  cache in /tmp and sets the PAM environment variable PAM_KRB5CCNAME to
+  point to it.  This ticket cache will be automatically destroyed when the
+  PAM session is closed and is there only to pass the initial credentials
+  to the call to pam_setcred.  The module would use a memory cache, but
+  memory caches will only work if the application preserves the PAM
+  environment between the calls to pam_authenticate and pam_setcred.  Most
+  do, but OpenSSH notoriously does not and calls pam_authenticate in a
+  subprocess, so this method is used to pass the tickets to the
+  pam_setcred call in a different process.
+
+  pam_authenticate does a complete authentication, including checking the
+  resulting TGT by obtaining a service ticket for the local host if
+  possible, but this requires read access to the system keytab.  If the
+  keytab doesn't exist, can't be read, or doesn't include the appropriate
+  credentials, the default is to accept the authentication.  This can be
+  controlled by setting verify_ap_req_nofail to true in [libdefaults] in
+  /etc/krb5.conf.  pam_authenticate also does a basic authorization check,
+  by default calling krb5_kuserok (which uses ~/.k5login if available and
+  falls back to checking that the principal corresponds to the account
+  name).  This can be customized with several options documented in the
+  pam_krb5(5) man page.
+
+  pam-krb5 treats pam_open_session and pam_setcred(PAM_ESTABLISH_CRED) as
+  synonymous, as some applications call one and some call the other.  Both
+  copy the initial credentials from the temporary cache into a permanent
+  cache for this session and set KRB5CCNAME in the environment.  It will
+  remember when the credential cache has been established and then avoid
+  doing any duplicate work afterwards, since some applications call
+  pam_setcred or pam_open_session multiple times (most notably X.Org 7 and
+  earlier xdm, which also throws away the module settings the last time it
+  calls them).
+
+  pam_acct_mgmt finds the ticket cache, reads it in to obtain the
+  authenticated principal, and then does is another authorization check
+  against .k5login or the local account name as described above.
+
+  After the call to pam_setcred or pam_open_session, the ticket cache will
+  be destroyed whenever the calling application either destroys the PAM
+  environment or calls pam_close_session, which it should do on user
+  logout.
+
+  The normal sequence of events when refreshing a ticket cache (such as
+  inside a screensaver) is:
+
+      pam_authenticate
+      pam_setcred(PAM_REINITIALIZE_CRED)
+      pam_acct_mgmt
+
+  (PAM_REFRESH_CRED may be used instead.)  Authentication proceeds as
+  above.  At the pam_setcred stage, rather than creating a new ticket
+  cache, the module instead finds the current ticket cache (from the
+  KRB5CCNAME environment variable or the default ticket cache location
+  from the Kerberos library) and then reinitializes it with the
+  credentials from the temporary pam_authenticate ticket cache.  When
+  refreshing a ticket cache, the application should not open a session.
+  Calling pam_acct_mgmt is optional; pam-krb5 doesn't do anything
+  different when it's called in this case.
+
+  If pam_authenticate apparently didn't succeed, or if an account was
+  configured to be ignored via ignore_root or minimum_uid, pam_setcred
+  (and therefore pam_open_session) and pam_acct_mgmt return PAM_IGNORE,
+  which tells the PAM library to proceed as if that module wasn't listed
+  in the PAM configuration at all.  pam_authenticate, however, returns
+  failure in the ignored user case by default, since otherwise a
+  configuration using ignore_root with pam-krb5 as the only PAM module
+  would allow anyone to log in as root without a password.  There doesn't
+  appear to be a case where returning PAM_IGNORE instead would improve the
+  module's behavior, but if you know of a case, please let me know.
+
+  By default, pam_authenticate intentionally does not follow the PAM
+  standard for handling expired accounts and instead returns failure from
+  pam_authenticate unless the Kerberos libraries are able to change the
+  account password during authentication.  Too many applications either do
+  not call pam_acct_mgmt or ignore its exit status.  The fully correct PAM
+  behavior (returning success from pam_authenticate and
+  PAM_NEW_AUTHTOK_REQD from pam_acct_mgmt) can be enabled with the
+  defer_pwchange option.
+
+  The defer_pwchange option is unfortunately somewhat tricky to implement.
+  In this case, the calling sequence is:
+
+      pam_authenticate
+      pam_acct_mgmt
+      pam_chauthtok
+      pam_setcred
+      pam_open_session
+
+  During the first pam_authenticate, we can't obtain credentials and
+  therefore a ticket cache since the password is expired.  But
+  pam_authenticate isn't called again after pam_chauthtok, so
+  pam_chauthtok has to create a ticket cache.  We however don't want it to
+  do this for the normal password change (passwd) case.
+
+  What we do is set a flag in our PAM data structure saying that we're
+  processing an expired password, and pam_chauthtok, if it sees that flag,
+  redoes the authentication with password prompting disabled after it
+  finishes changing the password.
+
+  Unfortunately, when handling password changes this way, pam_chauthtok
+  will always have to prompt the user for their current password again
+  even though they just typed it.  This is because the saved
+  authentication tokens are cleared after pam_authenticate returns, for
+  security reasons.  We could hack around this by saving the password in
+  our PAM data structure, but this would let the application gain access
+  to it (exactly what the clearing is intended to prevent) and breaks a
+  PAM library guarantee.  We could also work around this by having
+  pam_authenticate get the kadmin/changepw authenticator in the expired
+  password case and store it for pam_chauthtok, but it doesn't seem worth
+  the hassle.
+
+HISTORY AND ACKNOWLEDGEMENTS
+
+  Originally written by Frank Cusack <fcusack@fcusack.com>, with the
+  following acknowledgement:
+
+    Thanks to Naomaru Itoi <itoi@eecs.umich.edu>, Curtis King
+    <curtis.king@cul.ca>, and Derrick Brashear <shadow@dementia.org>, all
+    of whom have written and made available Kerberos 4/5 modules.
+    Although no code in this module is directly from these author's
+    modules, (except the get_user_info() routine in support.c; derived
+    from whichever of these authors originally wrote the first module the
+    other 2 copied from), it was extremely helpful to look over their code
+    which aided in my design.
+
+  The module was then patched for the FreeBSD ports collection with
+  additional modifications by unknown maintainers and then was modified by
+  Joel Kociolek <joko@logidee.com> to be usable with Debian GNU/Linux.
+
+  It was packaged by Sam Hartman as the Kerberos v5 PAM module for Debian
+  and improved and modified by him and later by Russ Allbery to fix bugs
+  and add additional features.  It was then adopted by Andres Salomon, who
+  added support for refreshing credentials.
+
+  The current distribution is maintained by Russ Allbery, who also added
+  support for reading configuration from krb5.conf, added many features
+  for compatibility with the Sourceforge module, commented and
+  standardized the formatting of the code, and overhauled the
+  documentation.
+
+  Thanks to Douglas E. Engert for the initial implementation of PKINIT
+  support.  I have since modified and reworked it extensively, so any bugs
+  or compilation problems are my fault.
+
+  Thanks to Markus Moeller for lots of debugging and multiple patches and
+  suggestions for improved portability.
+
+  Thanks to Booker Bense for the implementation of the alt_auth_map
+  option.
+
+  Thanks to Sam Hartman for the FAST support implementation.
+
+SUPPORT
+
+  The pam-krb5 web page at:
+
+      https://www.eyrie.org/~eagle/software/pam-krb5/
+
+  will always have the current version of this package, the current
+  documentation, and pointers to any additional resources.
+
+  For bug tracking, use the issue tracker on GitHub:
+
+      https://github.com/rra/pam-krb5/issues
+
+  However, please be aware that I tend to be extremely busy and work
+  projects often take priority.  I'll save your report and get to it as
+  soon as I can, but it may take me a couple of months.
+
+SOURCE REPOSITORY
+
+  pam-krb5 is maintained using Git.  You can access the current source on
+  GitHub at:
+
+      https://github.com/rra/pam-krb5
+
+  or by cloning the repository at:
+
+      https://git.eyrie.org/git/kerberos/pam-krb5.git
+
+  or view the repository via the web at:
+
+      https://git.eyrie.org/?p=kerberos/pam-krb5.git
+
+  The eyrie.org repository is the canonical one, maintained by the author,
+  but using GitHub is probably more convenient for most purposes.  Pull
+  requests are gratefully reviewed and normally accepted.
+
+LICENSE
+
+  The pam-krb5 package as a whole is covered by the following copyright
+  statement and license:
+
+    Copyright 2005-2010, 2014-2015, 2017, 2020-2021
+        Russ Allbery <eagle@eyrie.org>
+    Copyright 2009-2011
+        The Board of Trustees of the Leland Stanford Junior University
+    Copyright 2005 Andres Salomon <dilinger@debian.org>
+    Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are
+    met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, and the entire permission notice in its entirety, including
+       the disclaimer of warranties.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the
+       distribution.
+
+    3. The name of the author may not be used to endorse or promote
+       products derived from this software without specific prior written
+       permission.
+
+    ALTERNATIVELY, this product may be distributed under the terms of the
+    GNU General Public License, in which case the provisions of the GPL
+    are required INSTEAD OF the above restrictions.  (This clause is
+    necessary due to a potential bad interaction between the GPL and the
+    restrictions contained in a BSD-style copyright.)
+
+    THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+    WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+    IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+    INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+    BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+    OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+    USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+    DAMAGE.
+
+  Some files in this distribution are individually released under
+  different licenses, all of which are compatible with the above general
+  package license but which may require preservation of additional
+  notices.  All required notices, and detailed information about the
+  licensing of each file, are recorded in the LICENSE file.
+
+  Files covered by a license with an assigned SPDX License Identifier
+  include SPDX-License-Identifier tags to enable automated processing of
+  license information.  See https://spdx.org/licenses/ for more
+  information.
+
+  For any copyright range specified by files in this package as YYYY-ZZZZ,
+  the range specifies every single year in that closed interval.
diff --git a/README.md b/README.md
new file mode 100644
index 000000000000..e74b6751ceb4
--- /dev/null
+++ b/README.md
@@ -0,0 +1,665 @@
+# pam-krb5
+
+[![Build
+status](https://github.com/rra/pam-krb5/workflows/build/badge.svg)](https://github.com/rra/pam-krb5/actions)
+[![Debian
+package](https://img.shields.io/debian/v/libpam-krb5/unstable)](https://tracker.debian.org/pkg/libpam-krb5)
+
+Copyright 2005-2010, 2014-2015, 2017, 2020-2021 Russ Allbery
+<eagle@eyrie.org>.  Copyright 2009-2011 The Board of Trustees of the
+Leland Stanford Junior University.  Copyright 2005 Andres Salomon
+<dilinger@debian.org>.  Copyright 1999-2000 Frank Cusack
+<fcusack@fcusack.com>.  This software is distributed under a BSD-style
+license.  Please see the section [License](#license) below for more
+information.
+
+## Blurb
+
+pam-krb5 is a Kerberos PAM module for either MIT Kerberos or Heimdal.  It
+supports ticket refreshing by screen savers, configurable authorization
+handling, authentication of non-local accounts for network services,
+password changing, and password expiration, as well as all the standard
+expected PAM features.  It works correctly with OpenSSH, even with
+ChallengeResponseAuthentication and PrivilegeSeparation enabled, and
+supports extensive configuration either by PAM options or in krb5.conf or
+both.  PKINIT is supported with recent versions of both MIT Kerberos and
+Heimdal and FAST is supported with recent MIT Kerberos.
+
+## Description
+
+pam-krb5 provides a Kerberos PAM module that supports authentication, user
+ticket cache handling, simple authorization (via .k5login or checking
+Kerberos principals against local usernames), and password changing.  It
+can be configured through either options in the PAM configuration itself
+or through entries in the system krb5.conf file, and it tries to work
+around PAM implementation flaws in commonly-used PAM-enabled applications
+such as OpenSSH and xdm.  It supports both PKINIT and FAST to the extent
+that the underlying Kerberos libraries support these features.
+
+This is not the Kerberos PAM module maintained on Sourceforge and used on
+Red Hat systems.  It is an independent implementation that, if it ever
+shared any common code, diverged long ago.  It supports some features that
+the Sourceforge module does not (particularly around authorization), and
+does not support some options (particularly ones not directly related to
+Kerberos) that it does.  This module will never support Kerberos v4 or
+AFS.  For an AFS session module that works with this module (or any other
+Kerberos PAM module), see
+[pam-afs-session](https://www.eyrie.org/~eagle/software/pam-afs-session/).
+
+If there are other options besides AFS and Kerberos v4 support from the
+Sourceforge PAM module that you're missing in this module, please let me
+know.
+
+## Requirements
+
+Either MIT Kerberos (or Kerberos implementations based on it) or Heimdal
+are supported.  MIT Keberos 1.3 or later may be required; this module has
+not been tested with earlier versions.
+
+For PKINIT support, Heimdal 0.8rc1 or later or MIT Kerberos 1.6.3 or later
+are required.  Earlier MIT Kerberos 1.6 releases have a bug in their
+handling of PKINIT options.  MIT Kerberos 1.12 or later is required to use
+the use_pkinit PAM option.
+
+For FAST (Flexible Authentication Secure Tunneling) support, MIT Kerberos
+1.7 or higher is required.  For anonymous FAST support, anonymous
+authentication (generally anonymous PKINIT) support is required in both
+the Kerberos libraries and in the local KDC.
+
+This module should work on Linux and build with gcc or clang.  It may
+still work on Solaris and build with the Sun C compiler, but I have only
+tested it on Linux recently.  There is beta-quality support for the AIX
+NAS Kerberos implementation that has not been tested in years.  Other PAM
+implementations will probably require some porting, although untested
+build system support is present for FreeBSD, Mac OS X, and HP-UX.  I
+personally can only test on Linux and rely on others to report problems on
+other operating systems.
+
+Old versions of OpenSSH are known to call `pam_authenticate` followed by
+`pam_setcred(PAM_REINITIALIZE_CRED)` without first calling
+`pam_open_session`, thereby requesting that an existing ticket cache be
+renewed (similar to what a screensaver would want) rather than requesting
+a new ticket cache be created.  Since this behavior is indistinguishable
+at the PAM level from a screensaver, pam-krb5 when used with these old
+versions of OpenSSH will refresh the ticket cache of the OpenSSH daemon
+rather than setting up a new ticket cache for the user.  The resulting
+ticket cache will have the correct permissions (this is not a security
+concern), but will not be named correctly or referenced in the user's
+environment and will be overwritten by the next user login.  The best
+solution to this problem is to upgrade OpenSSH.  I'm not sure exactly when
+this problem was fixed, but at the very least OpenSSH 4.3 and later do not
+exhibit it.
+
+To bootstrap from a Git checkout, or if you change the Automake files and
+need to regenerate Makefile.in, you will need Automake 1.11 or later.  For
+bootstrap or if you change configure.ac or any of the m4 files it includes
+and need to regenerate configure or config.h.in, you will need Autoconf
+2.64 or later.  Perl is also required to generate manual pages from a
+fresh Git checkout.
+
+## Building and Installation
+
+You can build and install pam-krb5 with the standard commands:
+
+```
+    ./configure
+    make
+    make install
+```
+
+If you are building from a Git clone, first run `./bootstrap` in the
+source directory to generate the build files.  `make install` will
+probably have to be done as root.  Building outside of the source
+directory is also supported, if you wish, by creating an empty directory
+and then running configure with the correct relative path.
+
+The module will be installed in `/usr/local/lib/security` by default, but
+expect to have to override this using `--libdir`.  The correct
+installation path for PAM modules varies considerably between systems.
+The module will always be installed in a subdirectory named `security`
+under the specified value of `--libdir`.  On Red Hat Linux, for example,
+`--libdir=/usr/lib64` is appropriate to install the module into the system
+PAM directory.  On Debian's amd64 architecture,
+`--libdir=/usr/lib/x86_64-linux-gnu` would be correct.
+
+Normally, configure will use `krb5-config` to determine the flags to use
+to compile with your Kerberos libraries.  To specify a particular
+`krb5-config` script to use, either set the `PATH_KRB5_CONFIG` environment
+variable or pass it to configure like:
+
+```
+    ./configure PATH_KRB5_CONFIG=/path/to/krb5-config
+```
+
+If `krb5-config` isn't found, configure will look for the standard
+Kerberos libraries in locations already searched by your compiler.  If the
+the `krb5-config` script first in your path is not the one corresponding
+to the Kerberos libraries you want to use, or if your Kerberos libraries
+and includes aren't in a location searched by default by your compiler,
+you need to specify a different Kerberos installation root via
+`--with-krb5=PATH`.  For example:
+
+```
+    ./configure --with-krb5=/usr/pubsw
+```
+
+You can also individually set the paths to the include directory and the
+library directory with `--with-krb5-include` and `--with-krb5-lib`.  You
+may need to do this if Autoconf can't figure out whether to use `lib`,
+`lib32`, or `lib64` on your platform.
+
+To not use `krb5-config` and force library probing even if there is a
+`krb5-config` script on your path, set `PATH_KRB5_CONFIG` to a nonexistent
+path:
+
+```
+    ./configure PATH_KRB5_CONFIG=/nonexistent
+```
+
+`krb5-config` is not used and library probing is always done if either
+`--with-krb5-include` or `--with-krb5-lib` are given.
+
+Pass `--enable-silent-rules` to configure for a quieter build (similar to
+the Linux kernel).  Use `make warnings` instead of `make` to build with
+full GCC compiler warnings (requires either GCC or Clang and may require a
+relatively current version of the compiler).
+
+You can pass the `--enable-reduced-depends` flag to configure to try to
+minimize the shared library dependencies encoded in the binaries.  This
+omits from the link line all the libraries included solely because other
+libraries depend on them and instead links the programs only against
+libraries whose APIs are called directly.  This will only work with shared
+libraries and will only work on platforms where shared libraries properly
+encode their own dependencies (this includes most modern platforms such as
+all Linux).  It is intended primarily for building packages for Linux
+distributions to avoid encoding unnecessary shared library dependencies
+that make shared library migrations more difficult.  If none of the above
+made any sense to you, don't bother with this flag.
+
+## Testing
+
+pam-krb5 comes with a comprehensive test suite, but it requires some
+configuration in order to test anything other than low-level utility
+functions.  For the full test suite, you will need to have a running KDC
+in which you can create two test accounts, one with admin access to the
+other.  Using a test KDC environment, if you have one, is recommended.
+
+Follow the instructions in `tests/config/README` to configure the test
+suite.
+
+Now, you can run the test suite with:
+
+```
+    make check
+```
+
+If a test fails, you can run a single test with verbose output via:
+
+```
+    tests/runtests -o <name-of-test>
+```
+
+Do this instead of running the test program directly since it will ensure
+that necessary environment variables are set up.
+
+The default libkadm5clnt library on the system must match the
+implementation of your KDC for the module/expired test to work, since the
+two kadmin protocols are not compatible.  If you use the MIT library
+against a Heimdal server, the test will be skipped; if you use the Heimdal
+library against an MIT server, the test suite may hang.
+
+Several `module/expired` tests are expected to fail with Heimdal 1.5 due
+to a bug in Heimdal with reauthenticating immediately after a
+library-mediated password change of an expired password.  This is fixed in
+later releases of Heimdal.
+
+To run the full test suite, Perl 5.10 or later is required.  The following
+additional Perl modules will be used if present:
+
+* Test::Pod
+* Test::Spelling
+
+All are available on CPAN.  Those tests will be skipped if the modules are
+not available.
+
+To enable tests that don't detect functionality problems but are used to
+sanity-check the release, set the environment variable `RELEASE_TESTING`
+to a true value.  To enable tests that may be sensitive to the local
+environment or that produce a lot of false positives without uncovering
+many problems, set the environment variable `AUTHOR_TESTING` to a true
+value.
+
+## Configuring
+
+Just installing the module does not enable it or change anything about
+your system authentication configuration.  To use the module for all
+system authentication on Debian systems, put something like:
+
+```
+    auth  sufficient   pam_krb5.so minimum_uid=1000
+    auth  required     pam_unix.so try_first_pass nullok_secure
+```
+
+in `/etc/pam.d/common-auth`, something like:
+
+```
+    session  optional  pam_krb5.so minimum_uid=1000
+    session  required  pam_unix.so
+```
+
+in `/etc/pam.d/common-session`, and something like:
+
+```
+    account  required  pam_krb5.so minimum_uid=1000
+    account  required  pam_unix.so
+```
+
+in `/etc/pam.d/common-account`.  The `minimum_uid` setting tells the PAM
+module to pass on any users with a UID lower than 1000, thereby bypassing
+Kerberos authentication for the root account and any system accounts.  You
+normally want to do this since otherwise, if the network is down, the
+Kerberos authentication can time out and make it difficult to log in as
+root and fix matters.  This also avoids problems with Kerberos principals
+that happen to match system accounts accidentally getting access to those
+accounts.
+
+Be sure to include the module in the session group as well as the auth
+group.  Without the session entry, the user's ticket cache will not be
+created properly for ssh logins (among possibly others).
+
+If your users should normally all use Kerberos passwords exclusively,
+putting something like:
+
+```
+    password sufficient pam_krb5.so minimum_uid=1000
+    password required   pam_unix.so try_first_pass obscure md5
+```
+
+in `/etc/pam.d/common-password` will change users' passwords in Kerberos
+by default and then only fall back on Unix if that doesn't work.  (You can
+make this tighter by using the more complex new-style PAM configuration.)
+If you instead want to synchronize local and Kerberos passwords and change
+them both at the same time, you can do something like:
+
+```
+    password required   pam_unix.so obscure sha512
+    password required   pam_krb5.so use_authtok minimum_uid=1000
+```
+
+If you have multiple environments that you want to synchronize and you
+don't want password changes to continue if the Kerberos password change
+fails, use the `clear_on_fail` option.  For example:
+
+```
+    password required   pam_krb5.so clear_on_fail minimum_uid=1000
+    password required   pam_unix.so use_authtok obscure sha512
+    password required   pam_smbpass.so use_authtok
+```
+
+In this case, if `pam_krb5` cannot change the password (due to password
+strength rules on the KDC, for example), it will clear the stored password
+(because of the `clear_on_fail` option), and since `pam_unix` and
+`pam_smbpass` are both configured with `use_authtok`, they will both fail.
+`clear_on_fail` is not the default because it would interfere with the
+more common pattern of falling back to local passwords if the user doesn't
+exist in Kerberos.
+
+If you use a more complex configuration with the Linux PAM `[]` syntax for
+the session and account groups, note that `pam_krb5` returns a status of
+ignore, not success, if the user didn't log on with Kerberos.  You may
+need to handle that explicitly with `ignore=ignore` in your action list.
+
+There are many, many other possibilities.  See the Linux PAM documentation
+for all the configuration options.
+
+On Red Hat systems, modify `/etc/pam.d/system-auth` instead, which
+contains all of the configuration for the different stacks.
+
+You can also use pam-krb5 only for specific services.  In that case,
+modify the files in `/etc/pam.d` for that particular service to use
+`pam_krb5.so` for authentication.  For services that are using passwords
+over TLS to authenticate users, you may want to use the `ignore_k5login`
+and `no_ccache` options to the authenticate module.  `.k5login`
+authorization is only meaningful for local accounts and ticket caches are
+usually (although not always) only useful for interactive sessions.
+
+Configuring the module for Solaris is both simpler and less flexible,
+since Solaris (at least Solaris 8 and 9, which are the last versions of
+Solaris with which this module was extensively tested) use a single
+`/etc/pam.conf` file that contains configuration for all programs.  For
+console login on Solaris, try something like:
+
+```
+    login auth sufficient /usr/local/lib/security/pam_krb5.so minimum_uid=100
+    login auth required /usr/lib/security/pam_unix_auth.so.1 use_first_pass
+    login account required /usr/local/lib/security/pam_krb5.so minimum_uid=100
+    login account required /usr/lib/security/pam_unix_account.so.1
+    login session required /usr/local/lib/security/pam_krb5.so retain_after_close minimum_uid=100
+    login session required /usr/lib/security/pam_unix_session.so.1
+```
+
+A similar configuration could be used for other services, such as ssh.
+See the pam.conf(5) man page for more information.  When using this module
+with Solaris login (at least on Solaris 8 and 9), you will probably also
+need to add `retain_after_close` to the PAM configuration to avoid having
+the user's credentials deleted before they are logged in.
+
+The Solaris Kerberos library reportedly does not support prompting for a
+password change of an expired account during authentication.  Supporting
+password change for expired accounts on Solaris with native Kerberos may
+therefore require setting the `defer_pwchange` or `force_pwchange` option
+for selected login applications.  See the description and warnings about
+that option in the pam_krb5(5) man page.
+
+Some configuration options may be put in the `krb5.conf` file used by your
+Kerberos libraries (usually `/etc/krb5.conf` or
+`/usr/local/etc/krb5.conf`) instead or in addition to the PAM
+configuration.  See the man page for more details.
+
+The Kerberos library, via pam-krb5, will prompt the user to change their
+password if their password is expired, but when using OpenSSH, this will
+only work when `ChallengeResponseAuthentication` is enabled.  Unless this
+option is enabled, OpenSSH doesn't pass PAM messages to the user and can
+only respond to a simple password prompt.
+
+If you are using MIT Kerberos, be aware that users whose passwords are
+expired will not be prompted to change their password unless the KDC
+configuration for your realm in `[realms]` in `krb5.conf` contains a
+`master_kdc` setting or, if using DNS SRV records, you have a DNS entry
+for `_kerberos-master` as well as `_kerberos`.
+
+## Debugging
+
+The first step when debugging any problems with this module is to add
+`debug` to the PAM options for the module (either in the PAM configuration
+or in `krb5.conf`).  This will significantly increase the logging from the
+module and should provide a trace of exactly what failed and any available
+error information.
+
+Many Kerberos authentication problems are due to configuration issues in
+`krb5.conf`.  If pam-krb5 doesn't work, first check that `kinit` works on
+the same system.  That will test your basic Kerberos configuration.  If
+the system has a keytab file installed that's readable by the process
+doing authentication via PAM, make sure that the keytab is current and
+contains a key for `host/<system>` where <system> is the fully-qualified
+hostname.  pam-krb5 prevents KDC spoofing by checking the user's
+credentials when possible, but this means that if a keytab is present it
+must be correct or authentication will fail.  You can check the keytab
+with `klist -k` and `kinit -k`.
+
+Be sure that all libraries and modules, including PAM modules, loaded by a
+program use the same Kerberos libraries.  Sometimes programs that use PAM,
+such as current versions of OpenSSH, also link against Kerberos directly.
+If your sshd is linked against one set of Kerberos libraries and pam-krb5
+is linked against a different set of Kerberos libraries, this will often
+cause problems (such as segmentation faults, bus errors, assertions, or
+other strange behavior).  Similar issues apply to the com_err library or
+any other library used by both modules and shared libraries and by the
+application that loads them.  If your OS ships Kerberos libraries, it's
+usually best if possible to build all Kerberos software on the system
+against those libraries.
+
+## Implementation Notes
+
+The normal sequence of actions taken for a user login is:
+
+```
+    pam_authenticate
+    pam_setcred(PAM_ESTABLISH_CRED)
+    pam_open_session
+    pam_acct_mgmt
+```
+
+and then at logout:
+
+```
+    pam_close_session
+```
+
+followed by closing the open PAM session.  The corresponding `pam_sm_*`
+functions in this module are called when an application calls those public
+interface functions.  Not all applications call all of those functions, or
+in particularly that order, although `pam_authenticate` is always first
+and has to be.
+
+When `pam_authenticate` is called, pam-krb5 creates a temporary ticket
+cache in `/tmp` and sets the PAM environment variable `PAM_KRB5CCNAME` to
+point to it.  This ticket cache will be automatically destroyed when the
+PAM session is closed and is there only to pass the initial credentials to
+the call to `pam_setcred`.  The module would use a memory cache, but
+memory caches will only work if the application preserves the PAM
+environment between the calls to `pam_authenticate` and `pam_setcred`.
+Most do, but OpenSSH notoriously does not and calls `pam_authenticate` in
+a subprocess, so this method is used to pass the tickets to the
+`pam_setcred` call in a different process.
+
+`pam_authenticate` does a complete authentication, including checking the
+resulting TGT by obtaining a service ticket for the local host if
+possible, but this requires read access to the system keytab.  If the
+keytab doesn't exist, can't be read, or doesn't include the appropriate
+credentials, the default is to accept the authentication.  This can be
+controlled by setting `verify_ap_req_nofail` to true in `[libdefaults]` in
+`/etc/krb5.conf`.  `pam_authenticate` also does a basic authorization
+check, by default calling `krb5_kuserok` (which uses `~/.k5login` if
+available and falls back to checking that the principal corresponds to the
+account name).  This can be customized with several options documented in
+the pam_krb5(5) man page.
+
+pam-krb5 treats `pam_open_session` and `pam_setcred(PAM_ESTABLISH_CRED)`
+as synonymous, as some applications call one and some call the other.
+Both copy the initial credentials from the temporary cache into a
+permanent cache for this session and set `KRB5CCNAME` in the environment.
+It will remember when the credential cache has been established and then
+avoid doing any duplicate work afterwards, since some applications call
+`pam_setcred` or `pam_open_session` multiple times (most notably X.Org 7
+and earlier xdm, which also throws away the module settings the last time
+it calls them).
+
+`pam_acct_mgmt` finds the ticket cache, reads it in to obtain the
+authenticated principal, and then does is another authorization check
+against `.k5login` or the local account name as described above.
+
+After the call to `pam_setcred` or `pam_open_session`, the ticket cache
+will be destroyed whenever the calling application either destroys the PAM
+environment or calls `pam_close_session`, which it should do on user
+logout.
+
+The normal sequence of events when refreshing a ticket cache (such as
+inside a screensaver) is:
+
+```
+    pam_authenticate
+    pam_setcred(PAM_REINITIALIZE_CRED)
+    pam_acct_mgmt
+```
+
+(`PAM_REFRESH_CRED` may be used instead.)  Authentication proceeds as
+above.  At the `pam_setcred` stage, rather than creating a new ticket
+cache, the module instead finds the current ticket cache (from the
+`KRB5CCNAME` environment variable or the default ticket cache location
+from the Kerberos library) and then reinitializes it with the credentials
+from the temporary `pam_authenticate` ticket cache.  When refreshing a
+ticket cache, the application should not open a session.  Calling
+`pam_acct_mgmt` is optional; pam-krb5 doesn't do anything different when
+it's called in this case.
+
+If `pam_authenticate` apparently didn't succeed, or if an account was
+configured to be ignored via `ignore_root` or `minimum_uid`, `pam_setcred`
+(and therefore `pam_open_session`) and `pam_acct_mgmt` return
+`PAM_IGNORE`, which tells the PAM library to proceed as if that module
+wasn't listed in the PAM configuration at all.  `pam_authenticate`,
+however, returns failure in the ignored user case by default, since
+otherwise a configuration using `ignore_root` with pam-krb5 as the only
+PAM module would allow anyone to log in as root without a password.  There
+doesn't appear to be a case where returning `PAM_IGNORE` instead would
+improve the module's behavior, but if you know of a case, please let me
+know.
+
+By default, `pam_authenticate` intentionally does not follow the PAM
+standard for handling expired accounts and instead returns failure from
+`pam_authenticate` unless the Kerberos libraries are able to change the
+account password during authentication.  Too many applications either do
+not call `pam_acct_mgmt` or ignore its exit status.  The fully correct PAM
+behavior (returning success from `pam_authenticate` and
+`PAM_NEW_AUTHTOK_REQD` from `pam_acct_mgmt`) can be enabled with the
+`defer_pwchange` option.
+
+The `defer_pwchange` option is unfortunately somewhat tricky to implement.
+In this case, the calling sequence is:
+
+```
+    pam_authenticate
+    pam_acct_mgmt
+    pam_chauthtok
+    pam_setcred
+    pam_open_session
+```
+
+During the first `pam_authenticate`, we can't obtain credentials and
+therefore a ticket cache since the password is expired.  But
+`pam_authenticate` isn't called again after `pam_chauthtok`, so
+`pam_chauthtok` has to create a ticket cache.  We however don't want it to
+do this for the normal password change (`passwd`) case.
+
+What we do is set a flag in our PAM data structure saying that we're
+processing an expired password, and `pam_chauthtok`, if it sees that flag,
+redoes the authentication with password prompting disabled after it
+finishes changing the password.
+
+Unfortunately, when handling password changes this way, `pam_chauthtok`
+will always have to prompt the user for their current password again even
+though they just typed it.  This is because the saved authentication
+tokens are cleared after `pam_authenticate` returns, for security reasons.
+We could hack around this by saving the password in our PAM data
+structure, but this would let the application gain access to it (exactly
+what the clearing is intended to prevent) and breaks a PAM library
+guarantee.  We could also work around this by having `pam_authenticate`
+get the `kadmin/changepw` authenticator in the expired password case and
+store it for `pam_chauthtok`, but it doesn't seem worth the hassle.
+
+## History and Acknowledgements
+
+Originally written by Frank Cusack <fcusack@fcusack.com>, with the
+following acknowledgement:
+
+> Thanks to Naomaru Itoi <itoi@eecs.umich.edu>, Curtis King
+> <curtis.king@cul.ca>, and Derrick Brashear <shadow@dementia.org>, all of
+> whom have written and made available Kerberos 4/5 modules.  Although no
+> code in this module is directly from these author's modules, (except the
+> get_user_info() routine in support.c; derived from whichever of these
+> authors originally wrote the first module the other 2 copied from), it
+> was extremely helpful to look over their code which aided in my design.
+
+The module was then patched for the FreeBSD ports collection with
+additional modifications by unknown maintainers and then was modified by
+Joel Kociolek <joko@logidee.com> to be usable with Debian GNU/Linux.
+
+It was packaged by Sam Hartman as the Kerberos v5 PAM module for Debian
+and improved and modified by him and later by Russ Allbery to fix bugs and
+add additional features.  It was then adopted by Andres Salomon, who added
+support for refreshing credentials.
+
+The current distribution is maintained by Russ Allbery, who also added
+support for reading configuration from `krb5.conf`, added many features
+for compatibility with the Sourceforge module, commented and standardized
+the formatting of the code, and overhauled the documentation.
+
+Thanks to Douglas E. Engert for the initial implementation of PKINIT
+support.  I have since modified and reworked it extensively, so any bugs
+or compilation problems are my fault.
+
+Thanks to Markus Moeller for lots of debugging and multiple patches and
+suggestions for improved portability.
+
+Thanks to Booker Bense for the implementation of the `alt_auth_map`
+option.
+
+Thanks to Sam Hartman for the FAST support implementation.
+
+## Support
+
+The [pam-krb5 web page](https://www.eyrie.org/~eagle/software/pam-krb5/)
+will always have the current version of this package, the current
+documentation, and pointers to any additional resources.
+
+For bug tracking, use the [issue tracker on
+GitHub](https://github.com/rra/pam-krb5/issues).  However, please be aware
+that I tend to be extremely busy and work projects often take priority.
+I'll save your report and get to it as soon as I can, but it may take me a
+couple of months.
+
+## Source Repository
+
+pam-krb5 is maintained using Git.  You can access the current source on
+[GitHub](https://github.com/rra/pam-krb5) or by cloning the repository at:
+
+https://git.eyrie.org/git/kerberos/pam-krb5.git
+
+or [view the repository on the
+web](https://git.eyrie.org/?p=kerberos/pam-krb5.git).
+
+The eyrie.org repository is the canonical one, maintained by the author,
+but using GitHub is probably more convenient for most purposes.  Pull
+requests are gratefully reviewed and normally accepted.
+
+## License
+
+The pam-krb5 package as a whole is covered by the following copyright
+statement and license:
+
+> Copyright 2005-2010, 2014-2015, 2017, 2020-2021
+>     Russ Allbery <eagle@eyrie.org>
+>
+> Copyright 2009-2011
+>     The Board of Trustees of the Leland Stanford Junior University
+>
+> Copyright 2005
+>     Andres Salomon <dilinger@debian.org>
+>
+> Copyright 1999-2000
+>     Frank Cusack <fcusack@fcusack.com>
+>
+> Redistribution and use in source and binary forms, with or without
+> modification, are permitted provided that the following conditions are
+> met:
+>
+> 1. Redistributions of source code must retain the above copyright
+>    notice, and the entire permission notice in its entirety, including
+>    the disclaimer of warranties.
+>
+> 2. Redistributions in binary form must reproduce the above copyright
+>    notice, this list of conditions and the following disclaimer in the
+>    documentation and/or other materials provided with the distribution.
+>
+> 3. The name of the author may not be used to endorse or promote products
+>    derived from this software without specific prior written permission.
+>
+> ALTERNATIVELY, this product may be distributed under the terms of the GNU
+> General Public License, in which case the provisions of the GPL are
+> required INSTEAD OF the above restrictions.  (This clause is necessary due
+> to a potential bad interaction between the GPL and the restrictions
+> contained in a BSD-style copyright.)
+>
+> THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+> INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+> AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
+> THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+> EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+> PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+> PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+> LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+> NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+> SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Some files in this distribution are individually released under different
+licenses, all of which are compatible with the above general package
+license but which may require preservation of additional notices.  All
+required notices, and detailed information about the licensing of each
+file, are recorded in the LICENSE file.
+
+Files covered by a license with an assigned SPDX License Identifier
+include SPDX-License-Identifier tags to enable automated processing of
+license information.  See https://spdx.org/licenses/ for more information.
+
+For any copyright range specified by files in this package as YYYY-ZZZZ,
+the range specifies every single year in that closed interval.
diff --git a/TODO b/TODO
new file mode 100644
index 000000000000..876c5196a1bf
--- /dev/null
+++ b/TODO
@@ -0,0 +1,101 @@
+                           pam-krb5 To-Do List
+
+PAM API:
+
+ * Support PAM_CHANGE_EXPIRED_AUTHTOK properly in pam_chauthtok.  This
+   will require prompting for the current password (if it's not already
+   available in the PAM data) and trying a regular authentication first to
+   see if the account is expired.
+
+ * Tighter verification that all of our flags are valid might be a good
+   idea.
+
+ * For informational messages followed by a prompt, find a way to combine
+   these into one PAM conversation call for better GUI presentation
+   behavior.
+
+Functionality:
+
+ * Change the authentication flow so that both Heimdal and MIT use the
+   same logic for attempting PKINIT first and then falling back to
+   password.  This will fix failure to store passwords in the PAM data
+   with try_pkinit and MIT Kerberos on password fallback and will allow
+   implementation of use_pkinit for MIT.  Based on discussion with MIT
+   Kerberos upstream, the best approach is probably to configure a custom
+   prompter that refuses to reply to any prompt.
+
+ * Add a daemon that can be used to verify TGTs that can be used when
+   pam-krb5 is run as a non-root user and hence doesn't have access to the
+   system keytab.  Jeff Hutzelman has a daemon and protocol for doing this
+   developed for a different PAM authentication module, and it would be
+   good to stay consistent with that protocol if possible.  (Debian
+   Bug#399001)
+
+ * The alt_auth_map parsing to find realms doesn't take into account
+   escaped @-signs and doesn't do proper principal parsing.
+
+ * Fix password expiration handling for the search_k5login and
+   alt_auth_map cases.  Right now, we may return expired password errors
+   that would trigger password expiration handling, which probably isn't
+   correct.
+
+ * Support authentication from a keytab.
+
+ * Support disabling of user canonicalization so that the PAM user is
+   retained even if the module did an aname to lname mapping.
+
+ * Use set_out_ccache to write the resulting ticket cache, if it is
+   available.  This ensures the correct flags are set in the ticket cache.
+   This poses some challenges due to the two-step ticket cache mechanism
+   currently used.  Perhaps there's a cache copying API?
+
+ * Use krb5_chpw_message to parse password change messages from Active
+   Directory.
+
+ * Consider exposing the Kerberos principal in the password prompt for a
+   password change.  (Debian Bug#667928)
+
+Code Cleanup:
+
+ * The PKINIT code for Heimdal involves too many #ifdefs right now for my
+   taste.  Find a way to restructure it to only wrap the main PKINIT
+   function for Heimdal.
+
+ * The current handling of error return codes is a mess.  We need to find
+   a way to return a rich set of error codes from the underlying functions
+   and then map error codes appropriately in the interface functions.
+   Helpful for this would be improved documentation of what error codes
+   are permitted and where.
+
+ * Tracking when to free the Kerberos context and other things stored in
+   the PAM context is currently too complicated.  It should be possible to
+   simplify it with a reference counting scheme.
+
+Documentation:
+
+ * Document PKINIT configuration with MIT in krb5.conf.  It looks like the
+   library supports configuration in [realms] with similar names to the
+   PAM module configuration.
+
+Portability:
+
+ * If pam_modutil_getpwnam is not available but getpwnam_r is, roll our
+   own using getpwnam_r.
+
+Logging:
+
+ * Log the information that the Kerberos library asks us to display, or at
+   least the info and error messages.
+
+ * Log unknown PAM flags on module entry.  Currently, only the symbolic
+   flags we know about will be logged.
+
+Test suite:
+
+ * Ensure that the test suite covers all possible PAM options.
+
+ * Figure out why the pin-mit script for module/pkinit prompts twice and
+   check if it's a bug in the module.
+
+ * Find a way of testing the PKINIT identity selection for MIT Kerberos
+   with use_pkinit enabled.
diff --git a/bootstrap b/bootstrap
new file mode 100755
index 000000000000..948aa1b9f02e
--- /dev/null
+++ b/bootstrap
@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# Run this shell script to bootstrap as necessary after a fresh checkout.
+
+set -e
+
+autoreconf -i --force
+rm -rf autom4te.cache
+
+# Generate manual pages.
+version=`grep '^pam-krb5' NEWS | head -1 | cut -d' ' -f2`
+pod2man --release="$version" --center=pam-krb5 -s 5 docs/pam_krb5.pod \
+    >docs/pam_krb5.5
diff --git a/ci/README.md b/ci/README.md
new file mode 100644
index 000000000000..fedd0d57fd08
--- /dev/null
+++ b/ci/README.md
@@ -0,0 +1,13 @@
+# Continuous Integration
+
+The files in this directory are used for continuous integration testing.
+`ci/install` installs the prerequisite packages (run as root on a Debian
+derivative), and `ci/test` runs the tests.
+
+Most tests will be skipped without a Kerberos configuration.  The scripts
+`ci/kdc-setup-heimdal` and `ci/kdc-setup-mit` will (when run as root on a
+Debian derivative) set up a Heimdal or MIT Kerberos KDC, respectively, and
+generate the files required to run the complete test suite.
+
+Tests are run automatically via GitHub Actions workflows using these
+scripts and the configuration in the `.github/workflows` directory.
diff --git a/ci/files/heimdal/heimdal-kdc b/ci/files/heimdal/heimdal-kdc
new file mode 100644
index 000000000000..d7814631746d
--- /dev/null
+++ b/ci/files/heimdal/heimdal-kdc
@@ -0,0 +1,9 @@
+# Heimdal KDC init script setup.  -*- sh -*-
+
+# KDC configuration.
+KDC_ENABLED=yes
+KDC_PARAMS='--config-file=/etc/heimdal-kdc/kdc.conf'
+
+# kpasswdd configuration.
+KPASSWDD_ENABLED=yes
+KPASSWDD_PARAMS='-r HEIMDAL.TEST'
diff --git a/ci/files/heimdal/kadmind.acl b/ci/files/heimdal/kadmind.acl
new file mode 100644
index 000000000000..ae74ad5598ad
--- /dev/null
+++ b/ci/files/heimdal/kadmind.acl
@@ -0,0 +1 @@
+test/admin@HEIMDAL.TEST  all  testuser@HEIMDAL.TEST
diff --git a/ci/files/heimdal/kdc.conf b/ci/files/heimdal/kdc.conf
new file mode 100644
index 000000000000..29ac52ebb947
--- /dev/null
+++ b/ci/files/heimdal/kdc.conf
@@ -0,0 +1,30 @@
+# Heimdal KDC configuration.  -*- conf -*-
+
+[kadmin]
+    default_keys           = aes256-cts-hmac-sha1-96:pw-salt
+
+[kdc]
+    acl_file               = /etc/heimdal-kdc/kadmind.acl
+    check-ticket-addresses = false
+    logging                = SYSLOG:NOTICE
+    ports                  = 88
+
+    # PKINIT configuration.
+    enable-pkinit          = yes
+    pkinit_identity        = FILE:/etc/heimdal-kdc/kdc.pem
+    pkinit_anchors         = FILE:/etc/heimdal-kdc/ca/ca.pem
+    pkinit_mappings_file   = /etc/heimdal-kdc/pki-mapping
+    pkinit_allow_proxy_certificate  = no
+    pkinit_principal_in_certificate = no
+
+[libdefaults]
+    default_realm          = HEIMDAL.TEST
+    dns_lookup_kdc         = false
+    dns_lookup_realm       = false
+
+[realms]
+    HEIMDAL.TEST.EYRIE.ORG = {
+        kdc            = 127.0.0.1
+        master_kdc     = 127.0.0.1
+        admin_server   = 127.0.0.1
+    }
diff --git a/ci/files/heimdal/krb5.conf b/ci/files/heimdal/krb5.conf
new file mode 100644
index 000000000000..a2b22c2d54cd
--- /dev/null
+++ b/ci/files/heimdal/krb5.conf
@@ -0,0 +1,19 @@
+[libdefaults]
+    default_realm         = HEIMDAL.TEST
+    dns_lookup_kdc        = false
+    dns_lookup_realm      = false
+    rdns                  = false
+    renew_lifetime        = 7d
+    ticket_lifetime       = 25h
+
+[realms]
+    HEIMDAL.TEST = {
+        kdc               = 127.0.0.1
+        master_kdc        = 127.0.0.1
+        admin_server      = 127.0.0.1
+        pkinit_anchors    = FILE:/etc/heimdal-kdc/ca/ca.pem
+    }
+
+[logging]
+    kdc                   = SYSLOG:NOTICE
+    default               = SYSLOG:NOTICE
diff --git a/ci/files/heimdal/pki-mapping b/ci/files/heimdal/pki-mapping
new file mode 100644
index 000000000000..76dd6b87edb6
--- /dev/null
+++ b/ci/files/heimdal/pki-mapping
@@ -0,0 +1 @@
+testuser@HEIMDAL.TEST:UID=testuser,DC=HEIMDAL,DC=TEST
diff --git a/ci/files/mit/extensions.client b/ci/files/mit/extensions.client
new file mode 100644
index 000000000000..5a1bbc29bdec
--- /dev/null
+++ b/ci/files/mit/extensions.client
@@ -0,0 +1,19 @@
+[client_cert]
+basicConstraints=CA:FALSE
+keyUsage=digitalSignature,keyEncipherment,keyAgreement
+extendedKeyUsage=1.3.6.1.5.2.3.4
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+issuerAltName=issuer:copy
+subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ_name
+
+[princ_name]
+realm=EXP:0,GeneralString:${ENV::REALM}
+principal_name=EXP:1,SEQUENCE:principal_seq
+
+[principal_seq]
+name_type=EXP:0,INTEGER:1
+name_string=EXP:1,SEQUENCE:principals
+
+[principals]
+princ1=GeneralString:${ENV::CLIENT}
diff --git a/ci/files/mit/extensions.kdc b/ci/files/mit/extensions.kdc
new file mode 100644
index 000000000000..cbff73bef1ed
--- /dev/null
+++ b/ci/files/mit/extensions.kdc
@@ -0,0 +1,20 @@
+[kdc_cert]
+basicConstraints=CA:FALSE
+keyUsage=nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+extendedKeyUsage=1.3.6.1.5.2.3.5
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+issuerAltName=issuer:copy
+subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
+
+[kdc_princ_name]
+realm=EXP:0,GeneralString:${ENV::REALM}
+principal_name=EXP:1,SEQUENCE:kdc_principal_seq
+
+[kdc_principal_seq]
+name_type=EXP:0,INTEGER:1
+name_string=EXP:1,SEQUENCE:kdc_principals
+
+[kdc_principals]
+princ1=GeneralString:krbtgt
+princ2=GeneralString:${ENV::REALM}
diff --git a/ci/files/mit/kadm5.acl b/ci/files/mit/kadm5.acl
new file mode 100644
index 000000000000..652bbecb84b2
--- /dev/null
+++ b/ci/files/mit/kadm5.acl
@@ -0,0 +1 @@
+test/admin@MIT.TEST  mci  testuser@MIT.TEST
diff --git a/ci/files/mit/kdc.conf b/ci/files/mit/kdc.conf
new file mode 100644
index 000000000000..7bf4e6a06e95
--- /dev/null
+++ b/ci/files/mit/kdc.conf
@@ -0,0 +1,19 @@
+[kdcdefaults]
+    kdc_ports                   = 88
+    kdc_tcp_ports               = 88
+    restrict_anonymous_to_tgt   = true
+
+[realms]
+    MIT.TEST = {
+        database_name           = /var/lib/krb5kdc/principal
+        admin_keytab            = /var/lib/krb5kdc/kadm5.keytab
+        acl_file                = /etc/krb5kdc/kadm5.acl
+        key_stash_file          = /var/lib/krb5kdc/stash
+        max_life                = 1d 1h 0m 0s
+        max_renewable_life      = 7d 0h 0m 0s
+        master_key_type         = aes256-cts
+        supported_enctypes      = aes256-cts:normal
+        default_principal_flags = +preauth
+        pkinit_identity         = FILE:/var/lib/krb5kdc/kdc.pem,/var/lib/krb5kdc/kdckey.pem
+        pkinit_anchors          = FILE:/etc/krb5kdc/cacert.pem
+    }
diff --git a/ci/files/mit/krb5.conf b/ci/files/mit/krb5.conf
new file mode 100644
index 000000000000..9b0d5ab9dbdf
--- /dev/null
+++ b/ci/files/mit/krb5.conf
@@ -0,0 +1,19 @@
+[libdefaults]
+    default_realm         = MIT.TEST
+    dns_lookup_kdc        = false
+    dns_lookup_realm      = false
+    rdns                  = false
+    renew_lifetime        = 7d
+    ticket_lifetime       = 25h
+
+[realms]
+    MIT.TEST = {
+        kdc               = 127.0.0.1
+        master_kdc        = 127.0.0.1
+        admin_server      = 127.0.0.1
+        pkinit_anchors    = FILE:/etc/krb5kdc/cacert.pem
+    }
+
+[logging]
+    kdc                   = SYSLOG:NOTICE
+    default               = SYSLOG:NOTICE
diff --git a/ci/install b/ci/install
new file mode 100755
index 000000000000..b53ac2957546
--- /dev/null
+++ b/ci/install
@@ -0,0 +1,18 @@
+#!/bin/sh
+#
+# Install packages for integration tests.
+#
+# This script is normally run via sudo in a test container or VM, such as via
+# GitHub Actions.
+#
+# Copyright 2015-2021 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: MIT
+
+set -eux
+
+# Install distribution packages.
+apt-get update -qq
+apt-get install aspell autoconf automake cppcheck heimdal-multidev      \
+        krb5-config libkrb5-dev libpam0g-dev libtest-pod-perl           \
+        libtest-spelling-perl libtool perl valgrind
diff --git a/ci/kdc-setup-heimdal b/ci/kdc-setup-heimdal
new file mode 100755
index 000000000000..9d15b1a4a6de
--- /dev/null
+++ b/ci/kdc-setup-heimdal
@@ -0,0 +1,105 @@
+#!/bin/sh
+#
+# Build a Kerberos test realm for Heimdal.
+#
+# This script automates the process of setting up a Kerberos test realm from
+# scratch suitable for testing pam-krb5.  It is primarily intended to be run
+# from inside CI in a VM or container from the top of the pam-krb5 source
+# tree, and must be run as root.  It expects to be operating on the Debian
+# Heimdal package.
+#
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: MIT
+
+set -eux
+
+# Install the KDC.
+apt-get install heimdal-kdc
+
+# Install its configuration files.
+cp ci/files/heimdal/heimdal-kdc /etc/default/heimdal-kdc
+cp ci/files/heimdal/kadmind.acl /etc/heimdal-kdc/kadmind.acl
+cp ci/files/heimdal/kdc.conf /etc/heimdal-kdc/kdc.conf
+cp ci/files/heimdal/krb5.conf /etc/krb5.conf
+cp ci/files/heimdal/pki-mapping /etc/heimdal-kdc/pki-mapping
+
+# Some versions of heimdal-kdc require this.
+ln -s /etc/heimdal-kdc/kadmind.acl /var/lib/heimdal-kdc/kadmind.acl
+
+# Add domain-realm mappings for the local host, since otherwise Heimdal and
+# MIT Kerberos may attempt to discover the realm of the local domain, and the
+# DNS server for GitHub Actions has a habit of just not responding and causing
+# the test to hang.
+cat <<EOF >>/etc/krb5.conf
+[domain_realm]
+    $(hostname -f) = HEIMDAL.TEST
+EOF
+cat <<EOF >>/etc/heimdal-kdc/kdc.conf
+[domain_realm]
+    $(hostname -f) = HEIMDAL.TEST
+EOF
+
+# Create the basic KDC.
+kstash --random-key
+kadmin -l init --realm-max-ticket-life='1 day 1 hour' \
+    --realm-max-renewable-life='1 week' HEIMDAL.TEST
+
+# Set default principal policies.
+kadmin -l modify --attributes=requires-pre-auth,disallow-svr \
+    default@HEIMDAL.TEST
+
+# Create and store the keytabs.
+kadmin -l add -r --use-defaults --attributes=requires-pre-auth \
+    test/admin@HEIMDAL.TEST
+kadmin -l ext_keytab -k tests/config/admin-keytab test/admin@HEIMDAL.TEST
+kadmin -l add -r --use-defaults --attributes=requires-pre-auth \
+    test/keytab@HEIMDAL.TEST
+kadmin -l ext_keytab -k tests/config/keytab test/keytab@HEIMDAL.TEST
+
+# Create a user principal with a known password.
+password="iceedKaicVevjunwiwyd"
+kadmin -l add --use-defaults --password="$password" testuser@HEIMDAL.TEST
+echo 'testuser@HEIMDAL.TEST' >tests/config/password
+echo "$password" >>tests/config/password
+
+# Create the root CA for PKINIT.
+mkdir -p /etc/heimdal-kdc/ca
+hxtool issue-certificate --self-signed --issue-ca --generate-key=rsa    \
+    --subject=CN=CA,DC=HEIMDAL,DC=TEST --lifetime=10years               \
+    --certificate=FILE:/etc/heimdal-kdc/ca/ca.pem
+chmod 644 /etc/heimdal-kdc/ca/ca.pem
+
+# Create the certificate for the Heimdal Kerberos KDC.
+hxtool issue-certificate --ca-certificate=FILE:/etc/heimdal-kdc/ca/ca.pem \
+    --generate-key=rsa --type=pkinit-kdc                                  \
+    --pk-init-principal=krbtgt/HEIMDAL.TEST@HEIMDAL.TEST                  \
+    --subject=uid=kdc,DC=HEIMDAL,DC=TEST                                  \
+    --certificate=FILE:/etc/heimdal-kdc/kdc.pem
+chmod 644 /etc/heimdal-kdc/kdc.pem
+
+# Create the certificate for the Heimdal client.
+hxtool issue-certificate --ca-certificate=FILE:/etc/heimdal-kdc/ca/ca.pem \
+    --generate-key=rsa --type=pkinit-client                               \
+    --pk-init-principal=testuser@HEIMDAL.TEST                             \
+    --subject=UID=testuser,DC=HEIMDAL,DC=TEST                             \
+    --certificate=FILE:tests/config/pkinit-cert
+echo 'testuser@HEIMDAL.TEST' >tests/config/pkinit-principal
+
+# Fix permissions on all the newly-created files.
+chmod 644 tests/config/*
+
+# Restart the Heimdal KDC and services.
+systemctl stop heimdal-kdc
+systemctl start heimdal-kdc
+
+# Ensure that the KDC is running.
+for n in $(seq 1 5); do
+    if echo "$password" \
+            | kinit --password-file=STDIN testuser@HEIMDAL.TEST; then
+        break
+    fi
+    sleep 1
+done
+klist
+kdestroy
diff --git a/ci/kdc-setup-mit b/ci/kdc-setup-mit
new file mode 100755
index 000000000000..0b3dfb60b64b
--- /dev/null
+++ b/ci/kdc-setup-mit
@@ -0,0 +1,102 @@
+#!/bin/sh
+#
+# Build a Kerberos test realm for MIT Kerberos
+#
+# This script automates the process of setting up a Kerberos test realm from
+# scratch suitable for testing pam-krb5.  It is primarily intended to be run
+# from inside CI in a VM or container from the top of the pam-krb5 source
+# tree, and must be run as root.  It expects to be operating on the Debian
+# MIT Kerberos package.
+#
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: MIT
+
+set -eux
+
+# Install the KDC and the OpenSSL command line tool.
+apt-get install krb5-admin-server krb5-kdc krb5-pkinit openssl
+
+# Install its configuration files.
+cp ci/files/mit/extensions.client /etc/krb5kdc/extensions.client
+cp ci/files/mit/extensions.kdc /etc/krb5kdc/extensions.kdc
+cp ci/files/mit/kadm5.acl /etc/krb5kdc/kadm5.acl
+cp ci/files/mit/kdc.conf /etc/krb5kdc/kdc.conf
+cp ci/files/mit/krb5.conf /etc/krb5.conf
+
+# Add domain-realm mappings for the local host, since otherwise Heimdal and
+# MIT Kerberos may attempt to discover the realm of the local domain, and the
+# DNS server for GitHub Actions has a habit of just not responding and causing
+# the test to hang.
+cat <<EOF >>/etc/krb5.conf
+[domain_realm]
+    $(hostname -f) = MIT.TEST
+EOF
+
+# Create the basic KDC.
+kdb5_util create -s -P 'this is a test master database password'
+
+# Create and store the keytabs.
+kadmin.local -q 'add_principal +requires_preauth -randkey test/admin@MIT.TEST'
+kadmin.local -q 'ktadd -k tests/config/admin-keytab test/admin@MIT.TEST'
+kadmin.local -q 'add_principal +requires_preauth -randkey test/keytab@MIT.TEST'
+kadmin.local -q 'ktadd -k tests/config/keytab test/keytab@MIT.TEST'
+
+# Enable anonymous PKINIT.
+kadmin.local -q 'addprinc -randkey WELLKNOWN/ANONYMOUS'
+
+# Create a user principal with a known password.
+password="iceedKaicVevjunwiwyd"
+kadmin.local -q \
+    "add_principal +requires_preauth -pw $password testuser@MIT.TEST"
+echo 'testuser@MIT.TEST' >tests/config/password
+echo "$password" >>tests/config/password
+
+# Create the root CA for PKINIT.
+openssl genrsa -out /etc/krb5kdc/cakey.pem 2048
+openssl req -key /etc/krb5kdc/cakey.pem -new -x509 \
+    -out /etc/krb5kdc/cacert.pem -subj "/CN=MIT.TEST CA" -days 3650
+chmod 755 /etc/krb5kdc
+chmod 644 /etc/krb5kdc/cacert.pem
+
+# Create the certificate for the MIT Kerberos KDC.
+openssl genrsa -out /var/lib/krb5kdc/kdckey.pem 2048
+openssl req -new -out /var/lib/krb5kdc/kdc.req \
+    -key /var/lib/krb5kdc/kdckey.pem -subj "/CN=MIT.TEST"
+REALM=MIT.TEST openssl x509 -req -in /var/lib/krb5kdc/kdc.req   \
+    -CAkey /etc/krb5kdc/cakey.pem -CA /etc/krb5kdc/cacert.pem   \
+    -out /var/lib/krb5kdc/kdc.pem -days 365                     \
+    -extfile /etc/krb5kdc/extensions.kdc -extensions kdc_cert   \
+    -CAcreateserial
+rm /var/lib/krb5kdc/kdc.req
+
+# Create the certificate for the MIT Kerberos client.
+openssl genrsa -out clientkey.pem 2048
+openssl req -new -key clientkey.pem -out client.req \
+        -subj "/CN=testuser@MIT.TEST"
+REALM="MIT.TEST" CLIENT="testuser" openssl x509                         \
+    -CAkey /etc/krb5kdc/cakey.pem -CA /etc/krb5kdc/cacert.pem -req      \
+    -in client.req -extensions client_cert                              \
+    -extfile /etc/krb5kdc/extensions.client -days 365 -out client.pem
+cat client.pem clientkey.pem >tests/config/pkinit-cert
+rm clientkey.pem client.pem client.req
+echo 'testuser@MIT.TEST' >tests/config/pkinit-principal
+
+# Fix permissions on all the newly-created files.
+chmod 644 tests/config/*
+
+# Restart the MIT Kerberos KDC and services.
+systemctl stop krb5-kdc krb5-admin-server
+systemctl start krb5-kdc krb5-admin-server
+
+# Ensure that the KDC is running.
+for n in $(seq 1 5); do
+    if echo "$password" | kinit testuser@MIT.TEST; then
+        break
+    fi
+    sleep 1
+done
+klist
+kdestroy
+kinit -n @MIT.TEST
+kinit -X X509_user_identity=FILE:tests/config/pkinit-cert testuser@MIT.TEST
diff --git a/ci/test b/ci/test
new file mode 100755
index 000000000000..b7844bdd75fe
--- /dev/null
+++ b/ci/test
@@ -0,0 +1,44 @@
+#!/bin/sh
+#
+# Run tests for continuous integration.
+#
+# This script is normally run in a test container or VM, such as via GitHub
+# Actions.
+#
+# Copyright 2015-2021 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: MIT
+
+set -eux
+
+# Normally, KERBEROS is set based on the CI matrix, but provide a default in
+# case someone runs this test by hand.
+KERBEROS="${KERBEROS:-mit}"
+
+# Generate Autotools files.
+./bootstrap
+
+# Build everything with Clang first, with warnings enabled.
+if [ "$KERBEROS" = 'heimdal' ]; then
+    ./configure CC=clang PATH_KRB5_CONFIG=/usr/bin/krb5-config.heimdal
+else
+    ./configure CC=clang
+fi
+make warnings
+
+# Then rebuild everything with GCC with warnings enabled.
+make distclean
+if [ "$KERBEROS" = 'heimdal' ]; then
+    ./configure CC=gcc PATH_KRB5_CONFIG=/usr/bin/krb5-config.heimdal
+else
+    ./configure CC=gcc
+fi
+make warnings
+
+# Run the tests with valgrind.
+make check-valgrind
+
+# Run additional style tests, but only in the MIT build.
+if [ "$KERBEROS" = "mit" ]; then
+    make check-cppcheck
+fi
diff --git a/configure.ac b/configure.ac
new file mode 100644
index 000000000000..eddc6fd46559
--- /dev/null
+++ b/configure.ac
@@ -0,0 +1,145 @@
+dnl Autoconf configuration for pam-krb5.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2005-2009, 2014, 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2009-2013
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl Copyright 2005 Andres Salomon <dilinger@debian.org>
+dnl Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+dnl
+dnl SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+AC_PREREQ([2.64])
+AC_INIT([pam-krb5], [4.11], [eagle@eyrie.org])
+AC_CONFIG_AUX_DIR([build-aux])
+AC_CONFIG_LIBOBJ_DIR([portable])
+AC_CONFIG_MACRO_DIR([m4])
+AM_INIT_AUTOMAKE([1.11 check-news dist-xz foreign silent-rules subdir-objects
+    -Wall -Werror])
+AM_MAINTAINER_MODE
+
+dnl Detect unexpanded macros.
+m4_pattern_forbid([^PKG_])
+m4_pattern_forbid([^_?RRA_])
+
+AC_PROG_CC
+AC_USE_SYSTEM_EXTENSIONS
+RRA_PROG_CC_WARNINGS_FLAGS
+AC_SYS_LARGEFILE
+AM_PROG_CC_C_O
+m4_ifdef([AM_PROG_AR], [AM_PROG_AR])
+AC_PROG_INSTALL
+LT_INIT([disable-static])
+AC_CANONICAL_HOST
+RRA_LD_VERSION_SCRIPT
+
+dnl Only used for the test suite.
+AC_ARG_VAR([PATH_OPENSSL], [Path to openssl for the test suite])
+AC_PATH_PROG([PATH_OPENSSL], [openssl])
+AS_IF([test x"$PATH_OPENSSL" != x],
+    [AC_DEFINE_UNQUOTED([PATH_OPENSSL], ["$PATH_OPENSSL"],
+        [Define to the full path to openssl for some tests.])])
+AC_ARG_VAR([PATH_VALGRIND], [Path to valgrind for the test suite])
+AC_PATH_PROG([PATH_VALGRIND], [valgrind])
+
+dnl Probe for the functionality of the PAM libraries and their include file
+dnl naming.  Mac OS X puts them in pam/* instead of security/*.
+AC_SEARCH_LIBS([pam_set_data], [pam])
+AC_CHECK_FUNCS([pam_getenv pam_getenvlist pam_modutil_getpwnam])
+AC_REPLACE_FUNCS([pam_syslog pam_vsyslog])
+AC_CHECK_HEADERS([security/pam_modutil.h], [],
+    [AC_CHECK_HEADERS([pam/pam_modutil.h])])
+AC_CHECK_HEADERS([security/pam_appl.h], [],
+    [AC_CHECK_HEADERS([pam/pam_appl.h], [],
+        [AC_MSG_ERROR([No PAM header files found])])])
+AC_CHECK_HEADERS([security/pam_ext.h], [],
+    [AC_CHECK_HEADERS([pam/pam_ext.h])])
+RRA_HEADER_PAM_CONST
+RRA_HEADER_PAM_STRERROR_CONST
+AC_DEFINE([MODULE_NAME], ["pam_krb5"],
+    [The name of the PAM module, used by the pam_vsyslog replacement.])
+
+dnl Probe for the location and functionality of the Kerberos libraries.
+RRA_LIB_KRB5
+RRA_LIB_KRB5_SWITCH
+AC_CHECK_HEADERS([hx509_err.h])
+AC_CHECK_MEMBER([krb5_creds.session],
+    [AC_DEFINE([HAVE_KRB5_HEIMDAL], [1],
+        [Define if your Kerberos implementation is Heimdal.])],
+    [AC_DEFINE([HAVE_KRB5_MIT], [1],
+        [Define if your Kerberos implementation is MIT.])],
+    [RRA_INCLUDES_KRB5])
+AC_CHECK_TYPES([krb5_realm], [], [], [RRA_INCLUDES_KRB5])
+AC_CHECK_FUNCS([krb5_cc_get_full_name \
+    krb5_data_free \
+    krb5_free_default_realm \
+    krb5_free_string \
+    krb5_get_init_creds_opt_alloc \
+    krb5_get_init_creds_opt_set_anonymous \
+    krb5_get_init_creds_opt_set_change_password_prompt \
+    krb5_get_init_creds_opt_set_default_flags \
+    krb5_get_init_creds_opt_set_fast_ccache_name \
+    krb5_get_init_creds_opt_set_out_ccache \
+    krb5_get_init_creds_opt_set_pa \
+    krb5_get_prompt_types \
+    krb5_init_secure_context \
+    krb5_principal_get_realm \
+    krb5_principal_set_comp_string \
+    krb5_set_password \
+    krb5_set_trace_filename \
+    krb5_verify_init_creds_opt_init \
+    krb5_xfree])
+AC_CHECK_FUNCS([krb5_get_init_creds_opt_set_pkinit],
+    [RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_ARGS])
+AC_CHECK_FUNCS([krb5_get_init_creds_opt_free],
+    [RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS])
+AC_CHECK_DECLS([krb5_kt_free_entry], [], [], [RRA_INCLUDES_KRB5])
+AC_CHECK_FUNCS([krb5_appdefault_string], [],
+    [AC_CHECK_FUNCS([krb5_get_profile])
+     AC_CHECK_HEADERS([k5profile.h profile.h])
+     AC_LIBOBJ([krb5-profile])])
+AC_LIBOBJ([krb5-extra])
+RRA_LIB_KRB5_RESTORE
+
+dnl The kadmin client libraries are only used for the test suite.
+RRA_LIB_KADM5CLNT_OPTIONAL
+RRA_LIB_KADM5CLNT_SWITCH
+AC_CHECK_HEADERS([kadm5/kadm5_err.h])
+AC_CHECK_FUNCS([kadm5_init_krb5_context kadm5_init_with_skey_ctx])
+RRA_LIB_KADM5CLNT_RESTORE
+
+dnl Regex support is only used for the test suite.
+AC_CHECK_HEADER([regex.h], [AC_CHECK_FUNCS([regcomp])])
+
+dnl Other probes of the system libraries.
+AC_HEADER_STDBOOL
+AC_CHECK_HEADERS([strings.h sys/bittypes.h sys/select.h sys/time.h])
+AC_CHECK_DECLS([reallocarray])
+AC_TYPE_LONG_LONG_INT
+AC_CHECK_TYPES([ssize_t], [], [],
+    [#include <sys/types.h>])
+AC_CHECK_FUNCS([explicit_bzero])
+AC_REPLACE_FUNCS([asprintf issetugid mkstemp reallocarray strndup])
+
+dnl Try to specify the binding so that any references within the PAM module
+dnl are resolved to the functions in that module in preference to any external
+dnl function.
+dnl
+dnl More platforms could be handled here.  Contributions welcome.
+AS_CASE([$host],
+    [*-hpux*],
+    [AS_IF([test x"$GCC" = x"yes"],
+        [AM_LDFLAGS="-Wl,-Bsymbolic $AM_LDFLAGS"],
+        [AM_LDFLAGS="-Wl,+vshlibunsats $AM_LDFLAGS"])],
+
+    [*-linux*],
+    [AM_LDFLAGS="-Wl,-z,defs -Wl,-Bsymbolic $AM_LDFLAGS"],
+
+    [*-solaris2*],
+    [AS_IF([test x"$GCC" = x"yes"],
+        [AM_LDFLAGS="-Wl,-Bsymbolic $AM_LDFLAGS"],
+        [AM_LDFLAGS="-Wl,-xldscope=symbolic $AM_LDFLAGS"])])
+
+AC_CONFIG_HEADERS([config.h])
+AC_CONFIG_FILES([Makefile])
+AC_OUTPUT
diff --git a/docs/docknot.yaml b/docs/docknot.yaml
new file mode 100644
index 000000000000..67e19f88d50a
--- /dev/null
+++ b/docs/docknot.yaml
@@ -0,0 +1,551 @@
+# Package metadata for pam-krb5.
+#
+# This file contains configuration for DocKnot used to generate
+# documentation files (like README.md) and web pages.  Other documentation
+# in this package is generated automatically from these files as part of
+# the release process.  For more information, see DocKnot's documentation.
+#
+# DocKnot is available from <https://www.eyrie.org/~eagle/software/docknot/>.
+#
+# Copyright 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+format: v1
+
+name: pam-krb5
+maintainer: Russ Allbery <eagle@eyrie.org>
+version: '4.11'
+synopsis: PAM module for Kerberos authentication
+
+license:
+  name: BSD-3-clause-or-GPL-1+
+copyrights:
+  - holder: Russ Allbery <eagle@eyrie.org>
+    years: 2005-2010, 2014-2015, 2017, 2020-2021
+  - holder: The Board of Trustees of the Leland Stanford Junior University
+    years: 2009-2011
+  - holder: Andres Salomon <dilinger@debian.org>
+    years: '2005'
+  - holder: Frank Cusack <fcusack@fcusack.com>
+    years: 1999-2000
+
+build:
+  autoconf: '2.64'
+  automake: '1.11'
+  autotools: true
+  kerberos: true
+  manpages: true
+  middle: |
+    The module will be installed in `/usr/local/lib/security` by default, but
+    expect to have to override this using `--libdir`.  The correct
+    installation path for PAM modules varies considerably between systems.
+    The module will always be installed in a subdirectory named `security`
+    under the specified value of `--libdir`.  On Red Hat Linux, for example,
+    `--libdir=/usr/lib64` is appropriate to install the module into the system
+    PAM directory.  On Debian's amd64 architecture,
+    `--libdir=/usr/lib/x86_64-linux-gnu` would be correct.
+  reduced_depends: true
+  type: Autoconf
+  valgrind: true
+distribution:
+  packaging:
+    debian:
+      package: libpam-krb5
+      summary: |
+        Debian packages are available from Debian in Debian 4.0 (etch) and
+        later releases as libpam-krb5 and libpam-heimdal.  The former packages
+        are built against the MIT Kerberos libraries and the latter against
+        the Heimdal libraries.
+  section: kerberos
+  tarname: pam-krb5
+  version: pam-krb5
+support:
+  email: eagle@eyrie.org
+  github: rra/pam-krb5
+  web: https://www.eyrie.org/~eagle/software/pam-krb5/
+vcs:
+  browse: https://git.eyrie.org/?p=kerberos/pam-krb5.git
+  github: rra/pam-krb5
+  openhub: https://www.openhub.net/p/pamkrb5
+  status:
+    workflow: build
+  type: Git
+  url: https://git.eyrie.org/git/kerberos/pam-krb5.git
+
+quote:
+  author: Joyce McGreevy
+  date: 2003-11-17
+  text: |
+    "You're always going to have some people who can't appreciate the thrill
+    of a tepid change for the somewhat better," explained one source.
+  title: '"Look, ma, no hands!"'
+  work: Salon
+advisories:
+  - date: 2020-03-30
+    threshold: '4.9'
+    versions: 4.8 and earlier
+  - date: 2009-02-11
+    threshold: '3.13'
+    versions: 3.12 and earlier
+docs:
+  user:
+    - name: pam-krb5
+      title: Manual page
+
+blurb: |
+  pam-krb5 is a Kerberos PAM module for either MIT Kerberos or Heimdal.  It
+  supports ticket refreshing by screen savers, configurable authorization
+  handling, authentication of non-local accounts for network services,
+  password changing, and password expiration, as well as all the standard
+  expected PAM features.  It works correctly with OpenSSH, even with
+  ChallengeResponseAuthentication and PrivilegeSeparation enabled, and
+  supports extensive configuration either by PAM options or in krb5.conf or
+  both.  PKINIT is supported with recent versions of both MIT Kerberos and
+  Heimdal and FAST is supported with recent MIT Kerberos.
+
+description: |
+  pam-krb5 provides a Kerberos PAM module that supports authentication, user
+  ticket cache handling, simple authorization (via .k5login or checking
+  Kerberos principals against local usernames), and password changing.  It can
+  be configured through either options in the PAM configuration itself or
+  through entries in the system krb5.conf file, and it tries to work around
+  PAM implementation flaws in commonly-used PAM-enabled applications such as
+  OpenSSH and xdm.  It supports both PKINIT and FAST to the extent that the
+  underlying Kerberos libraries support these features.
+
+  This is not the Kerberos PAM module maintained on Sourceforge and used on
+  Red Hat systems.  It is an independent implementation that, if it ever
+  shared any common code, diverged long ago.  It supports some features that
+  the Sourceforge module does not (particularly around authorization), and
+  does not support some options (particularly ones not directly related to
+  Kerberos) that it does.  This module will never support Kerberos v4 or AFS.
+  For an AFS session module that works with this module (or any other Kerberos
+  PAM module), see
+  [pam-afs-session](https://www.eyrie.org/~eagle/software/pam-afs-session/).
+
+  If there are other options besides AFS and Kerberos v4 support from the
+  Sourceforge PAM module that you're missing in this module, please let me
+  know.
+
+requirements: |
+  Either MIT Kerberos (or Kerberos implementations based on it) or Heimdal are
+  supported.  MIT Keberos 1.3 or later may be required; this module has not
+  been tested with earlier versions.
+
+  For PKINIT support, Heimdal 0.8rc1 or later or MIT Kerberos 1.6.3 or later
+  are required.  Earlier MIT Kerberos 1.6 releases have a bug in their
+  handling of PKINIT options.  MIT Kerberos 1.12 or later is required to use
+  the use_pkinit PAM option.
+
+  For FAST (Flexible Authentication Secure Tunneling) support, MIT Kerberos
+  1.7 or higher is required.  For anonymous FAST support, anonymous
+  authentication (generally anonymous PKINIT) support is required in both the
+  Kerberos libraries and in the local KDC.
+
+  This module should work on Linux and build with gcc or clang.  It may still
+  work on Solaris and build with the Sun C compiler, but I have only tested it
+  on Linux recently.  There is beta-quality support for the AIX NAS Kerberos
+  implementation that has not been tested in years.  Other PAM implementations
+  will probably require some porting, although untested build system support
+  is present for FreeBSD, Mac OS X, and HP-UX.  I personally can only test on
+  Linux and rely on others to report problems on other operating systems.
+
+  Old versions of OpenSSH are known to call `pam_authenticate` followed by
+  `pam_setcred(PAM_REINITIALIZE_CRED)` without first calling
+  `pam_open_session`, thereby requesting that an existing ticket cache be
+  renewed (similar to what a screensaver would want) rather than requesting a
+  new ticket cache be created.  Since this behavior is indistinguishable at
+  the PAM level from a screensaver, pam-krb5 when used with these old versions
+  of OpenSSH will refresh the ticket cache of the OpenSSH daemon rather than
+  setting up a new ticket cache for the user.  The resulting ticket cache will
+  have the correct permissions (this is not a security concern), but will not
+  be named correctly or referenced in the user's environment and will be
+  overwritten by the next user login.  The best solution to this problem is to
+  upgrade OpenSSH.  I'm not sure exactly when this problem was fixed, but at
+  the very least OpenSSH 4.3 and later do not exhibit it.
+
+test:
+  lancaster: true
+  prefix: |
+    pam-krb5 comes with a comprehensive test suite, but it requires some
+    configuration in order to test anything other than low-level utility
+    functions.  For the full test suite, you will need to have a running KDC
+    in which you can create two test accounts, one with admin access to the
+    other.  Using a test KDC environment, if you have one, is recommended.
+
+    Follow the instructions in `tests/config/README` to configure the test
+    suite.
+
+    Now, you can run the test suite with:
+  suffix: |
+    The default libkadm5clnt library on the system must match the
+    implementation of your KDC for the module/expired test to work, since the
+    two kadmin protocols are not compatible.  If you use the MIT library
+    against a Heimdal server, the test will be skipped; if you use the Heimdal
+    library against an MIT server, the test suite may hang.
+
+    Several `module/expired` tests are expected to fail with Heimdal 1.5 due
+    to a bug in Heimdal with reauthenticating immediately after a
+    library-mediated password change of an expired password.  This is fixed in
+    later releases of Heimdal.
+
+    To run the full test suite, Perl 5.10 or later is required.  The following
+    additional Perl modules will be used if present:
+
+    * Test::Pod
+    * Test::Spelling
+
+    All are available on CPAN.  Those tests will be skipped if the modules are
+    not available.
+
+sections:
+  - title: Configuring
+    body: |
+      Just installing the module does not enable it or change anything about
+      your system authentication configuration.  To use the module for all
+      system authentication on Debian systems, put something like:
+
+      ```
+          auth  sufficient   pam_krb5.so minimum_uid=1000
+          auth  required     pam_unix.so try_first_pass nullok_secure
+      ```
+
+      in `/etc/pam.d/common-auth`, something like:
+
+      ```
+          session  optional  pam_krb5.so minimum_uid=1000
+          session  required  pam_unix.so
+      ```
+
+      in `/etc/pam.d/common-session`, and something like:
+
+      ```
+          account  required  pam_krb5.so minimum_uid=1000
+          account  required  pam_unix.so
+      ```
+
+      in `/etc/pam.d/common-account`.  The `minimum_uid` setting tells the PAM
+      module to pass on any users with a UID lower than 1000, thereby
+      bypassing Kerberos authentication for the root account and any system
+      accounts.  You normally want to do this since otherwise, if the network
+      is down, the Kerberos authentication can time out and make it difficult
+      to log in as root and fix matters.  This also avoids problems with
+      Kerberos principals that happen to match system accounts accidentally
+      getting access to those accounts.
+
+      Be sure to include the module in the session group as well as the auth
+      group.  Without the session entry, the user's ticket cache will not be
+      created properly for ssh logins (among possibly others).
+
+      If your users should normally all use Kerberos passwords exclusively,
+      putting something like:
+
+      ```
+          password sufficient pam_krb5.so minimum_uid=1000
+          password required   pam_unix.so try_first_pass obscure md5
+      ```
+
+      in `/etc/pam.d/common-password` will change users' passwords in Kerberos
+      by default and then only fall back on Unix if that doesn't work.  (You
+      can make this tighter by using the more complex new-style PAM
+      configuration.)  If you instead want to synchronize local and Kerberos
+      passwords and change them both at the same time, you can do something
+      like:
+
+      ```
+          password required   pam_unix.so obscure sha512
+          password required   pam_krb5.so use_authtok minimum_uid=1000
+      ```
+
+      If you have multiple environments that you want to synchronize and you
+      don't want password changes to continue if the Kerberos password change
+      fails, use the `clear_on_fail` option.  For example:
+
+      ```
+          password required   pam_krb5.so clear_on_fail minimum_uid=1000
+          password required   pam_unix.so use_authtok obscure sha512
+          password required   pam_smbpass.so use_authtok
+      ```
+
+      In this case, if `pam_krb5` cannot change the password (due to password
+      strength rules on the KDC, for example), it will clear the stored
+      password (because of the `clear_on_fail` option), and since `pam_unix`
+      and `pam_smbpass` are both configured with `use_authtok`, they will both
+      fail.  `clear_on_fail` is not the default because it would interfere
+      with the more common pattern of falling back to local passwords if the
+      user doesn't exist in Kerberos.
+
+      If you use a more complex configuration with the Linux PAM `[]` syntax
+      for the session and account groups, note that `pam_krb5` returns a
+      status of ignore, not success, if the user didn't log on with Kerberos.
+      You may need to handle that explicitly with `ignore=ignore` in your
+      action list.
+
+      There are many, many other possibilities.  See the Linux PAM
+      documentation for all the configuration options.
+
+      On Red Hat systems, modify `/etc/pam.d/system-auth` instead, which
+      contains all of the configuration for the different stacks.
+
+      You can also use pam-krb5 only for specific services.  In that case,
+      modify the files in `/etc/pam.d` for that particular service to use
+      `pam_krb5.so` for authentication.  For services that are using passwords
+      over TLS to authenticate users, you may want to use the `ignore_k5login`
+      and `no_ccache` options to the authenticate module.  `.k5login`
+      authorization is only meaningful for local accounts and ticket caches
+      are usually (although not always) only useful for interactive sessions.
+
+      Configuring the module for Solaris is both simpler and less flexible,
+      since Solaris (at least Solaris 8 and 9, which are the last versions of
+      Solaris with which this module was extensively tested) use a single
+      `/etc/pam.conf` file that contains configuration for all programs.  For
+      console login on Solaris, try something like:
+
+      ```
+          login auth sufficient /usr/local/lib/security/pam_krb5.so minimum_uid=100
+          login auth required /usr/lib/security/pam_unix_auth.so.1 use_first_pass
+          login account required /usr/local/lib/security/pam_krb5.so minimum_uid=100
+          login account required /usr/lib/security/pam_unix_account.so.1
+          login session required /usr/local/lib/security/pam_krb5.so retain_after_close minimum_uid=100
+          login session required /usr/lib/security/pam_unix_session.so.1
+      ```
+
+      A similar configuration could be used for other services, such as ssh.
+      See the pam.conf(5) man page for more information.  When using this
+      module with Solaris login (at least on Solaris 8 and 9), you will
+      probably also need to add `retain_after_close` to the PAM configuration
+      to avoid having the user's credentials deleted before they are logged
+      in.
+
+      The Solaris Kerberos library reportedly does not support prompting for a
+      password change of an expired account during authentication.  Supporting
+      password change for expired accounts on Solaris with native Kerberos may
+      therefore require setting the `defer_pwchange` or `force_pwchange`
+      option for selected login applications.  See the description and
+      warnings about that option in the pam_krb5(5) man page.
+
+      Some configuration options may be put in the `krb5.conf` file used by
+      your Kerberos libraries (usually `/etc/krb5.conf` or
+      `/usr/local/etc/krb5.conf`) instead or in addition to the PAM
+      configuration.  See the man page for more details.
+
+      The Kerberos library, via pam-krb5, will prompt the user to change their
+      password if their password is expired, but when using OpenSSH, this will
+      only work when `ChallengeResponseAuthentication` is enabled.  Unless
+      this option is enabled, OpenSSH doesn't pass PAM messages to the user
+      and can only respond to a simple password prompt.
+
+      If you are using MIT Kerberos, be aware that users whose passwords are
+      expired will not be prompted to change their password unless the KDC
+      configuration for your realm in `[realms]` in `krb5.conf` contains a
+      `master_kdc` setting or, if using DNS SRV records, you have a DNS entry
+      for `_kerberos-master` as well as `_kerberos`.
+  - title: Debugging
+    body: |
+      The first step when debugging any problems with this module is to add
+      `debug` to the PAM options for the module (either in the PAM
+      configuration or in `krb5.conf`).  This will significantly increase the
+      logging from the module and should provide a trace of exactly what
+      failed and any available error information.
+
+      Many Kerberos authentication problems are due to configuration issues in
+      `krb5.conf`.  If pam-krb5 doesn't work, first check that `kinit` works
+      on the same system.  That will test your basic Kerberos configuration.
+      If the system has a keytab file installed that's readable by the process
+      doing authentication via PAM, make sure that the keytab is current and
+      contains a key for `host/<system>` where <system> is the fully-qualified
+      hostname.  pam-krb5 prevents KDC spoofing by checking the user's
+      credentials when possible, but this means that if a keytab is present it
+      must be correct or authentication will fail.  You can check the keytab
+      with `klist -k` and `kinit -k`.
+
+      Be sure that all libraries and modules, including PAM modules, loaded by
+      a program use the same Kerberos libraries.  Sometimes programs that use
+      PAM, such as current versions of OpenSSH, also link against Kerberos
+      directly.  If your sshd is linked against one set of Kerberos libraries
+      and pam-krb5 is linked against a different set of Kerberos libraries,
+      this will often cause problems (such as segmentation faults, bus errors,
+      assertions, or other strange behavior).  Similar issues apply to the
+      com_err library or any other library used by both modules and shared
+      libraries and by the application that loads them.  If your OS ships
+      Kerberos libraries, it's usually best if possible to build all Kerberos
+      software on the system against those libraries.
+  - title: Implementation Notes
+    body: |
+      The normal sequence of actions taken for a user login is:
+
+      ```
+          pam_authenticate
+          pam_setcred(PAM_ESTABLISH_CRED)
+          pam_open_session
+          pam_acct_mgmt
+      ```
+
+      and then at logout:
+
+      ```
+          pam_close_session
+      ```
+
+      followed by closing the open PAM session.  The corresponding `pam_sm_*`
+      functions in this module are called when an application calls those
+      public interface functions.  Not all applications call all of those
+      functions, or in particularly that order, although `pam_authenticate` is
+      always first and has to be.
+
+      When `pam_authenticate` is called, pam-krb5 creates a temporary ticket
+      cache in `/tmp` and sets the PAM environment variable `PAM_KRB5CCNAME`
+      to point to it.  This ticket cache will be automatically destroyed when
+      the PAM session is closed and is there only to pass the initial
+      credentials to the call to `pam_setcred`.  The module would use a memory
+      cache, but memory caches will only work if the application preserves the
+      PAM environment between the calls to `pam_authenticate` and
+      `pam_setcred`.  Most do, but OpenSSH notoriously does not and calls
+      `pam_authenticate` in a subprocess, so this method is used to pass the
+      tickets to the `pam_setcred` call in a different process.
+
+      `pam_authenticate` does a complete authentication, including checking
+      the resulting TGT by obtaining a service ticket for the local host if
+      possible, but this requires read access to the system keytab.  If the
+      keytab doesn't exist, can't be read, or doesn't include the appropriate
+      credentials, the default is to accept the authentication.  This can be
+      controlled by setting `verify_ap_req_nofail` to true in `[libdefaults]`
+      in `/etc/krb5.conf`.  `pam_authenticate` also does a basic authorization
+      check, by default calling `krb5_kuserok` (which uses `~/.k5login` if
+      available and falls back to checking that the principal corresponds to
+      the account name).  This can be customized with several options
+      documented in the pam_krb5(5) man page.
+
+      pam-krb5 treats `pam_open_session` and `pam_setcred(PAM_ESTABLISH_CRED)`
+      as synonymous, as some applications call one and some call the other.
+      Both copy the initial credentials from the temporary cache into a
+      permanent cache for this session and set `KRB5CCNAME` in the
+      environment.  It will remember when the credential cache has been
+      established and then avoid doing any duplicate work afterwards, since
+      some applications call `pam_setcred` or `pam_open_session` multiple
+      times (most notably X.Org 7 and earlier xdm, which also throws away the
+      module settings the last time it calls them).
+
+      `pam_acct_mgmt` finds the ticket cache, reads it in to obtain the
+      authenticated principal, and then does is another authorization check
+      against `.k5login` or the local account name as described above.
+
+      After the call to `pam_setcred` or `pam_open_session`, the ticket cache
+      will be destroyed whenever the calling application either destroys the
+      PAM environment or calls `pam_close_session`, which it should do on user
+      logout.
+
+      The normal sequence of events when refreshing a ticket cache (such as
+      inside a screensaver) is:
+
+      ```
+          pam_authenticate
+          pam_setcred(PAM_REINITIALIZE_CRED)
+          pam_acct_mgmt
+      ```
+
+      (`PAM_REFRESH_CRED` may be used instead.)  Authentication proceeds as
+      above.  At the `pam_setcred` stage, rather than creating a new ticket
+      cache, the module instead finds the current ticket cache (from the
+      `KRB5CCNAME` environment variable or the default ticket cache location
+      from the Kerberos library) and then reinitializes it with the
+      credentials from the temporary `pam_authenticate` ticket cache.  When
+      refreshing a ticket cache, the application should not open a session.
+      Calling `pam_acct_mgmt` is optional; pam-krb5 doesn't do anything
+      different when it's called in this case.
+
+      If `pam_authenticate` apparently didn't succeed, or if an account was
+      configured to be ignored via `ignore_root` or `minimum_uid`,
+      `pam_setcred` (and therefore `pam_open_session`) and `pam_acct_mgmt`
+      return `PAM_IGNORE`, which tells the PAM library to proceed as if that
+      module wasn't listed in the PAM configuration at all.
+      `pam_authenticate`, however, returns failure in the ignored user case by
+      default, since otherwise a configuration using `ignore_root` with
+      pam-krb5 as the only PAM module would allow anyone to log in as root
+      without a password.  There doesn't appear to be a case where returning
+      `PAM_IGNORE` instead would improve the module's behavior, but if you
+      know of a case, please let me know.
+
+      By default, `pam_authenticate` intentionally does not follow the PAM
+      standard for handling expired accounts and instead returns failure from
+      `pam_authenticate` unless the Kerberos libraries are able to change the
+      account password during authentication.  Too many applications either do
+      not call `pam_acct_mgmt` or ignore its exit status.  The fully correct
+      PAM behavior (returning success from `pam_authenticate` and
+      `PAM_NEW_AUTHTOK_REQD` from `pam_acct_mgmt`) can be enabled with the
+      `defer_pwchange` option.
+
+      The `defer_pwchange` option is unfortunately somewhat tricky to
+      implement.  In this case, the calling sequence is:
+
+      ```
+          pam_authenticate
+          pam_acct_mgmt
+          pam_chauthtok
+          pam_setcred
+          pam_open_session
+      ```
+
+      During the first `pam_authenticate`, we can't obtain credentials and
+      therefore a ticket cache since the password is expired.  But
+      `pam_authenticate` isn't called again after `pam_chauthtok`, so
+      `pam_chauthtok` has to create a ticket cache.  We however don't want it
+      to do this for the normal password change (`passwd`) case.
+
+      What we do is set a flag in our PAM data structure saying that we're
+      processing an expired password, and `pam_chauthtok`, if it sees that
+      flag, redoes the authentication with password prompting disabled after
+      it finishes changing the password.
+
+      Unfortunately, when handling password changes this way, `pam_chauthtok`
+      will always have to prompt the user for their current password again
+      even though they just typed it.  This is because the saved
+      authentication tokens are cleared after `pam_authenticate` returns, for
+      security reasons.  We could hack around this by saving the password in
+      our PAM data structure, but this would let the application gain access
+      to it (exactly what the clearing is intended to prevent) and breaks a
+      PAM library guarantee.  We could also work around this by having
+      `pam_authenticate` get the `kadmin/changepw` authenticator in the
+      expired password case and store it for `pam_chauthtok`, but it doesn't
+      seem worth the hassle.
+  - title: History and Acknowledgements
+    body: |
+      Originally written by Frank Cusack <fcusack@fcusack.com>, with the
+      following acknowledgement:
+
+      > Thanks to Naomaru Itoi <itoi@eecs.umich.edu>, Curtis King
+      > <curtis.king@cul.ca>, and Derrick Brashear <shadow@dementia.org>, all
+      > of whom have written and made available Kerberos 4/5 modules.
+      > Although no code in this module is directly from these author's
+      > modules, (except the get_user_info() routine in support.c; derived
+      > from whichever of these authors originally wrote the first module the
+      > other 2 copied from), it was extremely helpful to look over their code
+      > which aided in my design.
+
+      The module was then patched for the FreeBSD ports collection with
+      additional modifications by unknown maintainers and then was modified by
+      Joel Kociolek <joko@logidee.com> to be usable with Debian GNU/Linux.
+
+      It was packaged by Sam Hartman as the Kerberos v5 PAM module for Debian
+      and improved and modified by him and later by Russ Allbery to fix bugs
+      and add additional features.  It was then adopted by Andres Salomon, who
+      added support for refreshing credentials.
+
+      The current distribution is maintained by Russ Allbery, who also added
+      support for reading configuration from `krb5.conf`, added many features
+      for compatibility with the Sourceforge module, commented and
+      standardized the formatting of the code, and overhauled the
+      documentation.
+
+      Thanks to Douglas E. Engert for the initial implementation of PKINIT
+      support.  I have since modified and reworked it extensively, so any bugs
+      or compilation problems are my fault.
+
+      Thanks to Markus Moeller for lots of debugging and multiple patches and
+      suggestions for improved portability.
+
+      Thanks to Booker Bense for the implementation of the `alt_auth_map`
+      option.
+
+      Thanks to Sam Hartman for the FAST support implementation.
diff --git a/docs/pam_krb5.pod b/docs/pam_krb5.pod
new file mode 100644
index 000000000000..024584dfd4cd
--- /dev/null
+++ b/docs/pam_krb5.pod
@@ -0,0 +1,1056 @@
+=for stopwords
+KRB5CCNAME ChallengeResponseAuthentication GSS-API Heimdal KDC PKINIT
+PasswordAuthentication SRV Solaris Sourceforge aname appdefaults auth
+canonicalized ccache krb5.conf forwardable kdestroy keytab libdefaults
+logout pam-krb5 preauth 0.8rc1 screensaver screensavers sshd localname
+krb5.conf. 0.8rc1. Allbery Cusack Salomon FSFAP SPDX-License-Identifier
+responder
+
+=head1 NAME
+
+pam_krb5 - Kerberos PAM module
+
+=head1 SYNOPSIS
+
+  auth            sufficient      pam_krb5.so minimum_uid=1000
+  session         required        pam_krb5.so minimum_uid=1000
+  account         required        pam_krb5.so minimum_uid=1000
+  password        sufficient      pam_krb5.so minimum_uid=1000
+
+=head1 DESCRIPTION
+
+The Kerberos service module for PAM, typically installed at
+F</lib/security/pam_krb5.so>, provides functionality for the four PAM
+operations: authentication, account management, session management, and
+password management.  F<pam_krb5.so> is a shared object that is
+dynamically loaded by the PAM subsystem as necessary, based on the system
+PAM configuration.  PAM is a system for plugging in external
+authentication and session management modules so that each application
+doesn't have to know the best way to check user authentication or create a
+user session on that system.  For details on how to configure PAM on your
+system, see the PAM man page, often pam(7).
+
+Here are the actions of this module when called from each group:
+
+=over 4
+
+=item auth
+
+Provides implementations of pam_authenticate() and pam_setcred().  The
+former takes the username from the PAM session, prompts for the user's
+password (unless configured to use an already-entered password), and then
+performs a Kerberos initial authentication, storing the obtained
+credentials (if successful) in a temporary ticket cache.  The latter,
+depending on the flags it is called with, either takes the contents of the
+temporary ticket cache and writes it out to a persistent ticket cache
+owned by the user or uses the temporary ticket cache to refresh an
+existing user ticket cache.
+
+Passwords as long or longer than PAM_MAX_RESP_SIZE octets (normally 512
+octets) will be rejected, since excessively long passwords can be used as
+a denial of service attack.
+
+After doing the initial authentication, the Kerberos PAM module will
+attempt to obtain tickets for a key in the local system keytab and then
+verify those tickets.  Unless this step is performed, the authentication
+is vulnerable to KDC spoofing, but it requires that the system have a
+local key and that the PAM module be running as a user that can read the
+keytab file (normally F</etc/krb5.keytab>.  You can point the Kerberos PAM
+module at a different keytab with the I<keytab> option.  If that keytab
+cannot be read or if no keys are found in it, the default (potentially
+insecure) behavior is to skip this check.  If you want to instead fail
+authentication if the obtained tickets cannot be checked, set
+C<verify_ap_req_nofail> to true in the [libdefaults] section of
+F</etc/krb5.conf>.  Note that this will affect applications other than
+this PAM module.
+
+By default, whenever the user is authenticated, a basic authorization
+check will also be done using krb5_kuserok().  The default behavior of
+this function is to check the user's account for a F<.k5login> file and,
+if one is present, ensure that the user's principal is listed in that
+file.  If F<.k5login> is not present, the default check is to ensure that
+the user's principal is in the default local realm and the user portion of
+the principal matches the account name (this can be changed by configuring
+a custom aname to localname mapping in F<krb5.conf>; see the Kerberos
+documentation for details).  This can be customized with several
+configuration options; see below.
+
+If the username provided to PAM contains an C<@> and Kerberos can,
+treating the username as a principal, map it to a local account name,
+pam_authenticate() will change the PAM user to that local account name.
+This allows users to log in with their Kerberos principal and let Kerberos
+do the mapping to an account.  This can be disabled with the
+I<no_update_user> option.  Be aware, however, that this facility cannot be
+used with OpenSSH.  OpenSSH will reject usernames that don't match local
+accounts before this remapping can be done and will pass an invalid
+password to the PAM module.  Also be aware that several other common PAM
+modules, such as pam_securetty, expect to be able to look up the user with
+getpwnam() and cannot be called before pam_krb5 when using this feature.
+
+When pam_setcred() is called to initialize a new ticket cache, the
+environment variable KRB5CCNAME is set to the path to that ticket cache.
+By default, the cache will be named F</tmp/krb5cc_UID_RANDOM> where UID is
+the user's UID and RANDOM is six randomly-chosen letters.  This can be
+configured with the I<ccache> and I<ccache_dir> options.
+
+pam-krb5 does not use the default ticket cache location or
+I<default_cc_name> in the C<[libdefaults]> section of F<krb5.conf>.  The
+default cache location would share a cache for all sessions of the same
+user, which causes confusing behavior when the user logs out of one of
+multiple sessions.
+
+If pam_setcred() initializes a new ticket cache, it will also set up that
+ticket cache so that it will be deleted when the PAM session is closed.
+Normally, the calling program (B<login>, B<sshd>, etc.) will run the
+user's shell as a sub-process, wait for it to exit, and then close the PAM
+session, thereby cleaning up the user's session.
+
+=item session
+
+Provides implementations of pam_open_session(), which is equivalent to
+calling pam_setcred() with the PAM_ESTABLISH_CRED flag, and
+pam_close_session(), which destroys the ticket cache created by
+pam_setcred().
+
+=item account
+
+Provides an implementation of pam_acct_mgmt().  All it does is do the same
+authorization check as performed by the pam_authenticate() implementation
+described above.
+
+=item password
+
+Provides an implementation of pam_chauthtok(), which implements password
+changes.  The user is prompted for their existing password (unless
+configured to use an already entered one) and the PAM module then obtains
+credentials for the special Kerberos principal C<kadmin/changepw>.  It
+then prompts the user for a new password, twice to ensure that the user
+entered it properly (again, unless configured to use an already entered
+password), and then does a Kerberos password change.
+
+Passwords as long or longer than PAM_MAX_RESP_SIZE octets (normally 512
+octets) will be rejected, since excessively long passwords can be used as
+a denial of service attack.
+
+Unlike the normal Unix password module, this module will allow any user to
+change any other user's password if they know the old password.  Also,
+unlike the normal Unix password module, root will always be prompted for
+the old password, since root has no special status in Kerberos.  (To
+change passwords in Kerberos without knowing the old password, use
+kadmin(8) instead.)
+
+=back
+
+Both the account and session management calls of the Kerberos PAM module
+will return PAM_IGNORE if called in the context of a PAM session for a
+user who did not authenticate with Kerberos (a return code of C<ignore> in
+the Linux PAM configuration language).
+
+Note that this module assumes the network is available in order to do a
+Kerberos authentication.  If the network is not available, some Kerberos
+libraries have timeouts longer than the timeout imposed by the login
+process.  This means that using this module incautiously can make it
+impossible to log on to console as root.  For this reason, you should
+always use the I<ignore_root> or I<minimum_uid> options, list a local
+authentication module such as B<pam_unix> first with a control field of
+C<sufficient> so that the Kerberos PAM module will be skipped if local
+password authentication was successful.
+
+This is not the same PAM module as the Kerberos PAM module available from
+Sourceforge, or the one included on Red Hat systems.  It supports many of
+the same options, has some additional options, and doesn't support some of
+the options those modules do.
+
+=head1 CONFIGURATION
+
+The Kerberos PAM module takes many options, not all of which are relevant
+to every PAM group; options that are not relevant will be silently
+ignored.  Any of these options can be set in the PAM configuration as
+arguments listed after C<pam_krb5.so>.  Some of the options can also be
+set in the system F<krb5.conf> file; if this is possible, it will be noted
+below in the option description.
+
+To set a boolean option in the PAM configuration file, just give the name
+of the option in the arguments.  To set an option that takes an argument,
+follow the option name with an equal sign (=) and the value, with no
+separating whitespace.  Whitespace in option arguments is not supported in
+the PAM configuration.
+
+To set an option for the PAM module in the system F<krb5.conf> file, put
+that option in the C<[appdefaults]> section.  All options must be followed
+by an equal sign (=) and a value, so for boolean options add C<= true>.
+The Kerberos PAM module will look for options either at the top level of
+the C<[appdefaults]> section or in a subsection named C<pam>, inside or
+outside a section for the realm.  For example, the following fragment of a
+F<krb5.conf> file would set I<forwardable> to true, I<minimum_uid> to
+1000, and set I<ignore_k5login> only if the realm is EXAMPLE.COM.
+
+    [appdefaults]
+        forwardable = true
+        pam = {
+            minimum_uid = 1000
+            EXAMPLE.COM = {
+                ignore_k5login = true
+            }
+        }
+
+For more information on the syntax of F<krb5.conf>, see krb5.conf(5).
+Note that options that depend on the realm will be set only on the basis
+of the default realm, either as configured in krb5.conf(5) or as set by
+the I<realm> option described below.  If the user authenticates to an
+account qualified with a realm, that realm will not be used when
+determining which options will apply.
+
+There is no difference to the PAM module whether options are specified at
+the top level or in a C<pam> section; the C<pam> section is supported in
+case there are options that should be set for the PAM module but not for
+other applications.
+
+If the same option is set in F<krb5.conf> and in the PAM configuration,
+the latter takes precedent.  Note, however, that due to the configuration
+syntax, there's no way to turn off a boolean option in the PAM
+configuration that was turned on in F<krb5.conf>.
+
+The start of each option description is annotated with the version of
+pam-krb5 in which that option was added with the current meaning.
+
+=head2 Authorization
+
+=over 4
+
+=item alt_auth_map=<format>
+
+[3.12] This functions similarly to the I<search_k5login> option.  The
+<format> argument is used as the authentication Kerberos principal, with
+any C<%s> in <format> replaced with the username.  If the username
+contains an C<@>, only the part of the username before the realm is used
+to replace C<%s>.  If <format> contains a realm, it will be used;
+otherwise, the realm of the username (if any) will be appended to the
+result.  There is no quote removal.
+
+If this option is present, the default behavior is to try this alternate
+principal first and then fall back to the standard behavior if it fails.
+The primary usage is to allow alternative principals to be used for
+authentication in programs like B<sudo>.  Most examples will look like:
+
+    alt_auth_map=%s/root
+
+which attempts authentication as the root instance of the username first
+and then falls back to the regular username (but see I<force_alt_auth> and
+I<only_alt_auth>).
+
+This option also allows a cheap way to attempt authentication in an
+alternative realm first and then fall back to the primary realm.  A
+setting like:
+
+    alt_auth_map=%s@EXAMPLE.COM
+
+will attempt authentication in the EXAMPLE.COM realm first and then fall
+back on the local default realm.  This is more convenient than running the
+module multiple times with multiple default realms set with I<realm>, but
+it is very limited: only two realms can be tried, and the alternate realm
+is always tried first.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf>, although
+normally it doesn't make sense to do that; normally it is used in the PAM
+options of configuration for specific programs.  It is only applicable to
+the auth and account groups.  If this option is set for the auth group, be
+sure to set it for the account group as well or account authorization may
+fail.
+
+=item force_alt_auth
+
+[3.12] This option is used with I<alt_auth_map> and forces authentication
+as the mapped principal if that principal exists in the KDC.  Only if the
+KDC returns principal unknown does the Kerberos PAM module fall back to
+normal authentication.  This can be used to force authentication with an
+alternate instance.  If I<alt_auth_map> is not set, it has no effect.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item ignore_k5login
+
+[2.0] Never look for a F<.k5login> file in the user's home directory.
+Instead, only check that the Kerberos principal maps to the local account
+name.  The default check is to ensure the realm matches the local realm
+and the user portion of the principal matches the local account name, but
+this can be customized by setting up an aname to localname mapping in
+F<krb5.conf>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and account groups.
+
+=item ignore_root
+
+[1.1] Do not do anything if the username is C<root>.  The authentication
+and password calls will silently fail (allowing that status to be ignored
+via a control of C<optional> or C<sufficient>), and the account and
+session calls (including pam_setcred) will return PAM_IGNORE, telling the
+PAM library to proceed as if they weren't mentioned in the PAM
+configuration.  This option is supported and will remain, but normally you
+want to use I<minimum_uid> instead.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf>.
+
+=item minimum_uid=<uid>
+
+[2.0] Do not do anything if the authenticated account name corresponds to
+a local account and that local account has a UID lower than <uid>.  If
+both of those conditions are true, the authentication and password calls
+will silently fail (allowing that status to be ignored via a control of
+C<optional> or C<sufficient>), and the account and session calls
+(including pam_setcred) will return PAM_IGNORE, telling the PAM library to
+proceed as if they weren't mentioned in the PAM configuration.
+
+Using this option is highly recommended if you don't need to use Kerberos
+to authenticate password logins to the root account (which isn't
+recommended since Kerberos requires a network connection).  It provides
+some defense in depth against user principals that happen to match a
+system account incorrectly authenticating as that system account.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf>.
+
+=item only_alt_auth
+
+[3.12] This option is used with I<alt_auth_map> and forces the use of the
+mapped principal for authentication.  It disables fallback to normal
+authentication in all cases and overrides I<search_k5login> and
+I<force_alt_auth>.  If I<alt_auth_map> is not set, it has no effect and
+the standard authentication behavior is used.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item search_k5login
+
+[2.0] Normally, the Kerberos implementation of pam_authenticate attempts
+to obtain tickets for the authenticating username in the local realm.  If
+this option is set and the local user has a F<.k5login> file in their home
+directory, the module will instead open and read that F<.k5login> file,
+attempting to use the supplied password to authenticate as each principal
+listed there in turn.  If any of those authentications succeed, the user
+will be successfully authenticated; otherwise, authentication will fail.
+This option is useful for allowing password authentication (via console or
+B<sshd> without GSS-API support) to shared accounts.  If there is no
+F<.k5login> file, the behavior is the same as normal.  Using this option
+requires that the user's F<.k5login> file be readable at the time of
+authentication.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=back
+
+=head2 Kerberos Behavior
+
+=over 4
+
+=item anon_fast
+
+[4.6] Attempt to use Flexible Authentication Secure Tunneling (FAST) by
+first authenticating as the anonymous user (WELLKNOWN/ANONYMOUS) and using
+its credentials as the FAST armor.  This requires anonymous PKINIT be
+enabled for the local realm, that PKINIT be configured on the local
+system, and that the Kerberos library support FAST and anonymous PKINIT.
+
+FAST is a mechanism to protect Kerberos against password guessing attacks
+and provide other security improvements.  To work, FAST requires that a
+ticket be obtained with a strong key to protect exchanges with potentially
+weaker user passwords.  This option uses anonymous authentication to
+obtain that key and then uses it to protect the subsequent authentication.
+
+If anonymous PKINIT is not available or fails, FAST will not be used and
+the authentication will proceed as normal.
+
+To instead use an existing ticket cache for the FAST credentials, use
+I<fast_ccache> instead of this option.  If both I<fast_ccache> and
+I<anon_fast> are set, the ticket cache named by I<fast_ccache> will be
+tried first, and the Kerberos PAM module will fall back on attempting
+anonymous PKINIT if that cache could not be used.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+The operation is the same as if using the I<fast_ccache> option, but the
+cache is created and destroyed automatically.  If both I<fast_ccache> and
+I<anon_fast> options are used, the I<fast_ccache> takes precedent and no
+anonymous authentication is done.
+
+=item fast_ccache=<ccache_name>
+
+[4.3] The same as I<anon_fast>, but use an existing Kerberos ticket cache
+rather than anonymous PKINIT.  This allows use of FAST with a realm that
+doesn't support PKINIT or doesn't support anonymous authentication.
+
+<ccache_name> should be a credential cache containing a ticket obtained
+using a strong key, such as the randomized key for the host principal of
+the local system.  If <ccache_name> names a ticket cache that is readable
+by the authenticating process and has tickets then FAST will be attempted.
+The easiest way to use this option is to use a program like B<k5start> to
+maintain a ticket cache using the host's keytab.  This ticket cache should
+normally only be readable by root, so this option will not be able to
+protect authentications done as non-root users (such as screensavers).
+
+If no credentials are present in the ticket cache, or if the ticket cache
+does not exist or is not readable, FAST will not used and authentication
+will proceed as normal.  However, if the credentials in that ticket cache
+are expired, authentication will fail if the KDC supports FAST.
+
+To use anonymous PKINIT to protect the FAST exchange, use the I<anon_fast>
+option instead.  I<anon_fast> is easier to configure, since no existing
+ticket cache is required, but requires PKINIT be available and configured
+and that the local realm support anonymous authentication.  If both
+I<fast_ccache> and I<anon_fast> are set, the ticket cache named by
+I<fast_ccache> will be tried first, and the Kerberos PAM module will fall
+back on attempting anonymous PKINIT if that cache could not be used.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=item forwardable
+
+[1.0] Obtain forwardable tickets.  If set (to either true or false,
+although it can only be set to false in F<krb5.conf>), this overrides the
+Kerberos library default set in the [libdefaults] section of F<krb5.conf>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item keytab=<path>
+
+[3.0] Specifies the keytab to use when validating the user's credentials.
+The default is the default system keytab (normally F</etc/krb5.keytab>),
+which is usually only readable by root.  Applications not running as root
+that use this PAM module for authentication may wish to point it to
+another keytab the application can read.  The first principal found in the
+keytab will be used as the principal for credential verification.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item realm=<realm>
+
+[2.2] Set the default Kerberos realm and obtain credentials in that realm,
+rather than in the normal default realm for this system.  If this option
+is used, it should be set for all groups being used for consistent
+results.  This setting will affect authorization decisions since it
+changes the default realm.  This setting will also change the service
+principal used to verify the obtained credentials to be in the specified
+realm.
+
+If you only want to set the realm assumed for user principals without
+changing the realm for authorization decisions or the service principal
+used to verify credentials, see the I<user_realm> option.
+
+=item renew_lifetime=<lifetime>
+
+[2.0] Obtain renewable tickets with a maximum renewable lifetime of
+<lifetime>.  <lifetime> should be a Kerberos lifetime string such as
+C<2d4h10m> or a time in minutes.  If set, this overrides the Kerberos
+library default set in the [libdefaults] section of F<krb5.conf>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item ticket_lifetime=<lifetime>
+
+[3.0] Obtain tickets with a maximum lifetime of <lifetime>.  <lifetime>
+should be a Kerberos lifetime string such as C<2d4h10m> or a time in
+minutes.  If set, this overrides the Kerberos library default set in the
+[libdefaults] section of F<krb5.conf>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item user_realm
+
+[4.6] Obtain credentials in the specified realm rather than in the default
+realm for this system.  If this option is used, it should be set for all
+groups being used for consistent results (although the account group
+currently doesn't care about realm).  This will not change authorization
+decisions.  If the obtained credentials are supposed to allow access to a
+shell account, the user will need an appropriate F<.k5login> file entry or
+the system will have to have a custom aname_to_localname mapping.
+
+=back
+
+=head2 PAM Behavior
+
+=over 4
+
+=item clear_on_fail
+
+[3.9] When changing passwords, PAM first does a preliminary check through
+the complete password stack, and then calls each module again to do the
+password change.  After that preliminary check, the order of module
+invocation is fixed.  This means that even if the Kerberos password change
+fails (or if one of the other password changes in the stack fails), other
+password PAM modules in the stack will still be called even if the failing
+module is marked required or requisite.  When using multiple password PAM
+modules to synchronize passwords between multiple systems when they
+change, this behavior can cause unwanted differences between the
+environments.
+
+Setting this option provides a way to work around this behavior.  If this
+option is set and a Kerberos password change is attempted and fails (due
+to network errors or password strength checking on the KDC, for example),
+this module will clear the stored password in the PAM stack.  This will
+force any subsequent modules that have I<use_authtok> set to fail so that
+those environments won't get out of sync with the password in Kerberos.
+The Kerberos PAM module will not meddle with the stored password if it
+skips the user due to configuration such as minimum_uid.
+
+Unfortunately, setting this option interferes with other desirable PAM
+configurations, such as attempting to change the password in Kerberos
+first and falling back on the local Unix password database if that fails.
+It therefore isn't the default.  Turn it on (and list pam_krb5 first after
+pam_cracklib if used) when synchronizing passwords between multiple
+environments.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the password group.
+
+=item debug
+
+[1.0] Log more verbose trace and debugging information to syslog at
+LOG_DEBUG priority, including entry and exit from each of the external PAM
+interfaces (except pam_close_session).
+
+This option can be set in C<[appdefaults]> in F<krb5.conf>.
+
+=item defer_pwchange
+
+[3.11] By default, pam-krb5 lets the Kerberos library handle prompting for
+a password change if an account's password is expired during the auth
+group.  If this fails, pam_authenticate() returns an error.
+
+According to the PAM standard, this is not the correct way to handle
+expired passwords.  Instead, pam_authenticate() should return success
+without attempting a password change, and then pam_acct_mgmt() should
+return PAM_NEW_AUTHTOK_REQD, at which point the calling application is
+responsible for either rejecting the authentication or calling
+pam_chauthtok().  However, following the standard requires that all
+applications call pam_acct_mgmt() and check its return status; otherwise,
+expired accounts may be able to successfully authenticate.  Many
+applications do not do this.
+
+If this option is set, pam-krb5 uses the fully correct PAM mechanism for
+handling expired accounts instead of failing in pam_authenticate().  Due
+to the security risk of widespread broken applications, be very careful
+about enabling this option.  It should normally only be turned on to solve
+a specific problem (such as using Solaris Kerberos libraries that don't
+support prompting for password changes during authentication), and then
+only for specific applications known to call pam_acct_mgmt() and check its
+return status properly.
+
+This option is only supported when pam-krb5 is built with MIT Kerberos.
+If built against Heimdal, this option does nothing and normal expired
+password change handling still happens.  (Heimdal is missing the required
+API to implement this option, at least as of version 1.6.)
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item fail_pwchange
+
+[4.2] By default, pam-krb5 lets the Kerberos library handle prompting for
+a password change if an account's password is expired during the auth
+group.  If this option is set, expired passwords are instead treated as an
+authentication failure identical to an incorrect password.  Also see
+I<defer_pwchange> and I<force_pwchange>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item force_pwchange
+
+[3.11] If this option is set and authentication fails with a Kerberos
+error indicating the user's password is expired, attempt to immediately
+change their password during the authenticate step.  Under normal
+circumstances, this is unnecessary.  Most Kerberos libraries will do this
+for you, and setting this option will prompt the user twice to change
+their password if the first attempt (done by the Kerberos library) fails.
+However, some system Kerberos libraries (such as Solaris's) have password
+change prompting disabled in the Kerberos library; on those systems, you
+can set this option to simulate the normal library behavior.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item no_update_user
+
+[4.7] Normally, if pam-krb5 is able to canonicalize the principal to a
+local name using krb5_aname_to_localname() or similar calls, it changes
+the PAM_USER variable for this PAM session to the canonicalized local
+name.  Setting this option disables this behavior and leaves PAM_USER set
+to the initial authentication identity.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth group.
+
+=item silent
+
+[1.0] Don't show messages and errors from Kerberos, such as warnings of
+expiring passwords, to the user via the prompter.  This is equivalent to
+the behavior when the application passes in PAM_SILENT, but can be set in
+the PAM configuration.
+
+This option is only applicable to the auth and password groups.
+
+=item trace=<log-file>
+
+[4.6] Enables Kerberos library trace logging to the specified log file if
+it is supported by the Kerberos library.  This is intended for temporary
+debugging.  The specified file will be appended to without further
+security checks, so do not specify a file in a publicly writable directory
+like F</tmp>.
+
+=back
+
+=head2 PKINIT
+
+=over 4
+
+=item pkinit_anchors=<anchors>
+
+[3.0] When doing PKINIT authentication, use <anchors> as the client trust
+anchors.  This is normally a reference to a file containing the trusted
+certificate authorities.  This option is only used if I<try_pkinit> or
+I<use_pkinit> are set.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=item pkinit_prompt
+
+[3.0] Before attempting PKINIT authentication, prompt the user to insert a
+smart card.  You may want to set this option for programs such as
+B<gnome-screensaver> that call PAM as soon as the mouse is touched and
+don't give the user an opportunity to enter the smart card first.  Any
+information entered at the first prompt is ignored.  If I<try_pkinit> is
+set, a user who wishes to use a password instead can just press Enter and
+then enter their password as normal.  This option is only used if
+I<try_pkinit> or I<use_pkinit> are set.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=item pkinit_user=<userid>
+
+[3.0] When doing PKINIT authentication, use <userid> as the user ID.  The
+value of this string is highly dependent on the type of PKINIT
+implementation you're using, but will generally be something like:
+
+    PKCS11:/usr/lib/pkcs11/lib/soft-pkcs11.so
+
+to specify the module to use with a smart card.  It may also point to a
+user certificate or to other types of user IDs.  See the Kerberos library
+documentation for more details.  This option is only used if I<try_pkinit>
+or I<use_pkinit> are set.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=item preauth_opt=<option>
+
+[3.3] Sets a preauth option (currently only applicable when built with MIT
+Kerberos).  <option> is either a key/value pair with the key separated
+from the value by C<=> or a boolean option (in which case it's turned on).
+In F<krb5.conf>, multiple options should be separated by whitespace.  In
+the PAM configuration, this option can be given multiple times to set
+multiple options.  In either case, <option> may not contain whitespace.
+
+The primary use of this option, at least in the near future, will be to
+set options for the MIT Kerberos PKINIT support.  For the full list of
+possible options, see the PKINIT plugin documentation.  At the time of
+this writing, C<X509_user_identity> is equivalent to I<pkinit_user> and
+C<X509_anchors> is equivalent to I<pkinit_anchors>.  C<flag_DSA_PROTOCOL>
+can only be set via this option.
+
+Any settings made with this option are applied after the I<pkinit_anchors>
+and I<pkinit_user> options, so if an equivalent setting is made via
+I<preauth_opt>, it will probably override the other setting.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.  Note that there is no way to
+remove a setting made in F<krb5.conf> using the PAM configuration, but
+options set in the PAM configuration are applied after options set in
+F<krb5.conf> and therefore may override earlier settings.
+
+=item try_pkinit
+
+[3.0] Attempt PKINIT authentication before trying a regular password.  You
+will probably also need to set the I<pkinit_user> configuration option.
+If PKINIT fails, the PAM module will fall back on regular password
+authentication.  This option is currently only supported if pam-krb5 was
+built against Heimdal 0.8rc1 or later or MIT Kerberos 1.6.3 or later.
+
+If this option is set and pam-krb5 is built against MIT Kerberos, and
+PKINIT fails and the module falls back to password authentication, the
+user's password will not be stored in the PAM stack for subsequent
+modules.  This is a bug in the interaction between the module and MIT
+Kerberos that requires some reworking of the PKINIT authentication method
+to fix.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=item use_pkinit
+
+[3.0, 4.9 for MIT Kerberos] Require PKINIT authentication.  You will
+probably also need to set the I<pkinit_user> configuration option.  If
+PKINIT fails, authentication will fail.  This option is only supported if
+pam-krb5 was built against Heimdal 0.8rc1 or later or MIT Kerberos 1.12 or
+later.
+
+Be aware that, with MIT Kerberos, this option is implemented by using a
+responder without a prompter, and thus any informational messages from the
+Kerberos libraries or KDC during authentication will not be displayed.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=back
+
+=head2 Prompting
+
+=over 4
+
+=item banner=<banner>
+
+[3.0] By default, the prompts when a user changes their password are:
+
+    Current Kerberos password:
+    Enter new Kerberos password:
+    Retype new Kerberos password:
+
+The string "Kerberos" is inserted so that users aren't confused about
+which password they're changing.  Setting this option replaces the word
+"Kerberos" with whatever this option is set to.  Setting this option to
+the empty string removes the word before "password:" entirely.
+
+If set in the PAM configuration, <banner> may not contain whitespace.  If
+you want a value containing whitespace, set it in F<krb5.conf>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the password group.
+
+=item expose_account
+
+[3.0] By default, the Kerberos PAM module password prompt is simply
+"Password:".  This avoids leaking any information about the system realm
+or account to principal conversions.  If this option is set, the string
+"for <principal>" is added before the colon, where <principal> is the
+user's principal.  This string is also added before the colon on prompts
+when changing the user's password.
+
+Enabling this option with ChallengeResponseAuthentication enabled in
+OpenSSH may cause problems for some ssh clients that only recognize
+"Password:" as a prompt.  This option is automatically disabled if
+I<search_k5login> is enabled since the principal displayed would be
+inaccurate.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and password groups.
+
+=item force_first_pass
+
+[4.0] Use the password obtained by a previous authentication or password
+module to authenticate the user without prompting the user again.  If no
+previous module obtained the user's password, fail without prompting the
+user.  Also see I<try_first_pass> and I<use_first_pass> for weaker
+versions of this option.
+
+This option is only applicable to the auth and password groups.  For the
+password group, it applies only to the old password.  See I<use_authtok>
+for a similar setting for the new password.
+
+=item no_prompt
+
+[4.6] Never prompt for the current password.  Instead, pass in a NULL
+password to the Kerberos library and let the Kerberos library do the
+prompting.  This may be needed if, for example, the Kerberos library is
+configured to use other authentication mechanisms than passwords and needs
+full control over the prompting process.
+
+The major disadvantage of this option is that it means the PAM module will
+never see the user's password and therefore cannot save it in the PAM
+module data for any subsequent modules.  In other words, this option
+cannot be used if another module is in the stack behind the Kerberos PAM
+module and wants to use I<use_first_pass>.  The Kerberos library also
+usually includes the principal in the prompt, and therefore this option
+implies behavior similar to I<expose_account>.  Similar to
+I<expose_account>, this can cause problems with OpenSSH if
+ChallengeResponseAuthentication is enabled, since clients may not
+recognize password prompts other than "Password:".
+
+Using this option with I<search_k5login> would result in a password prompt
+for every principal listed in the user's F<.k5login> file.  This is
+probably not desired behavior, although it's not prohibited by the module.
+
+This option is only applicable to the auth and password groups.  For the
+password group, it applies only to the authentication process; the user
+will still be prompted for a new password.
+
+=item prompt_principal
+
+[3.6] Before prompting for the user's password (or using the previously
+entered password, if I<try_first_pass>, I<use_first_pass>, or
+I<force_first_pass> are set), prompt the user for the Kerberos principal
+to use for authentication.  This allows the user to authenticate with a
+different principal than the one corresponding to the local username,
+provided that either a F<.k5login> file or local Kerberos principal to
+account mapping authorize that principal to access the local account.
+
+Be cautious when using this configuration option and don't use it with
+OpenSSH PasswordAuthentication, only ChallengeResponseAuthentication.
+Some PAM-enabled applications expect PAM modules to only prompt for
+passwords and may even blindly give the password to the first prompt, no
+matter what it is.  Such applications, in combination with this option,
+may expose the user's password in log messages and Kerberos requests.
+
+=item try_first_pass
+
+[1.0] If the authentication module isn't the first on the stack, and a
+previous module obtained the user's password, use that password to
+authenticate the user without prompting them again.  If that
+authentication fails, fall back on prompting the user for their password.
+This option has no effect if the authentication module is first in the
+stack or if no previous module obtained the user's password.  Also see
+I<use_first_pass> and I<force_first_pass> for stronger versions of this
+option.
+
+This option is only applicable to the auth and password groups.  For the
+password group, it applies only to the old password.
+
+=item use_authtok
+
+[4.0] Use the new password obtained by a previous password module when
+changing passwords rather than prompting for the new password.  If the new
+password isn't available, fail.  This can be used to require passwords be
+checked by another, prior module, such as B<pam_cracklib>.
+
+This option is only applicable to the password group.
+
+=item use_first_pass
+
+[1.0] Use the password obtained by a previous authentication module to
+authenticate the user without prompting the user again.  If no previous
+module obtained the user's password for either an authentication or
+password change, fall back on prompting the user.  If a previous module
+did obtain the user's password but authentication with that password
+fails, fail without further prompting the user.  Also see
+I<try_first_pass> and I<force_first_pass> for other versions of this
+option.
+
+This option is only applicable to the auth and password groups.  For the
+password group, it applies only to the old password.  See I<use_authtok>
+for a similar setting for the new password.
+
+=back
+
+=head2 Ticket Caches
+
+=over 4
+
+=item ccache=<pattern>
+
+[2.0] Use <pattern> as the pattern for creating credential cache names.
+<pattern> must be in the form <type>:<residual> where <type> and the
+following colon are optional if a file cache should be used.  The special
+token C<%u>, anywhere in <pattern>, is replaced with the user's numeric
+UID.  The special token C<%p>, anywhere in <pattern>, is replaced with the
+current process ID.
+
+If <pattern> ends in the literal string C<XXXXXX> (six X's), that string
+will be replaced by randomly generated characters and the ticket cache
+will be created using mkstemp(3).  This is strongly recommended if
+<pattern> points to a world-writable directory.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and session groups.
+
+=item ccache_dir=<directory>
+
+[1.2] Store both the temporary ticket cache used during authentication and
+user ticket caches in <directory> instead of in F</tmp>.  The algorithm
+for generating the ticket cache name is otherwise unchanged.  <directory>
+may be prefixed with C<FILE:> to make the cache type unambiguous (and this
+may be required on systems that use a cache type other than file as the
+default).
+
+Be aware that pam_krb5 creates and stores a temporary ticket cache file
+owned by root during the login process.  If you set I<ccache> above to
+avoid using the system F</tmp> directory for user ticket caches, you may
+also want to set I<ccache_dir> to move those temporary caches to some
+other location.  This will allow pam_krb5 to continue working even if the
+system F</tmp> directory is full.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and session groups.
+
+=item no_ccache
+
+[1.0] Do not create a ticket cache after authentication.  This option
+shouldn't be set in general, but is useful as part of the PAM
+configuration for a particular service that uses PAM for authentication
+but isn't creating user sessions and doesn't want the overhead of ever
+writing the user credentials to disk.  When using this option, the
+application should only call pam_authenticate(); other functions like
+pam_setcred(), pam_start_session(), and pam_acct_mgmt() don't make sense
+with this option.  Don't use this option if the application needs PAM
+account and session management calls.
+
+This option is only applicable to the auth group.
+
+=item retain_after_close
+
+[2.3] Normally, the user's ticket cache is destroyed when either pam_end()
+or pam_close_session() is called by the authenticating application so that
+ticket caches aren't left behind after the user logs out.  In some cases,
+however, this isn't desirable.  (On Solaris 8, for instance, the default
+behavior means login will destroy the ticket cache before running the
+user's shell.)  If this option is set, the PAM module will never destroy
+the user's ticket cache.  If you set this, you may want to call
+B<kdestroy> in the shell's logout configuration or run a temporary file
+removal program to avoid accumulating hundreds of ticket caches in
+F</tmp>.
+
+This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
+applicable to the auth and session groups.
+
+=back
+
+=head1 ENVIRONMENT
+
+=over 4
+
+=item KRB5CCNAME
+
+Set by pam_setcred() with the PAM_ESTABLISH_CRED option, and therefore
+also by pam_open_session(), to point to the new credential cache for the
+user.  See the I<ccache> and I<ccache_dir> options.  By default, the cache
+name will be prefixed with C<FILE:> to make the cache type unambiguous.
+
+=item PAM_KRB5CCNAME
+
+Set by pam_authenticate() to point to the temporary ticket cache used for
+authentication (unless the I<no_ccache> option was given).  pam_setcred()
+then uses that environment variable to locate the temporary cache even if
+it was not called in the same PAM session as pam_authenticate() (a problem
+with B<sshd> running in some modes).  This environment variable is only
+used internal to the PAM module.
+
+=back
+
+=head1 FILES
+
+=over 4
+
+=item F</tmp/krb5cc_UID_RANDOM>
+
+The default credential cache name.  UID is the decimal UID of the local
+user and RANDOM is a random six-character string.  The pattern may be
+changed with the I<ccache> option and the directory with the I<ccache_dir>
+option.
+
+=item F</tmp/krb5cc_pam_RANDOM>
+
+The credential cache name used for the temporary credential cache created
+by pam_authenticate().  This cache is removed again when the PAM session
+is ended or when pam_setcred() is called and will normally not be
+user-visible.  RANDOM is a random six-character string.
+
+=item F<~/.k5login>
+
+File containing Kerberos principals that are allowed access to that
+account.
+
+=back
+
+=head1 BUGS
+
+If I<try_pkinit> is set and pam-krb5 is built with MIT Kerberos, the
+user's password is not saved in the PAM data if PKINIT fails and the
+module falls back to password authentication.
+
+=head1 CAVEATS
+
+Be sure to list this module in the session group as well as the auth group
+when using it for interactive logins.  Otherwise, some applications (such
+as OpenSSH) will not set up the user's ticket cache correctly.
+
+The Kerberos library, via pam-krb5, will prompt the user to change their
+password if their password is expired, but when using OpenSSH, this will
+only work when ChallengeResponseAuthentication is enabled.  Unless this
+option is enabled, OpenSSH doesn't pass PAM messages to the user and can
+only respond to a simple password prompt.
+
+If you are using MIT Kerberos, be aware that users whose passwords are
+expired will not be prompted to change their password unless the KDC
+configuration for your realm in [realms] in krb5.conf contains a
+master_kdc setting or, if using DNS SRV records, you have a DNS entry for
+_kerberos-master as well as _kerberos.
+
+pam_authenticate() returns failure when called for an ignored account,
+requiring the system administrator to use C<optional> or C<sufficient> to
+ignore the module and move on to the next module.  It's arguably more
+correct to return PAM_IGNORE, which causes the module to be ignored as if
+it weren't in the configuration, but this increases the risk of
+inadvertent security holes when listing pam-krb5 as the only
+authentication module.
+
+This module treats the empty password as an authentication failure
+rather than attempting to use that password to avoid unwanted prompting
+behavior in the Kerberos libraries.  If you have a Kerberos principal that
+intentionally has an empty password, it won't work with this module.
+
+This module will not refresh an existing ticket cache if called with an
+effective UID or GID different than the real UID or GID, since refreshing
+an existing ticket cache requires trusting the KRB5CCNAME environment
+variable and the environment should not be trusted in a setuid context.
+
+Old versions of OpenSSH are known to call pam_authenticate followed by
+pam_setcred(PAM_REINITIALIZE_CRED) without first calling pam_open_session,
+thereby requesting that an existing ticket cache be renewed (similar to
+what a screensaver would want) rather than requesting a new ticket cache
+be created.  Since this behavior is indistinguishable at the PAM level
+from a screensaver, pam-krb5 when used with these old versions of OpenSSH
+will refresh the ticket cache of the OpenSSH daemon rather than setting up
+a new ticket cache for the user.  The resulting ticket cache will have the
+correct permissions, but will not be named correctly or referenced in the
+user's environment and will be overwritten by the next user login.  The
+best solution to this problem is to upgrade OpenSSH.  I'm not sure exactly
+when this problem was fixed, but at the very least OpenSSH 4.3 and later
+do not exhibit it.
+
+=head1 AUTHOR
+
+pam-krb5 was originally written by Frank Cusack.  Andres Salomon made
+extensive modifications, and then Russ Allbery <eagle@eyrie.org> adopted
+it and made even more extensive modifications.  Russ Allbery currently
+maintains the module.
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright 2005-2010, 2014, 2020 Russ Allbery <eagle@eyrie.org>
+
+Copyright 2008-2014 The Board of Trustees of the Leland Stanford Junior
+University
+
+Copying and distribution of this file, with or without modification, are
+permitted in any medium without royalty provided the copyright notice and
+this notice are preserved.  This file is offered as-is, without any
+warranty.
+
+SPDX-License-Identifier: FSFAP
+
+=head1 SEE ALSO
+
+kadmin(8), kdestroy(1), krb5.conf(5), pam(7), passwd(1), syslog(3)
+
+The current version of this module is available from its web page at
+L<https://www.eyrie.org/~eagle/software/pam-krb5/>.
+
+=cut
diff --git a/m4/cc-flags.m4 b/m4/cc-flags.m4
new file mode 100644
index 000000000000..99fcdec6001b
--- /dev/null
+++ b/m4/cc-flags.m4
@@ -0,0 +1,131 @@
+dnl Check whether the compiler supports particular flags.
+dnl
+dnl Provides RRA_PROG_CC_FLAG and RRA_PROG_LD_FLAG, which checks whether a
+dnl compiler supports a given flag for either compilation or linking,
+dnl respectively.  If it does, the commands in the second argument are run.
+dnl If not, the commands in the third argument are run.
+dnl
+dnl Provides RRA_PROG_CC_WARNINGS_FLAGS, which checks whether a compiler
+dnl supports a large set of warning flags and sets the WARNINGS_CFLAGS
+dnl substitution variable to all of the supported warning flags.  (Note that
+dnl this may be too aggressive for some people.)
+dnl
+dnl Depends on RRA_PROG_CC_CLANG.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Copyright 2016-2021 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2006, 2009, 2016
+dnl     by Internet Systems Consortium, Inc. ("ISC")
+dnl
+dnl Permission to use, copy, modify, and/or distribute this software for any
+dnl purpose with or without fee is hereby granted, provided that the above
+dnl copyright notice and this permission notice appear in all copies.
+dnl
+dnl THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+dnl REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+dnl MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
+dnl SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+dnl WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+dnl ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+dnl IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+dnl
+dnl SPDX-License-Identifier: ISC
+
+dnl Used to build the result cache name.
+AC_DEFUN([_RRA_PROG_CC_FLAG_CACHE],
+[translit([rra_cv_compiler_c_$1], [-=+,], [____])])
+AC_DEFUN([_RRA_PROG_LD_FLAG_CACHE],
+[translit([rra_cv_linker_c_$1], [-=+,], [____])])
+
+dnl Check whether a given flag is supported by the compiler when compiling a C
+dnl source file.
+AC_DEFUN([RRA_PROG_CC_FLAG],
+[AC_REQUIRE([AC_PROG_CC])
+ AC_MSG_CHECKING([if $CC supports $1])
+ AC_CACHE_VAL([_RRA_PROG_CC_FLAG_CACHE([$1])],
+    [save_CFLAGS=$CFLAGS
+     AS_CASE([$1],
+        [-Wno-*], [CFLAGS="$CFLAGS `AS_ECHO(["$1"]) | sed 's/-Wno-/-W/'`"],
+        [*],      [CFLAGS="$CFLAGS $1"])
+     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [int foo = 0;])],
+        [_RRA_PROG_CC_FLAG_CACHE([$1])=yes],
+        [_RRA_PROG_CC_FLAG_CACHE([$1])=no])
+     CFLAGS=$save_CFLAGS])
+ AC_MSG_RESULT([$_RRA_PROG_CC_FLAG_CACHE([$1])])
+ AS_IF([test x"$_RRA_PROG_CC_FLAG_CACHE([$1])" = xyes], [$2], [$3])])
+
+dnl Check whether a given flag is supported by the compiler when linking an
+dnl executable.
+AC_DEFUN([RRA_PROG_LD_FLAG],
+[AC_REQUIRE([AC_PROG_CC])
+ AC_MSG_CHECKING([if $CC supports $1 for linking])
+ AC_CACHE_VAL([_RRA_PROG_LD_FLAG_CACHE([$1])],
+    [save_LDFLAGS=$LDFLAGS
+     LDFLAGS="$LDFLAGS $1"
+     AC_LINK_IFELSE([AC_LANG_PROGRAM([], [int foo = 0;])],
+        [_RRA_PROG_LD_FLAG_CACHE([$1])=yes],
+        [_RRA_PROG_LD_FLAG_CACHE([$1])=no])
+     LDFLAGS=$save_LDFLAGS])
+ AC_MSG_RESULT([$_RRA_PROG_LD_FLAG_CACHE([$1])])
+ AS_IF([test x"$_RRA_PROG_LD_FLAG_CACHE([$1])" = xyes], [$2], [$3])])
+
+dnl Determine the full set of viable warning flags for the current compiler.
+dnl
+dnl This is based partly on personal preference and is a fairly aggressive set
+dnl of warnings.  Desirable CC warnings that can't be turned on due to other
+dnl problems:
+dnl
+dnl   -Wsign-conversion  Too many fiddly changes for the benefit
+dnl   -Wstack-protector  Too many false positives from small buffers
+dnl
+dnl Last checked against gcc 9.2.1 (2019-09-01).  -D_FORTIFY_SOURCE=2 enables
+dnl warn_unused_result attribute markings on glibc functions on Linux, which
+dnl catches a few more issues.  Add -O2 because gcc won't find some warnings
+dnl without optimization turned on.
+dnl
+dnl For Clang, we try to use -Weverything, but we have to disable some of the
+dnl warnings:
+dnl
+dnl   -Wcast-qual                     Some structs require casting away const
+dnl   -Wdisabled-macro-expansion      Triggers on libc (sigaction.sa_handler)
+dnl   -Wpadded                        Not an actual problem
+dnl   -Wreserved-id-macros            Autoconf sets several of these normally
+dnl   -Wsign-conversion               Too many fiddly changes for the benefit
+dnl   -Wtautological-pointer-compare  False positives with for loops
+dnl   -Wundef                         Conflicts with Autoconf probe results
+dnl   -Wunreachable-code              Happens with optional compilation
+dnl   -Wunreachable-code-return       Other compilers get confused
+dnl   -Wunused-macros                 Often used on suppressed branches
+dnl   -Wused-but-marked-unused        Happens a lot with conditional code
+dnl
+dnl Sets WARNINGS_CFLAGS as a substitution variable.
+AC_DEFUN([RRA_PROG_CC_WARNINGS_FLAGS],
+[AC_REQUIRE([RRA_PROG_CC_CLANG])
+ AS_IF([test x"$CLANG" = xyes],
+    [WARNINGS_CFLAGS="-Werror"
+     m4_foreach_w([flag],
+        [-Weverything -Wno-cast-qual -Wno-disabled-macro-expansion -Wno-padded
+         -Wno-sign-conversion -Wno-reserved-id-macro
+         -Wno-tautological-pointer-compare -Wno-undef -Wno-unreachable-code
+         -Wno-unreachable-code-return -Wno-unused-macros
+         -Wno-used-but-marked-unused],
+        [RRA_PROG_CC_FLAG(flag,
+            [WARNINGS_CFLAGS="${WARNINGS_CFLAGS} flag"])])],
+    [WARNINGS_CFLAGS="-g -O2 -D_FORTIFY_SOURCE=2 -Werror"
+     m4_foreach_w([flag],
+        [-fstrict-overflow -fstrict-aliasing -Wall -Wextra -Wformat=2
+         -Wformat-overflow=2 -Wformat-signedness -Wformat-truncation=2
+         -Wnull-dereference -Winit-self -Wswitch-enum -Wstrict-overflow=5
+         -Wmissing-format-attribute -Walloc-zero -Wduplicated-branches
+         -Wduplicated-cond -Wtrampolines -Wfloat-equal
+         -Wdeclaration-after-statement -Wshadow -Wpointer-arith
+         -Wbad-function-cast -Wcast-align -Wwrite-strings -Wconversion
+         -Wno-sign-conversion -Wdate-time -Wjump-misses-init -Wlogical-op
+         -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes
+         -Wmissing-declarations -Wnormalized=nfc -Wpacked -Wredundant-decls
+         -Wrestrict -Wnested-externs -Winline -Wvla],
+        [RRA_PROG_CC_FLAG(flag,
+            [WARNINGS_CFLAGS="${WARNINGS_CFLAGS} flag"])])])
+ AC_SUBST([WARNINGS_CFLAGS])])
diff --git a/m4/clang.m4 b/m4/clang.m4
new file mode 100644
index 000000000000..c1815a5702c2
--- /dev/null
+++ b/m4/clang.m4
@@ -0,0 +1,28 @@
+dnl Determine whether the current compiler is Clang.
+dnl
+dnl If the current compiler is Clang, set the shell variable CLANG to yes.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Copyright 2015 Russ Allbery <eagle@eyrie.org>
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Source used by RRA_PROG_CC_CLANG.
+AC_DEFUN([_RRA_PROG_CC_CLANG_SOURCE], [[
+#if ! __clang__
+#error
+#endif
+]])
+
+AC_DEFUN([RRA_PROG_CC_CLANG],
+[AC_CACHE_CHECK([if the compiler is Clang], [rra_cv_prog_cc_clang],
+    [AC_COMPILE_IFELSE([AC_LANG_SOURCE([_RRA_PROG_CC_CLANG_SOURCE])],
+        [rra_cv_prog_cc_clang=yes],
+        [rra_cv_prog_cc_clang=no])])
+ AS_IF([test x"$rra_cv_prog_cc_clang" = xyes], [CLANG=yes])])
diff --git a/m4/kadm5clnt.m4 b/m4/kadm5clnt.m4
new file mode 100644
index 000000000000..b52a32e04ed7
--- /dev/null
+++ b/m4/kadm5clnt.m4
@@ -0,0 +1,103 @@
+dnl Find the compiler and linker flags for the kadmin client library.
+dnl
+dnl Finds the compiler and linker flags for linking with the kadmin client
+dnl library.  Provides the --with-kadm5clnt, --with-kadm5clnt-include, and
+dnl --with-kadm5clnt-lib configure option to specify a non-standard path to
+dnl the library.  Uses krb5-config where available unless reduced dependencies
+dnl is requested or --with-kadm5clnt-include or --with-kadm5clnt-lib are
+dnl given.
+dnl
+dnl Provides the macros RRA_LIB_KADM5CLNT and RRA_LIB_KADM5CLNT_OPTIONAL and
+dnl sets the substitution variables KADM5CLNT_CPPFLAGS, KADM5CLNT_LDFLAGS, and
+dnl KADM5CLNT_LIBS.  Also provides RRA_LIB_KADM5CLNT_SWITCH to set CPPFLAGS,
+dnl LDFLAGS, and LIBS to include the kadmin client libraries, saving the
+dnl ecurrent values, and RRA_LIB_KADM5CLNT_RESTORE to restore those settings
+dnl to before the last RRA_LIB_KADM5CLNT_SWITCH.  Defines HAVE_KADM5CLNT and
+dnl sets rra_use_KADM5CLNT to true if the library is found.
+dnl
+dnl Depends on the RRA_LIB helper routines.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2005-2009, 2011, 2013
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Save the current CPPFLAGS, LDFLAGS, and LIBS settings and switch to
+dnl versions that include the kadmin client flags.  Used as a wrapper, with
+dnl RRA_LIB_KADM5CLNT_RESTORE, around tests.
+AC_DEFUN([RRA_LIB_KADM5CLNT_SWITCH], [RRA_LIB_HELPER_SWITCH([KADM5CLNT])])
+
+dnl Restore CPPFLAGS, LDFLAGS, and LIBS to their previous values (before
+dnl RRA_LIB_KADM5CLNT_SWITCH was called).
+AC_DEFUN([RRA_LIB_KADM5CLNT_RESTORE], [RRA_LIB_HELPER_RESTORE([KADM5CLNT])])
+
+dnl Set KADM5CLNT_CPPFLAGS and KADM5CLNT_LDFLAGS based on rra_KADM5CLNT_root,
+dnl rra_KADM5CLNT_libdir, and rra_KADM5CLNT_includedir.
+AC_DEFUN([_RRA_LIB_KADM5CLNT_PATHS], [RRA_LIB_HELPER_PATHS([KADM5CLNT])])
+
+dnl Does the appropriate library checks for reduced-dependency kadmin client
+dnl linkage.  The single argument, if "true", says to fail if the kadmin
+dnl client library could not be found.
+AC_DEFUN([_RRA_LIB_KADM5CLNT_REDUCED],
+[RRA_LIB_KADM5CLNT_SWITCH
+ AC_CHECK_LIB([kadm5clnt], [kadm5_init_with_password],
+    [KADM5CLNT_LIBS=-lkadm5clnt],
+    [AS_IF([test x"$1" = xtrue],
+        [AC_MSG_ERROR([cannot find usable kadmin client library])])])
+ RRA_LIB_KADM5CLNT_RESTORE])
+
+dnl Sanity-check the results of krb5-config and be sure we can really link a
+dnl GSS-API program.  If not, fall back on the manual check.
+AC_DEFUN([_RRA_LIB_KADM5CLNT_CHECK],
+[RRA_LIB_HELPER_CHECK([$1], [KADM5CLNT], [kadm5_init_with_password],
+    [kadmin client])])
+
+dnl Determine GSS-API compiler and linker flags from krb5-config.
+AC_DEFUN([_RRA_LIB_KADM5CLNT_CONFIG],
+[RRA_KRB5_CONFIG([${rra_KADM5CLNT_root}], [kadm-client], [KADM5CLNT],
+    [_RRA_LIB_KADM5CLNT_CHECK([$1])],
+    [_RRA_LIB_KADM5CLNT_PATHS
+     _RRA_LIB_KADM5CLNT_REDUCED([$1])])])
+
+dnl The core of the library checking, shared between RRA_LIB_KADM5CLNT and
+dnl RRA_LIB_KADM5CLNT_OPTIONAL.  The single argument, if "true", says to fail
+dnl if the kadmin client library could not be found.
+AC_DEFUN([_RRA_LIB_KADM5CLNT_INTERNAL],
+[AC_REQUIRE([RRA_ENABLE_REDUCED_DEPENDS])
+ AS_IF([test x"$rra_reduced_depends" = xtrue],
+    [_RRA_LIB_KADM5CLNT_PATHS
+     _RRA_LIB_KADM5CLNT_REDUCED([$1])],
+    [AS_IF([test x"$rra_KADM5CLNT_includedir" = x \
+            && test x"$rra_KADM5CLNT_libdir" = x],
+        [_RRA_LIB_KADM5CLNT_CONFIG([$1])],
+        [_RRA_LIB_KADM5CLNT_PATHS
+         _RRA_LIB_KADM5CLNT_REDUCED([$1])])])])
+
+dnl The main macro for packages with mandatory kadmin client support.
+AC_DEFUN([RRA_LIB_KADM5CLNT],
+[RRA_LIB_HELPER_VAR_INIT([KADM5CLNT])
+ RRA_LIB_HELPER_WITH([kadm-client], [kadmin client], [KADM5CLNT])
+ _RRA_LIB_KADM5CLNT_INTERNAL([true])
+ rra_use_KADM5CLNT=true
+ AC_DEFINE([HAVE_KADM5CLNT], 1, [Define to enable kadmin client features.])])
+
+dnl The main macro for packages with optional kadmin client support.
+AC_DEFUN([RRA_LIB_KADM5CLNT_OPTIONAL],
+[RRA_LIB_HELPER_VAR_INIT([KADM5CLNT])
+ RRA_LIB_HELPER_WITH_OPTIONAL([kadm-client], [kadmin client], [KADM5CLNT])
+ AS_IF([test x"$rra_use_KADM5CLNT" != xfalse],
+    [AS_IF([test x"$rra_use_KADM5CLNT" = xtrue],
+        [_RRA_LIB_KADM5CLNT_INTERNAL([true])],
+        [_RRA_LIB_KADM5CLNT_INTERNAL([false])])])
+ AS_IF([test x"$KADM5CLNT_LIBS" != x],
+    [rra_use_KADM5CLNT=true
+     AC_DEFINE([HAVE_KADM5CLNT], 1,
+        [Define to enable kadmin client features.])])])
diff --git a/m4/krb5-config.m4 b/m4/krb5-config.m4
new file mode 100644
index 000000000000..701881e024a9
--- /dev/null
+++ b/m4/krb5-config.m4
@@ -0,0 +1,104 @@
+dnl Use krb5-config to get link paths for Kerberos libraries.
+dnl
+dnl Provides one macro, RRA_KRB5_CONFIG, which attempts to get compiler and
+dnl linker flags for a library via krb5-config and sets the appropriate shell
+dnl variables.  Defines the Autoconf variable PATH_KRB5_CONFIG, which can be
+dnl used to find the default path to krb5-config.
+dnl
+dnl Depends on RRA_ENABLE_REDUCED_DEPENDS.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2018, 2021 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2011-2012
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Check for krb5-config in the user's path and set PATH_KRB5_CONFIG.  This
+dnl is moved into a separate macro so that it can be loaded via AC_REQUIRE,
+dnl meaning it will only be run once even if we link with multiple krb5-config
+dnl libraries.
+AC_DEFUN([_RRA_KRB5_CONFIG_PATH],
+[AC_ARG_VAR([PATH_KRB5_CONFIG], [Path to krb5-config])
+ AC_PATH_PROG([PATH_KRB5_CONFIG], [krb5-config], [],
+    [${PATH}:/usr/kerberos/bin])])
+
+dnl Check whether the --deps flag is supported by krb5-config.  Takes the path
+dnl to krb5-config to use.  Note that this path is not embedded in the cache
+dnl variable, so this macro implicitly assumes that we will always use the
+dnl same krb5-config program.
+AC_DEFUN([_RRA_KRB5_CONFIG_DEPS],
+[AC_REQUIRE([_RRA_KRB5_CONFIG_PATH])
+ AC_CACHE_CHECK([for --deps support in krb5-config],
+    [rra_cv_krb5_config_deps],
+    [AS_IF(["$1" 2>&1 | grep deps >/dev/null 2>&1],
+        [rra_cv_krb5_config_deps=yes],
+        [rra_cv_krb5_config_deps=no])])])
+
+dnl Obtain the library flags for a particular library using krb5-config.
+dnl Takes the path to the krb5-config program to use, the argument to
+dnl krb5-config to use, and the variable prefix under which to store the
+dnl library flags.
+AC_DEFUN([_RRA_KRB5_CONFIG_LIBS],
+[AC_REQUIRE([_RRA_KRB5_CONFIG_PATH])
+ AC_REQUIRE([RRA_ENABLE_REDUCED_DEPENDS])
+ _RRA_KRB5_CONFIG_DEPS([$1])
+ AS_IF([test x"$rra_reduced_depends" = xfalse \
+        && test x"$rra_cv_krb5_config_deps" = xyes],
+    [$3[]_LIBS=`"$1" --deps --libs $2 2>/dev/null`],
+    [$3[]_LIBS=`"$1" --libs $2 2>/dev/null`])])
+
+dnl Attempt to find the flags for a library using krb5-config.  Takes the
+dnl following arguments (in order):
+dnl
+dnl 1. The root directory for the library in question, generally from an
+dnl    Autoconf --with flag.  Used by preference as the path to krb5-config.
+dnl
+dnl 2. The argument to krb5-config to retrieve flags for this particular
+dnl    library.
+dnl
+dnl 3. The variable prefix to use when setting CPPFLAGS and LIBS variables
+dnl    based on the result of krb5-config.
+dnl
+dnl 4. Further actions to take if krb5-config was found and supported that
+dnl    library type.
+dnl
+dnl 5. Further actions to take if krb5-config could not be used to get flags
+dnl    for that library type.
+dnl
+dnl Special-case a krb5-config argument of krb5 and run krb5-config without an
+dnl argument if that option was requested and not supported.  Old versions of
+dnl krb5-config didn't take an argument to specify the library type, but
+dnl always returned the flags for libkrb5.
+AC_DEFUN([RRA_KRB5_CONFIG],
+[rra_krb5_config_$3=
+ rra_krb5_config_$3[]_ok=
+ AS_IF([test x"$1" != x && test -x "$1/bin/krb5-config"],
+    [rra_krb5_config_$3="$1/bin/krb5-config"],
+    [_RRA_KRB5_CONFIG_PATH
+     rra_krb5_config_$3="$PATH_KRB5_CONFIG"])
+ AS_IF([test x"$rra_krb5_config_$3" != x && test -x "$rra_krb5_config_$3"],
+    [AC_CACHE_CHECK([for $2 support in krb5-config], [rra_cv_lib_$3[]_config],
+         [AS_IF(["$rra_krb5_config_$3" 2>&1 | grep $2 >/dev/null 2>&1],
+             [rra_cv_lib_$3[]_config=yes],
+             [rra_cv_lib_$3[]_config=no])])
+     AS_IF([test "$rra_cv_lib_$3[]_config" = yes],
+        [$3[]_CPPFLAGS=`"$rra_krb5_config_$3" --cflags $2 2>/dev/null`
+         _RRA_KRB5_CONFIG_LIBS([$rra_krb5_config_$3], [$2], [$3])
+         rra_krb5_config_$3[]_ok=yes],
+        [AS_IF([test x"$2" = xkrb5],
+            [$3[]_CPPFLAGS=`"$rra_krb5_config_$3" --cflags 2>/dev/null`
+             $3[]_LIBS=`"$rra_krb5_config_$3" --libs $2 2>/dev/null`
+             rra_krb5_config_$3[]_ok=yes])])])
+ AS_IF([test x"$rra_krb5_config_$3[]_ok" = xyes],
+    [$3[]_CPPFLAGS=`AS_ECHO(["$$3[]_CPPFLAGS"]) | sed 's%-I/usr/include %%'`
+     $3[]_CPPFLAGS=`AS_ECHO(["$$3[]_CPPFLAGS"]) | sed 's%-I/usr/include$%%'`
+     $4],
+    [$5])])
diff --git a/m4/krb5-pkinit.m4 b/m4/krb5-pkinit.m4
new file mode 100644
index 000000000000..5575817e6a1f
--- /dev/null
+++ b/m4/krb5-pkinit.m4
@@ -0,0 +1,47 @@
+dnl Additional probes for Kerberos PKINIT support.
+dnl
+dnl Additional Kerberos library probes that check behavior of the library
+dnl relevant to PKINIT support.  Provides the macro:
+dnl
+dnl     RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_ARGS
+dnl
+dnl and defines HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_9_ARGS if it takes
+dnl only nine arguments.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2007, 2018, 2020-2021 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2011
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Source used by RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_ARGS.
+AC_DEFUN([_RRA_FUNC_KRB5_PKINIT_ARGS_SOURCE], [RRA_INCLUDES_KRB5] [[
+int
+main(void)
+{
+    krb5_context c;
+    krb5_get_init_creds_opt *o;
+    krb5_principal p;
+
+    krb5_get_init_creds_opt_set_pkinit(c, o, p, NULL, NULL, 0, NULL, NULL,
+                                       NULL);
+}
+]])
+
+dnl Check whether krb5_get_init_creds_opt_set_pkinit takes eleven arguments
+dnl (0.8 release candidates and later) or only nine (0.7).  Defines
+dnl HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_9_ARGS if it takes nine arguments.
+AC_DEFUN([RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_ARGS],
+[AC_CACHE_CHECK([if krb5_get_init_creds_opt_set_pkinit takes 9 arguments],
+    [rra_cv_func_krb5_get_init_creds_opt_set_pkinit_args],
+    [AC_COMPILE_IFELSE([AC_LANG_SOURCE([_RRA_FUNC_KRB5_PKINIT_ARGS_SOURCE])],
+        [rra_cv_func_krb5_get_init_creds_opt_set_pkinit_args=yes],
+        [rra_cv_func_krb5_get_init_creds_opt_set_pkinit_args=no])])
+AS_IF([test $rra_cv_func_krb5_get_init_creds_opt_set_pkinit_args = yes],
+    [AC_DEFINE([HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_9_ARGS], 1,
+        [Define if krb5_get_init_creds_opt_set_pkinit takes 9 arguments.])])])
diff --git a/m4/krb5.m4 b/m4/krb5.m4
new file mode 100644
index 000000000000..e6ec1bb09fa5
--- /dev/null
+++ b/m4/krb5.m4
@@ -0,0 +1,384 @@
+dnl Find the compiler and linker flags for Kerberos.
+dnl
+dnl Finds the compiler and linker flags for linking with Kerberos libraries.
+dnl Provides the --with-krb5, --with-krb5-include, and --with-krb5-lib
+dnl configure options to specify non-standard paths to the Kerberos libraries.
+dnl Uses krb5-config where available unless reduced dependencies is requested
+dnl or --with-krb5-include or --with-krb5-lib are given.
+dnl
+dnl Provides the macro RRA_LIB_KRB5 and sets the substitution variables
+dnl KRB5_CPPFLAGS, KRB5_LDFLAGS, and KRB5_LIBS.  Also provides
+dnl RRA_LIB_KRB5_SWITCH to set CPPFLAGS, LDFLAGS, and LIBS to include the
+dnl Kerberos libraries, saving the current values first, and
+dnl RRA_LIB_KRB5_RESTORE to restore those settings to before the last
+dnl RRA_LIB_KRB5_SWITCH.  HAVE_KRB5 will always be defined if RRA_LIB_KRB5 is
+dnl used.
+dnl
+dnl If KRB5_CPPFLAGS, KRB5_LDFLAGS, or KRB5_LIBS are set before calling these
+dnl macros, their values will be added to whatever the macros discover.
+dnl
+dnl KRB5_CPPFLAGS_WARNINGS will be set to the same value as KRB5_CPPFLAGS but
+dnl with any occurrences of -I changed to -isystem.  This may be useful to
+dnl suppress warnings from the Kerberos header files when building with and
+dnl aggressive warning flags.  Be aware that this change will change the
+dnl compiler header file search order as well.
+dnl
+dnl Provides the RRA_LIB_KRB5_OPTIONAL macro, which should be used if Kerberos
+dnl support is optional.  In this case, Kerberos libraries are mandatory if
+dnl --with-krb5 is given, and will not be probed for if --without-krb5 is
+dnl given.  Otherwise, they'll be probed for but will not be required.
+dnl Defines HAVE_KRB5 and sets rra_use_KRB5 to true if the libraries are
+dnl found.  The substitution variables will always be set, but they will be
+dnl empty unless Kerberos libraries are found and the user did not disable
+dnl Kerberos support.
+dnl
+dnl Sets the Automake conditional KRB5_USES_COM_ERR saying whether we use
+dnl com_err, since if we're also linking with AFS libraries, we may have to
+dnl change library ordering in that case.
+dnl
+dnl Depends on RRA_KRB5_CONFIG, RRA_ENABLE_REDUCED_DEPENDS, and
+dnl RRA_SET_LDFLAGS.
+dnl
+dnl Also provides RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS, which checks
+dnl whether krb5_get_init_creds_opt_free takes one argument or two.  Defines
+dnl HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS if it takes two arguments.
+dnl
+dnl Also provides RRA_INCLUDES_KRB5, which are the headers to include when
+dnl probing the Kerberos library properties.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2018, 2020-2021 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2005-2011, 2013-2014
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Headers to include when probing for Kerberos library properties.
+AC_DEFUN([RRA_INCLUDES_KRB5], [[
+#if HAVE_KRB5_H
+# include <krb5.h>
+#elif HAVE_KERBEROSV5_KRB5_H
+# include <kerberosv5/krb5.h>
+#else
+# include <krb5/krb5.h>
+#endif
+]])
+
+dnl Save the current CPPFLAGS, LDFLAGS, and LIBS settings and switch to
+dnl versions that include the Kerberos flags.  Used as a wrapper, with
+dnl RRA_LIB_KRB5_RESTORE, around tests.
+AC_DEFUN([RRA_LIB_KRB5_SWITCH],
+[rra_krb5_save_CPPFLAGS="$CPPFLAGS"
+ rra_krb5_save_LDFLAGS="$LDFLAGS"
+ rra_krb5_save_LIBS="$LIBS"
+ CPPFLAGS="$KRB5_CPPFLAGS $CPPFLAGS"
+ LDFLAGS="$KRB5_LDFLAGS $LDFLAGS"
+ LIBS="$KRB5_LIBS $LIBS"])
+
+dnl Restore CPPFLAGS, LDFLAGS, and LIBS to their previous values (before
+dnl RRA_LIB_KRB5_SWITCH was called).
+AC_DEFUN([RRA_LIB_KRB5_RESTORE],
+[CPPFLAGS="$rra_krb5_save_CPPFLAGS"
+ LDFLAGS="$rra_krb5_save_LDFLAGS"
+ LIBS="$rra_krb5_save_LIBS"])
+
+dnl Set KRB5_CPPFLAGS and KRB5_LDFLAGS based on rra_krb5_root,
+dnl rra_krb5_libdir, and rra_krb5_includedir.
+AC_DEFUN([_RRA_LIB_KRB5_PATHS],
+[AS_IF([test x"$rra_krb5_libdir" != x],
+    [KRB5_LDFLAGS="-L$rra_krb5_libdir"],
+    [AS_IF([test x"$rra_krb5_root" != x],
+        [RRA_SET_LDFLAGS([KRB5_LDFLAGS], [$rra_krb5_root])])])
+ AS_IF([test x"$rra_krb5_includedir" != x],
+    [KRB5_CPPFLAGS="-I$rra_krb5_includedir"],
+    [AS_IF([test x"$rra_krb5_root" != x],
+        [AS_IF([test x"$rra_krb5_root" != x/usr],
+            [KRB5_CPPFLAGS="-I${rra_krb5_root}/include"])])])])
+
+dnl Check for a header using a file existence check rather than using
+dnl AC_CHECK_HEADERS.  This is used if there were arguments to configure
+dnl specifying the Kerberos header path, since we may have one header in the
+dnl default include path and another under our explicitly-configured Kerberos
+dnl location.  The second argument is run if the header was found.
+AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER],
+[AC_MSG_CHECKING([for $1])
+ AS_IF([test -f "${rra_krb5_incroot}/$1"],
+    [AC_DEFINE_UNQUOTED(AS_TR_CPP([HAVE_$1]), [1],
+        [Define to 1 if you have the <$1> header file.])
+     AC_MSG_RESULT([yes])
+     $2],
+    [AC_MSG_RESULT([no])])])
+
+dnl Check for the com_err header.  Internal helper macro since we need
+dnl to do the same checks in multiple places.
+AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR],
+[AS_IF([test x"$rra_krb5_incroot" = x],
+    [AC_CHECK_HEADERS([et/com_err.h kerberosv5/com_err.h])],
+        [_RRA_LIB_KRB5_CHECK_HEADER([et/com_err.h])
+         _RRA_LIB_KRB5_CHECK_HEADER([kerberosv5/com_err.h])])])
+
+dnl Check for the main Kerberos header.  Internal helper macro since we need
+dnl to do the same checks in multiple places.  The first argument is run if
+dnl some header was found, and the second if no header was found.
+dnl header could not be found.
+AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER_KRB5],
+[rra_krb5_found_header=
+ AS_IF([test x"$rra_krb5_incroot" = x],
+     [AC_CHECK_HEADERS([krb5.h kerberosv5/krb5.h krb5/krb5.h],
+         [rra_krb5_found_header=true])],
+     [_RRA_LIB_KRB5_CHECK_HEADER([krb5.h],
+         [rra_krb5_found_header=true])
+      _RRA_LIB_KRB5_CHECK_HEADER([kerberosv5/krb5.h],
+         [rra_krb5_found_header=true])
+      _RRA_LIB_KRB5_CHECK_HEADER([krb5/krb5.h],
+         [rra_krb5_found_header=true])])
+ AS_IF([test x"$rra_krb5_found_header" = xtrue], [$1], [$2])])
+
+dnl Does the appropriate library checks for reduced-dependency Kerberos
+dnl linkage.  The single argument, if true, says to fail if Kerberos could not
+dnl be found.
+AC_DEFUN([_RRA_LIB_KRB5_REDUCED],
+[RRA_LIB_KRB5_SWITCH
+ AC_CHECK_LIB([krb5], [krb5_init_context],
+    [KRB5_LIBS="-lkrb5"
+     LIBS="$KRB5_LIBS $LIBS"
+     AC_CHECK_FUNCS([krb5_get_error_message],
+        [AC_CHECK_FUNCS([krb5_free_error_message])],
+        [AC_CHECK_FUNCS([krb5_get_error_string], [],
+            [AC_CHECK_FUNCS([krb5_get_err_txt], [],
+                [AC_CHECK_LIB([ksvc], [krb5_svc_get_msg],
+                    [KRB5_LIBS="$KRB5_LIBS -lksvc"
+                     AC_DEFINE([HAVE_KRB5_SVC_GET_MSG], [1])
+                     AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
+                        [RRA_INCLUDES_KRB5])],
+                    [AC_CHECK_LIB([com_err], [com_err],
+                        [KRB5_LIBS="$KRB5_LIBS -lcom_err"],
+                        [AS_IF([test x"$1" = xtrue],
+                            [AC_MSG_ERROR([cannot find usable com_err library])],
+                            [KRB5_LIBS=""])])
+                     _RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
+     _RRA_LIB_KRB5_CHECK_HEADER_KRB5([],
+        [KRB5_CPPFLAGS=
+         KRB5_LIBS=
+         AS_IF([test x"$1" = xtrue],
+            [AC_MSG_ERROR([cannot find usable Kerberos header])])])],
+    [AS_IF([test x"$1" = xtrue],
+        [AC_MSG_ERROR([cannot find usable Kerberos library])])])
+ RRA_LIB_KRB5_RESTORE])
+
+dnl Does the appropriate library checks for Kerberos linkage when we don't
+dnl have krb5-config or reduced dependencies.  The single argument, if true,
+dnl says to fail if Kerberos could not be found.
+AC_DEFUN([_RRA_LIB_KRB5_MANUAL],
+[RRA_LIB_KRB5_SWITCH
+ rra_krb5_extra=
+ LIBS=
+ AC_SEARCH_LIBS([res_search], [resolv], [],
+    [AC_SEARCH_LIBS([__res_search], [resolv])])
+ AC_SEARCH_LIBS([gethostbyname], [nsl])
+ AC_SEARCH_LIBS([socket], [socket], [],
+    [AC_CHECK_LIB([nsl], [socket], [LIBS="-lnsl -lsocket $LIBS"], [],
+        [-lsocket])])
+ AC_SEARCH_LIBS([crypt], [crypt])
+ AC_SEARCH_LIBS([roken_concat], [roken])
+ rra_krb5_extra="$LIBS"
+ LIBS="$rra_krb5_save_LIBS"
+ AC_CHECK_LIB([krb5], [krb5_init_context],
+    [KRB5_LIBS="-lkrb5 -lasn1 -lcom_err -lcrypto $rra_krb5_extra"],
+    [AC_CHECK_LIB([krb5support], [krb5int_getspecific],
+        [rra_krb5_extra="-lkrb5support $rra_krb5_extra"],
+        [AC_CHECK_LIB([pthreads], [pthread_setspecific],
+            [rra_krb5_pthread="-lpthreads"],
+            [AC_CHECK_LIB([pthread], [pthread_setspecific],
+                [rra_krb5_pthread="-lpthread"])])
+         AC_CHECK_LIB([krb5support], [krb5int_setspecific],
+            [rra_krb5_extra="-lkrb5support $rra_krb5_extra $rra_krb5_pthread"],
+            [], [$rra_krb5_pthread $rra_krb5_extra])],
+        [$rra_krb5_extra])
+     AC_CHECK_LIB([com_err], [error_message],
+        [rra_krb5_extra="-lcom_err $rra_krb5_extra"], [], [$rra_krb5_extra])
+     AC_CHECK_LIB([ksvc], [krb5_svc_get_msg],
+        [rra_krb5_extra="-lksvc $rra_krb5_extra"], [], [$rra_krb5_extra])
+     AC_CHECK_LIB([k5crypto], [krb5int_hash_md5],
+        [rra_krb5_extra="-lk5crypto $rra_krb5_extra"], [], [$rra_krb5_extra])
+     AC_CHECK_LIB([k5profile], [profile_get_values],
+        [rra_krb5_extra="-lk5profile $rra_krb5_extra"], [], [$rra_krb5_extra])
+     AC_CHECK_LIB([krb5], [krb5_cc_default],
+        [KRB5_LIBS="-lkrb5 $rra_krb5_extra"],
+        [AS_IF([test x"$1" = xtrue],
+            [AC_MSG_ERROR([cannot find usable Kerberos library])])],
+        [$rra_krb5_extra])],
+    [-lasn1 -lcom_err -lcrypto $rra_krb5_extra])
+ LIBS="$KRB5_LIBS $LIBS"
+ AC_CHECK_FUNCS([krb5_get_error_message],
+     [AC_CHECK_FUNCS([krb5_free_error_message])],
+     [AC_CHECK_FUNCS([krb5_get_error_string], [],
+         [AC_CHECK_FUNCS([krb5_get_err_txt], [],
+             [AC_CHECK_FUNCS([krb5_svc_get_msg],
+                 [AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
+                     [RRA_INCLUDES_KRB5])],
+                 [_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
+ _RRA_LIB_KRB5_CHECK_HEADER_KRB5([],
+    [KRB5_CPPFLAGS=
+     KRB5_LIBS=
+     AS_IF([test x"$1" = xtrue],
+        [AC_MSG_ERROR([cannot find usable Kerberos header])])])
+ RRA_LIB_KRB5_RESTORE])
+
+dnl Sanity-check the results of krb5-config and be sure we can really link a
+dnl Kerberos program.  If that fails, clear KRB5_CPPFLAGS and KRB5_LIBS so
+dnl that we know we don't have usable flags and fall back on the manual
+dnl check.
+AC_DEFUN([_RRA_LIB_KRB5_CHECK],
+[RRA_LIB_KRB5_SWITCH
+ AC_CHECK_FUNC([krb5_init_context],
+    [_RRA_LIB_KRB5_CHECK_HEADER_KRB5([RRA_LIB_KRB5_RESTORE],
+        [RRA_LIB_KRB5_RESTORE
+         KRB5_CPPFLAGS=
+         KRB5_LIBS=
+         _RRA_LIB_KRB5_PATHS
+         _RRA_LIB_KRB5_MANUAL([$1])])],
+    [RRA_LIB_KRB5_RESTORE
+     KRB5_CPPFLAGS=
+     KRB5_LIBS=
+     _RRA_LIB_KRB5_PATHS
+     _RRA_LIB_KRB5_MANUAL([$1])])])
+
+dnl Determine Kerberos compiler and linker flags from krb5-config.  Does the
+dnl additional probing we need to do to uncover error handling features, and
+dnl falls back on the manual checks.
+AC_DEFUN([_RRA_LIB_KRB5_CONFIG],
+[RRA_KRB5_CONFIG([${rra_krb5_root}], [krb5], [KRB5],
+    [_RRA_LIB_KRB5_CHECK([$1])
+     RRA_LIB_KRB5_SWITCH
+     AC_CHECK_FUNCS([krb5_get_error_message],
+         [AC_CHECK_FUNCS([krb5_free_error_message])],
+         [AC_CHECK_FUNCS([krb5_get_error_string], [],
+             [AC_CHECK_FUNCS([krb5_get_err_txt], [],
+                 [AC_CHECK_FUNCS([krb5_svc_get_msg],
+                     [AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
+                         [RRA_INCLUDES_KRB5])],
+                     [_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
+     RRA_LIB_KRB5_RESTORE],
+    [_RRA_LIB_KRB5_PATHS
+     _RRA_LIB_KRB5_MANUAL([$1])])])
+
+dnl The core of the library checking, shared between RRA_LIB_KRB5 and
+dnl RRA_LIB_KRB5_OPTIONAL.  The single argument, if "true", says to fail if
+dnl Kerberos could not be found.  Set up rra_krb5_incroot for later header
+dnl checking.
+AC_DEFUN([_RRA_LIB_KRB5_INTERNAL],
+[AC_REQUIRE([RRA_ENABLE_REDUCED_DEPENDS])
+ rra_krb5_incroot=
+ AC_SUBST([KRB5_CPPFLAGS])
+ AC_SUBST([KRB5_CPPFLAGS_WARNINGS])
+ AC_SUBST([KRB5_LDFLAGS])
+ AC_SUBST([KRB5_LIBS])
+ AS_IF([test x"$rra_krb5_includedir" != x],
+    [rra_krb5_incroot="$rra_krb5_includedir"],
+    [AS_IF([test x"$rra_krb5_root" != x],
+        [rra_krb5_incroot="${rra_krb5_root}/include"])])
+ AS_IF([test x"$rra_reduced_depends" = xtrue],
+    [_RRA_LIB_KRB5_PATHS
+     _RRA_LIB_KRB5_REDUCED([$1])],
+    [AS_IF([test x"$rra_krb5_includedir" = x && test x"$rra_krb5_libdir" = x],
+        [_RRA_LIB_KRB5_CONFIG([$1])],
+        [_RRA_LIB_KRB5_PATHS
+         _RRA_LIB_KRB5_MANUAL([$1])])])
+ rra_krb5_uses_com_err=false
+ AS_CASE([$KRB5_LIBS], [*-lcom_err*], [rra_krb5_uses_com_err=true])
+ AM_CONDITIONAL([KRB5_USES_COM_ERR],
+    [test x"$rra_krb5_uses_com_err" = xtrue])
+ KRB5_CPPFLAGS_WARNINGS=`AS_ECHO(["$KRB5_CPPFLAGS"]) | sed 's/-I/-isystem /g'`])
+
+dnl The main macro for packages with mandatory Kerberos support.
+AC_DEFUN([RRA_LIB_KRB5],
+[rra_krb5_root=
+ rra_krb5_libdir=
+ rra_krb5_includedir=
+ rra_use_KRB5=true
+
+ AC_ARG_WITH([krb5],
+    [AS_HELP_STRING([--with-krb5=DIR],
+        [Location of Kerberos headers and libraries])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_krb5_root="$withval"])])
+ AC_ARG_WITH([krb5-include],
+    [AS_HELP_STRING([--with-krb5-include=DIR],
+        [Location of Kerberos headers])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_krb5_includedir="$withval"])])
+ AC_ARG_WITH([krb5-lib],
+    [AS_HELP_STRING([--with-krb5-lib=DIR],
+        [Location of Kerberos libraries])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_krb5_libdir="$withval"])])
+ _RRA_LIB_KRB5_INTERNAL([true])
+ AC_DEFINE([HAVE_KRB5], 1, [Define to enable Kerberos features.])])
+
+dnl The main macro for packages with optional Kerberos support.
+AC_DEFUN([RRA_LIB_KRB5_OPTIONAL],
+[rra_krb5_root=
+ rra_krb5_libdir=
+ rra_krb5_includedir=
+ rra_use_KRB5=
+
+ AC_ARG_WITH([krb5],
+    [AS_HELP_STRING([--with-krb5@<:@=DIR@:>@],
+        [Location of Kerberos headers and libraries])],
+    [AS_IF([test x"$withval" = xno],
+        [rra_use_KRB5=false],
+        [AS_IF([test x"$withval" != xyes], [rra_krb5_root="$withval"])
+         rra_use_KRB5=true])])
+ AC_ARG_WITH([krb5-include],
+    [AS_HELP_STRING([--with-krb5-include=DIR],
+        [Location of Kerberos headers])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_krb5_includedir="$withval"])])
+ AC_ARG_WITH([krb5-lib],
+    [AS_HELP_STRING([--with-krb5-lib=DIR],
+        [Location of Kerberos libraries])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_krb5_libdir="$withval"])])
+
+ AS_IF([test x"$rra_use_KRB5" != xfalse],
+     [AS_IF([test x"$rra_use_KRB5" = xtrue],
+         [_RRA_LIB_KRB5_INTERNAL([true])],
+         [_RRA_LIB_KRB5_INTERNAL([false])])],
+     [AM_CONDITIONAL([KRB5_USES_COM_ERR], [false])])
+ AS_IF([test x"$KRB5_LIBS" != x],
+    [rra_use_KRB5=true
+     AC_DEFINE([HAVE_KRB5], 1, [Define to enable Kerberos features.])])])
+
+dnl Source used by RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS.
+AC_DEFUN([_RRA_FUNC_KRB5_OPT_FREE_ARGS_SOURCE], [RRA_INCLUDES_KRB5] [[
+int
+main(void)
+{
+    krb5_get_init_creds_opt *opts;
+    krb5_context c;
+    krb5_get_init_creds_opt_free(c, opts);
+}
+]])
+
+dnl Check whether krb5_get_init_creds_opt_free takes one argument or two.
+dnl Early Heimdal used to take a single argument.  Defines
+dnl HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS if it takes two arguments.
+dnl
+dnl Should be called with RRA_LIB_KRB5_SWITCH active.
+AC_DEFUN([RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS],
+[AC_CACHE_CHECK([if krb5_get_init_creds_opt_free takes two arguments],
+    [rra_cv_func_krb5_get_init_creds_opt_free_args],
+    [AC_COMPILE_IFELSE([AC_LANG_SOURCE([_RRA_FUNC_KRB5_OPT_FREE_ARGS_SOURCE])],
+        [rra_cv_func_krb5_get_init_creds_opt_free_args=yes],
+        [rra_cv_func_krb5_get_init_creds_opt_free_args=no])])
+ AS_IF([test $rra_cv_func_krb5_get_init_creds_opt_free_args = yes],
+    [AC_DEFINE([HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS], 1,
+        [Define if krb5_get_init_creds_opt_free takes two arguments.])])])
diff --git a/m4/ld-version.m4 b/m4/ld-version.m4
new file mode 100644
index 000000000000..f94347f41a30
--- /dev/null
+++ b/m4/ld-version.m4
@@ -0,0 +1,40 @@
+dnl Check whether the linker supports --version-script.
+dnl
+dnl Probes whether the linker supports --version-script with a simple version
+dnl script that only defines a single version.  Sets the Automake conditional
+dnl HAVE_LD_VERSION_SCRIPT based on whether it is supported.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Based on the gnulib ld-version-script macro from Simon Josefsson
+dnl Copyright 2010
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl Copyright 2008-2010 Free Software Foundation, Inc.
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+AC_DEFUN([RRA_LD_VERSION_SCRIPT],
+[AC_CACHE_CHECK([if -Wl,--version-script works], [rra_cv_ld_version_script],
+    [save_LDFLAGS="$LDFLAGS"
+     LDFLAGS="$LDFLAGS -Wl,--version-script=conftest.map"
+     cat > conftest.map <<EOF
+VERSION_1 {
+    global:
+        sym;
+
+    local:
+        *;
+};
+EOF
+     AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])],
+        [rra_cv_ld_version_script=yes], [rra_cv_ld_version_script=no])
+     rm -f conftest.map
+     LDFLAGS="$save_LDFLAGS"])
+ AM_CONDITIONAL([HAVE_LD_VERSION_SCRIPT],
+    [test x"$rra_cv_ld_version_script" = xyes])])
diff --git a/m4/lib-depends.m4 b/m4/lib-depends.m4
new file mode 100644
index 000000000000..09a2cf9f0737
--- /dev/null
+++ b/m4/lib-depends.m4
@@ -0,0 +1,30 @@
+dnl Provides option to change library probes.
+dnl
+dnl This file provides RRA_ENABLE_REDUCED_DEPENDS, which adds the configure
+dnl option --enable-reduced-depends to request that library probes assume
+dnl shared libraries are in use and dependencies of libraries should not be
+dnl probed.  If this option is given, the shell variable rra_reduced_depends
+dnl is set to true; otherwise, it is set to false.
+dnl
+dnl This macro doesn't do much but is defined separately so that other macros
+dnl can require it with AC_REQUIRE.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2005-2007
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+AC_DEFUN([RRA_ENABLE_REDUCED_DEPENDS],
+[rra_reduced_depends=false
+AC_ARG_ENABLE([reduced-depends],
+    [AS_HELP_STRING([--enable-reduced-depends],
+        [Try to minimize shared library dependencies])],
+    [AS_IF([test x"$enableval" = xyes], [rra_reduced_depends=true])])])
diff --git a/m4/lib-helper.m4 b/m4/lib-helper.m4
new file mode 100644
index 000000000000..481122b72a38
--- /dev/null
+++ b/m4/lib-helper.m4
@@ -0,0 +1,149 @@
+dnl Helper functions to manage compiler variables.
+dnl
+dnl These are a wide variety of helper macros to make it easier to construct
+dnl standard macros to probe for a library and to set library-specific
+dnl CPPFLAGS, LDFLAGS, and LIBS shell substitution variables.  Most of them
+dnl take as one of the arguments the prefix string to use for variables, which
+dnl is usually something like "KRB5" or "GSSAPI".
+dnl
+dnl Depends on RRA_SET_LDFLAGS.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2018 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2011, 2013
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Add the library flags to the default compiler flags and then remove them.
+dnl
+dnl To use these macros, pass the prefix string used for the variables as the
+dnl only argument.  For example, to use these for a library with KRB5 as a
+dnl prefix, one would use:
+dnl
+dnl     AC_DEFUN([RRA_LIB_KRB5_SWITCH], [RRA_LIB_HELPER_SWITCH([KRB5])])
+dnl     AC_DEFUN([RRA_LIB_KRB5_RESTORE], [RRA_LIB_HELPER_RESTORE([KRB5])])
+dnl
+dnl Then, wrap checks for library features with RRA_LIB_KRB5_SWITCH and
+dnl RRA_LIB_KRB5_RESTORE.
+AC_DEFUN([RRA_LIB_HELPER_SWITCH],
+[rra_$1[]_save_CPPFLAGS="$CPPFLAGS"
+ rra_$1[]_save_LDFLAGS="$LDFLAGS"
+ rra_$1[]_save_LIBS="$LIBS"
+ CPPFLAGS="$$1[]_CPPFLAGS $CPPFLAGS"
+ LDFLAGS="$$1[]_LDFLAGS $LDFLAGS"
+ LIBS="$$1[]_LIBS $LIBS"])
+
+AC_DEFUN([RRA_LIB_HELPER_RESTORE],
+[CPPFLAGS="$rra_$1[]_save_CPPFLAGS"
+ LDFLAGS="$rra_$1[]_save_LDFLAGS"
+ LIBS="$rra_$1[]_save_LIBS"])
+
+dnl Given _root, _libdir, and _includedir variables set for a library (set by
+dnl RRA_LIB_HELPER_WITH*), set the LDFLAGS and CPPFLAGS variables for that
+dnl library accordingly.  Takes the variable prefix as the only argument.
+AC_DEFUN([RRA_LIB_HELPER_PATHS],
+[AS_IF([test x"$rra_$1[]_libdir" != x],
+    [$1[]_LDFLAGS="-L$rra_$1[]_libdir"],
+    [AS_IF([test x"$rra_$1[]_root" != x],
+        [RRA_SET_LDFLAGS([$1][_LDFLAGS], [${rra_$1[]_root}])])])
+ AS_IF([test x"$rra_$1[]_includedir" != x],
+    [$1[]_CPPFLAGS="-I$rra_$1[]_includedir"],
+    [AS_IF([test x"$rra_$1[]_root" != x],
+        [AS_IF([test x"$rra_$1[]_root" != x/usr],
+            [$1[]_CPPFLAGS="-I${rra_$1[]_root}/include"])])])])
+
+dnl Check whether a library works.  This is used as a sanity check on the
+dnl results of *-config shell scripts.  Takes four arguments; the first, if
+dnl "true", says that a working library is mandatory and errors out if it
+dnl doesn't.  The second is the variable prefix.  The third is a function to
+dnl look for that should be in the libraries.  The fourth is the
+dnl human-readable name of the library for error messages.
+AC_DEFUN([RRA_LIB_HELPER_CHECK],
+[RRA_LIB_HELPER_SWITCH([$2])
+ AC_CHECK_FUNC([$3], [],
+    [AS_IF([test x"$1" = xtrue],
+        [AC_MSG_FAILURE([unable to link with $4 library])])
+     $2[]_CPPFLAGS=
+     $2[]_LDFLAGS=
+     $2[]_LIBS=])
+ RRA_LIB_HELPER_RESTORE([$2])])
+
+dnl Initialize the variables used by a library probe and set the appropriate
+dnl ones as substitution variables.  Takes the library variable prefix as its
+dnl only argument.
+AC_DEFUN([RRA_LIB_HELPER_VAR_INIT],
+[rra_$1[]_root=
+ rra_$1[]_libdir=
+ rra_$1[]_includedir=
+ rra_use_$1=
+ $1[]_CPPFLAGS=
+ $1[]_LDFLAGS=
+ $1[]_LIBS=
+ AC_SUBST([$1][_CPPFLAGS])
+ AC_SUBST([$1][_LDFLAGS])
+ AC_SUBST([$1][_LIBS])])
+
+dnl Unset all of the variables used by a library probe.  Used with the
+dnl _OPTIONAL versions of header probes when a header or library wasn't found
+dnl and therefore the library isn't usable.
+AC_DEFUN([RRA_LIB_HELPER_VAR_CLEAR],
+[$1[]_CPPFLAGS=
+ $1[]_LDFLAGS=
+ $1[]_LIBS=])
+
+dnl Handles --with options for a non-optional library.  First argument is the
+dnl base for the switch names.  Second argument is the short description.
+dnl Third argument is the variable prefix.  The variables set are used by
+dnl RRA_LIB_HELPER_PATHS.
+AC_DEFUN([RRA_LIB_HELPER_WITH],
+[AC_ARG_WITH([$1],
+    [AS_HELP_STRING([--with-][$1][=DIR],
+        [Location of $2 headers and libraries])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_$3[]_root="$withval"])])
+ AC_ARG_WITH([$1][-include],
+    [AS_HELP_STRING([--with-][$1][-include=DIR],
+        [Location of $2 headers])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_$3[]_includedir="$withval"])])
+ AC_ARG_WITH([$1][-lib],
+    [AS_HELP_STRING([--with-][$1][-lib=DIR],
+        [Location of $2 libraries])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_$3[]_libdir="$withval"])])])
+
+dnl Handles --with options for an optional library, so --with-<library> can
+dnl cause the checks to be skipped entirely or become mandatory.  Sets an
+dnl rra_use_PREFIX variable to true or false if the library is explicitly
+dnl enabled or disabled.
+dnl
+dnl First argument is the base for the switch names.  Second argument is the
+dnl short description.  Third argument is the variable prefix.
+dnl
+dnl The variables set are used by RRA_LIB_HELPER_PATHS.
+AC_DEFUN([RRA_LIB_HELPER_WITH_OPTIONAL],
+[AC_ARG_WITH([$1],
+    [AS_HELP_STRING([--with-][$1][@<:@=DIR@:>@],
+        [Location of $2 headers and libraries])],
+    [AS_IF([test x"$withval" = xno],
+        [rra_use_$3=false],
+        [AS_IF([test x"$withval" != xyes], [rra_$3[]_root="$withval"])
+         rra_use_$3=true])])
+ AC_ARG_WITH([$1][-include],
+    [AS_HELP_STRING([--with-][$1][-include=DIR],
+        [Location of $2 headers])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_$3[]_includedir="$withval"])])
+ AC_ARG_WITH([$1][-lib],
+    [AS_HELP_STRING([--with-][$1][-lib=DIR],
+        [Location of $2 libraries])],
+    [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
+        [rra_$3[]_libdir="$withval"])])])
diff --git a/m4/lib-pathname.m4 b/m4/lib-pathname.m4
new file mode 100644
index 000000000000..11f6cab0673d
--- /dev/null
+++ b/m4/lib-pathname.m4
@@ -0,0 +1,54 @@
+dnl Determine the library path name.
+dnl
+dnl Red Hat systems and some other Linux systems use lib64 and lib32 rather
+dnl than just lib in some circumstances.  This file provides an Autoconf
+dnl macro, RRA_SET_LDFLAGS, which given a variable, a prefix, and an optional
+dnl suffix, adds -Lprefix/lib, -Lprefix/lib32, or -Lprefix/lib64 to the
+dnl variable depending on which directories exist and the size of a long in
+dnl the compilation environment.  If a suffix is given, a slash and that
+dnl suffix will be appended, to allow for adding a subdirectory of the library
+dnl directory.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2021 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2008-2009
+dnl     The Board of Trustees of the Leland Stanford Junior University
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Probe for the alternate library name that we should attempt on this
+dnl architecture, given the size of an int, and set rra_lib_arch_name to that
+dnl name.  Separated out so that it can be AC_REQUIRE'd and not run multiple
+dnl times.
+dnl
+dnl There is an unfortunate abstraction violation here where we assume we know
+dnl the cache variable name used by Autoconf.  Unfortunately, Autoconf doesn't
+dnl provide any other way of getting at that information in shell that I can
+dnl see.
+AC_DEFUN([_RRA_LIB_ARCH_NAME],
+[rra_lib_arch_name=lib
+ AC_CHECK_SIZEOF([long])
+ AS_IF([test "$ac_cv_sizeof_long" -eq 4],
+     [rra_lib_arch_name=lib32],
+     [AS_IF([test "$ac_cv_sizeof_long" -eq 8],
+         [rra_lib_arch_name=lib64])])])
+
+dnl Set VARIABLE to -LPREFIX/lib{,32,64} or -LPREFIX/lib{,32,64}/SUFFIX as
+dnl appropriate.
+AC_DEFUN([RRA_SET_LDFLAGS],
+[AC_REQUIRE([_RRA_LIB_ARCH_NAME])
+ AS_IF([test -d "$2/$rra_lib_arch_name"],
+    [AS_IF([test x"$3" = x],
+        [$1="[$]$1 -L$2/${rra_lib_arch_name}"],
+        [$1="[$]$1 -L$2/${rra_lib_arch_name}/$3"])],
+    [AS_IF([test x"$3" = x],
+        [$1="[$]$1 -L$2/lib"],
+        [$1="[$]$1 -L$2/lib/$3"])])
+ $1=`AS_ECHO(["[$]$1"]) | sed -e 's/^ *//'`])
diff --git a/m4/pam-const.m4 b/m4/pam-const.m4
new file mode 100644
index 000000000000..3423d1a60d3f
--- /dev/null
+++ b/m4/pam-const.m4
@@ -0,0 +1,53 @@
+dnl Determine whether PAM uses const in prototypes.
+dnl
+dnl Linux marks several PAM arguments const, including the argument to
+dnl pam_get_item and some arguments to conversation functions, which Solaris
+dnl doesn't.  Mac OS X, OS X, and macOS mark the first argument to
+dnl pam_strerror const, and other platforms don't.  This test tries to
+dnl determine which style is in use to select whether to declare variables
+dnl const and how to prototype functions in order to avoid compiler warnings.
+dnl
+dnl Since this is just for compiler warnings, it's not horribly important if
+dnl we guess wrong.  This test is ugly, but it seems to work.
+dnl
+dnl The canonical version of this file is maintained in the rra-c-util
+dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+dnl
+dnl Written by Markus Moeller
+dnl Copyright 2007, 2015 Russ Allbery <eagle@eyrie.org>
+dnl Copyright 2007-2008 Markus Moeller
+dnl
+dnl This file is free software; the authors give unlimited permission to copy
+dnl and/or distribute it, with or without modifications, as long as this
+dnl notice is preserved.
+dnl
+dnl SPDX-License-Identifier: FSFULLR
+
+dnl Source used by RRA_HEADER_PAM_CONST.
+AC_DEFUN([_RRA_HEADER_PAM_CONST_SOURCE],
+[#ifdef HAVE_SECURITY_PAM_APPL_H
+# include <security/pam_appl.h>
+#else
+# include <pam/pam_appl.h>
+#endif
+])
+
+AC_DEFUN([RRA_HEADER_PAM_CONST],
+[AC_CACHE_CHECK([whether PAM prefers const], [rra_cv_header_pam_const],
+    [AC_EGREP_CPP([const void \*\* *_?item], _RRA_HEADER_PAM_CONST_SOURCE(),
+        [rra_cv_header_pam_const=yes], [rra_cv_header_pam_const=no])])
+ AS_IF([test x"$rra_cv_header_pam_const" = xyes],
+    [rra_header_pam_const=const], [rra_header_pam_const=])
+ AC_DEFINE_UNQUOTED([PAM_CONST], [$rra_header_pam_const],
+    [Define to const if PAM uses const in pam_get_item, empty otherwise.])])
+
+AC_DEFUN([RRA_HEADER_PAM_STRERROR_CONST],
+[AC_CACHE_CHECK([whether pam_strerror uses const],
+    [rra_cv_header_pam_strerror_const],
+    [AC_EGREP_CPP([pam_strerror *\(const], _RRA_HEADER_PAM_CONST_SOURCE(),
+        [rra_cv_header_pam_strerror_const=yes],
+        [rra_cv_header_pam_strerror_const=no])])
+ AS_IF([test x"$rra_cv_header_pam_strerror_const" = xyes],
+    [rra_header_pam_strerror_const=const], [rra_header_pam_strerror_const=])
+ AC_DEFINE_UNQUOTED([PAM_STRERROR_CONST], [$rra_header_pam_strerror_const],
+    [Define to const if PAM uses const in pam_strerror, empty otherwise.])])
diff --git a/module/account.c b/module/account.c
new file mode 100644
index 000000000000..c270c9b97431
--- /dev/null
+++ b/module/account.c
@@ -0,0 +1,92 @@
+/*
+ * Implements the PAM authorization function (pam_acct_mgmt).
+ *
+ * We don't have much to do for account management, but we do recheck the
+ * user's authorization against .k5login (or whatever equivalent we've been
+ * configured for).
+ *
+ * Copyright 2005-2009, 2014, 2020-2021 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+/* Get prototypes for the account management functions. */
+#define PAM_SM_ACCOUNT
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Check the authorization of the user.  It's not entirely clear what this
+ * function is supposed to do, but rechecking .k5login and friends makes the
+ * most sense.
+ */
+int
+pamk5_account(struct pam_args *args)
+{
+    struct context *ctx;
+    int retval;
+    const char *name;
+
+    /* If the account was expired, here's where we actually fail. */
+    ctx = args->config->ctx;
+    if (ctx->expired) {
+        pam_syslog(args->pamh, LOG_INFO, "user %s account password is expired",
+                   ctx->name);
+        return PAM_NEW_AUTHTOK_REQD;
+    }
+
+    /*
+     * Re-retrieve the user rather than trusting our context; it's conceivable
+     * the application could have changed it.  We have to cast &name due to
+     * C's broken type system.
+     *
+     * Use pam_get_item rather than pam_get_user here since the user should be
+     * set by the time we get to this point.  If we would have to prompt for a
+     * user, something is definitely broken and we should fail.
+     */
+    retval = pam_get_item(args->pamh, PAM_USER, (PAM_CONST void **) &name);
+    if (retval != PAM_SUCCESS || name == NULL) {
+        putil_err_pam(args, retval, "unable to retrieve user");
+        return PAM_AUTH_ERR;
+    }
+    if (ctx->name != name) {
+        free(ctx->name);
+        ctx->name = strdup(name);
+        args->user = ctx->name;
+    }
+
+    /*
+     * If we have a ticket cache, then we can apply an additional bit of
+     * paranoia.  Rather than trusting princ in the context, extract the
+     * principal from the Kerberos ticket cache we actually received and then
+     * validate that.  This should make no difference in practice, but it's a
+     * bit more thorough.
+     */
+    if (ctx->cache != NULL) {
+        putil_debug(args, "retrieving principal from cache");
+        if (ctx->princ != NULL) {
+            krb5_free_principal(ctx->context, ctx->princ);
+            ctx->princ = NULL;
+        }
+        retval = krb5_cc_get_principal(ctx->context, ctx->cache, &ctx->princ);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "cannot get principal from cache");
+            return PAM_AUTH_ERR;
+        }
+    }
+    return pamk5_authorized(args);
+}
diff --git a/module/alt-auth.c b/module/alt-auth.c
new file mode 100644
index 000000000000..e5294bbceb7b
--- /dev/null
+++ b/module/alt-auth.c
@@ -0,0 +1,240 @@
+/*
+ * Support for alternate authentication mapping.
+ *
+ * pam-krb5 supports a feature where the principal for authentication can be
+ * set via a PAM option and possibly based on the authenticating user.  This
+ * can be used to, for example, require /root instances be used with sudo
+ * while still using normal instances for other system authentications.
+ *
+ * This file collects all the pieces related to that support.
+ *
+ * Original support written by Booker Bense <bbense@slac.stanford.edu>
+ * Further updates by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2008-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Map the user to a Kerberos principal according to alt_auth_map.  Returns 0
+ * on success, storing the mapped principal name in newly allocated memory in
+ * principal.  The caller is responsible for freeing.  Returns an errno value
+ * on any error.
+ */
+int
+pamk5_map_principal(struct pam_args *args, const char *username,
+                    char **principal)
+{
+    char *realm;
+    char *new_user = NULL;
+    const char *user;
+    const char *p;
+    size_t needed, offset;
+    int oerrno;
+
+    /* Makes no sense if alt_auth_map isn't set. */
+    if (args->config->alt_auth_map == NULL)
+        return EINVAL;
+
+    /* Need to split off the realm if it is present. */
+    realm = strchr(username, '@');
+    if (realm == NULL)
+        user = username;
+    else {
+        new_user = strdup(username);
+        if (new_user == NULL)
+            return errno;
+        realm = strchr(new_user, '@');
+        if (realm == NULL)
+            goto fail;
+        *realm = '\0';
+        realm++;
+        user = new_user;
+    }
+
+    /* Now, allocate a string and build the principal. */
+    needed = 0;
+    for (p = args->config->alt_auth_map; *p != '\0'; p++) {
+        if (p[0] == '%' && p[1] == 's') {
+            needed += strlen(user);
+            p++;
+        } else {
+            needed++;
+        }
+    }
+    if (realm != NULL && strchr(args->config->alt_auth_map, '@') == NULL)
+        needed += 1 + strlen(realm);
+    needed++;
+    *principal = malloc(needed);
+    if (*principal == NULL)
+        goto fail;
+    offset = 0;
+    for (p = args->config->alt_auth_map; *p != '\0'; p++) {
+        if (p[0] == '%' && p[1] == 's') {
+            memcpy(*principal + offset, user, strlen(user));
+            offset += strlen(user);
+            p++;
+        } else {
+            (*principal)[offset] = *p;
+            offset++;
+        }
+    }
+    if (realm != NULL && strchr(args->config->alt_auth_map, '@') == NULL) {
+        (*principal)[offset] = '@';
+        offset++;
+        memcpy(*principal + offset, realm, strlen(realm));
+        offset += strlen(realm);
+    }
+    (*principal)[offset] = '\0';
+    free(new_user);
+    return 0;
+
+fail:
+    if (new_user != NULL) {
+        oerrno = errno;
+        free(new_user);
+        errno = oerrno;
+    }
+    return errno;
+}
+
+
+/*
+ * Authenticate using an alternate principal mapping.
+ *
+ * Create a principal based on the principal mapping and the user, and use the
+ * provided password to try to authenticate as that user.  If we succeed, fill
+ * out creds, set princ to the successful principal in the context, and return
+ * 0.  Otherwise, return a Kerberos error code or an errno value.
+ */
+krb5_error_code
+pamk5_alt_auth(struct pam_args *args, const char *service,
+               krb5_get_init_creds_opt *opts, const char *pass,
+               krb5_creds *creds)
+{
+    struct context *ctx = args->config->ctx;
+    char *kuser;
+    krb5_principal princ;
+    krb5_error_code retval;
+
+    retval = pamk5_map_principal(args, ctx->name, &kuser);
+    if (retval != 0)
+        return retval;
+    retval = krb5_parse_name(ctx->context, kuser, &princ);
+    if (retval != 0) {
+        free(kuser);
+        return retval;
+    }
+    free(kuser);
+
+    /* Log the principal we're attempting to authenticate as. */
+    if (args->debug) {
+        char *principal;
+
+        retval = krb5_unparse_name(ctx->context, princ, &principal);
+        if (retval != 0)
+            putil_debug_krb5(args, retval, "krb5_unparse_name failed");
+        else {
+            putil_debug(args, "mapping %s to %s", ctx->name, principal);
+            krb5_free_unparsed_name(ctx->context, principal);
+        }
+    }
+
+    /*
+     * Now, attempt to authenticate as that user.  On success, save the
+     * principal.  Return the Kerberos status code.
+     */
+    retval = krb5_get_init_creds_password(ctx->context, creds, princ,
+                                          (char *) pass, pamk5_prompter_krb5,
+                                          args, 0, (char *) service, opts);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval, "alternate authentication failed");
+        krb5_free_principal(ctx->context, princ);
+        return retval;
+    } else {
+        putil_debug(args, "alternate authentication successful");
+        if (ctx->princ != NULL)
+            krb5_free_principal(ctx->context, ctx->princ);
+        ctx->princ = princ;
+        return 0;
+    }
+}
+
+
+/*
+ * Verify an alternate authentication.
+ *
+ * Meant to be called from pamk5_authorized, this checks that the principal in
+ * the context matches the alt_auth_map-derived identity of the user we're
+ * authenticating.  Returns PAM_SUCCESS if they match, PAM_AUTH_ERR if they
+ * don't match, and PAM_SERVICE_ERR on an internal error.
+ */
+int
+pamk5_alt_auth_verify(struct pam_args *args)
+{
+    struct context *ctx;
+    char *name = NULL;
+    char *mapped = NULL;
+    char *authed = NULL;
+    krb5_principal princ = NULL;
+    krb5_error_code retval;
+    int status = PAM_SERVICE_ERR;
+
+    if (args == NULL || args->config == NULL || args->config->ctx == NULL)
+        return PAM_SERVICE_ERR;
+    ctx = args->config->ctx;
+    if (ctx->context == NULL || ctx->name == NULL)
+        return PAM_SERVICE_ERR;
+    if (pamk5_map_principal(args, ctx->name, &name) != 0) {
+        putil_err(args, "cannot map principal name");
+        goto done;
+    }
+    retval = krb5_parse_name(ctx->context, name, &princ);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot parse mapped principal name %s",
+                       mapped);
+        goto done;
+    }
+    retval = krb5_unparse_name(ctx->context, princ, &mapped);
+    if (retval != 0) {
+        putil_err_krb5(args, retval,
+                       "krb5_unparse_name on mapped principal failed");
+        goto done;
+    }
+    retval = krb5_unparse_name(ctx->context, ctx->princ, &authed);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "krb5_unparse_name failed");
+        goto done;
+    }
+    if (strcmp(authed, mapped) == 0)
+        status = PAM_SUCCESS;
+    else {
+        putil_debug(args, "mapped user %s does not match principal %s", mapped,
+                    authed);
+        status = PAM_AUTH_ERR;
+    }
+
+done:
+    free(name);
+    if (authed != NULL)
+        krb5_free_unparsed_name(ctx->context, authed);
+    if (mapped != NULL)
+        krb5_free_unparsed_name(ctx->context, mapped);
+    if (princ != NULL)
+        krb5_free_principal(ctx->context, princ);
+    return status;
+}
diff --git a/module/auth.c b/module/auth.c
new file mode 100644
index 000000000000..065ce97b6596
--- /dev/null
+++ b/module/auth.c
@@ -0,0 +1,1135 @@
+/*
+ * Core authentication routines for pam_krb5.
+ *
+ * The actual authentication work is done here, either via password or via
+ * PKINIT.  The only external interface is pamk5_password_auth, which calls
+ * the appropriate internal functions.  This interface is used by both the
+ * authentication and the password groups.
+ *
+ * Copyright 2005-2010, 2014-2015, 2017, 2020
+ *     Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+#ifdef HAVE_HX509_ERR_H
+#    include <hx509_err.h>
+#endif
+#include <pwd.h>
+#include <sys/stat.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+#include <pam-util/vector.h>
+
+/*
+ * If the PKINIT smart card error statuses aren't defined, define them to 0.
+ * This will cause the right thing to happen with the logic around PKINIT.
+ */
+#ifndef HX509_PKCS11_NO_TOKEN
+#    define HX509_PKCS11_NO_TOKEN 0
+#endif
+#ifndef HX509_PKCS11_NO_SLOT
+#    define HX509_PKCS11_NO_SLOT 0
+#endif
+
+
+/*
+ * Fill in ctx->princ from the value of ctx->name or (if configured) from
+ * prompting.  If we don't prompt and ctx->name contains an @-sign,
+ * canonicalize it to a local account name unless no_update_user is set.  If
+ * the canonicalization fails, don't worry about it.  It may be that the
+ * application doesn't care.
+ */
+static krb5_error_code
+parse_name(struct pam_args *args)
+{
+    struct context *ctx = args->config->ctx;
+    krb5_context c = ctx->context;
+    char *user_realm;
+    char *user = ctx->name;
+    char *newuser = NULL;
+    char kuser[65] = ""; /* MAX_USERNAME == 65 (MIT Kerberos 1.4.1). */
+    krb5_error_code k5_errno;
+    int retval;
+
+    /*
+     * If configured to prompt for the principal, do that first.  Fall back on
+     * using the local username as normal if prompting fails or if the user
+     * just presses Enter.
+     */
+    if (args->config->prompt_principal) {
+        retval = pamk5_conv(args, "Principal: ", PAM_PROMPT_ECHO_ON, &user);
+        if (retval != PAM_SUCCESS)
+            putil_err_pam(args, retval, "error getting principal");
+        if (*user == '\0') {
+            free(user);
+            user = ctx->name;
+        }
+    }
+
+    /*
+     * We don't just call krb5_parse_name so that we can work around a bug in
+     * MIT Kerberos versions prior to 1.4, which store the realm in a static
+     * variable inside the library and don't notice changes.  If no realm is
+     * specified and a realm is set in our arguments, append the realm to
+     * force krb5_parse_name to do the right thing.
+     */
+    user_realm = args->realm;
+    if (args->config->user_realm)
+        user_realm = args->config->user_realm;
+    if (user_realm != NULL && strchr(user, '@') == NULL) {
+        if (asprintf(&newuser, "%s@%s", user, user_realm) < 0) {
+            if (user != ctx->name)
+                free(user);
+            return KRB5_CC_NOMEM;
+        }
+        if (user != ctx->name)
+            free(user);
+        user = newuser;
+    }
+    k5_errno = krb5_parse_name(c, user, &ctx->princ);
+    if (user != ctx->name)
+        free(user);
+    if (k5_errno != 0)
+        return k5_errno;
+
+    /*
+     * Now that we have a principal to call krb5_aname_to_localname, we can
+     * canonicalize ctx->name to a local name.  We do this even if we were
+     * explicitly prompting for a principal, but we use ctx->name to generate
+     * the local username, not the principal name.  It's unlikely, and would
+     * be rather weird, if the user were to specify a principal name for the
+     * username and then enter a different username at the principal prompt,
+     * but this behavior seems to make the most sense.
+     *
+     * Skip canonicalization if no_update_user was set.  In that case,
+     * continue to use the initial authentication identity everywhere.
+     */
+    if (strchr(ctx->name, '@') != NULL && !args->config->no_update_user) {
+        if (krb5_aname_to_localname(c, ctx->princ, sizeof(kuser), kuser) != 0)
+            return 0;
+        user = strdup(kuser);
+        if (user == NULL) {
+            putil_crit(args, "cannot allocate memory: %s", strerror(errno));
+            return 0;
+        }
+        free(ctx->name);
+        ctx->name = user;
+        args->user = user;
+    }
+    return k5_errno;
+}
+
+
+/*
+ * Set initial credential options based on our configuration information, and
+ * using the Heimdal call to set initial credential options if it's available.
+ * This function is used both for regular password authentication and for
+ * PKINIT.  It also configures FAST if requested and the Kerberos libraries
+ * support it.
+ *
+ * Takes a flag indicating whether we're getting tickets for a specific
+ * service.  If so, we don't try to get forwardable, renewable, or proxiable
+ * tickets.
+ */
+static void
+set_credential_options(struct pam_args *args, krb5_get_init_creds_opt *opts,
+                       int service)
+{
+    struct pam_config *config = args->config;
+    krb5_context c = config->ctx->context;
+
+    krb5_get_init_creds_opt_set_default_flags(c, "pam", args->realm, opts);
+    if (!service) {
+        if (config->forwardable)
+            krb5_get_init_creds_opt_set_forwardable(opts, 1);
+        if (config->ticket_lifetime != 0)
+            krb5_get_init_creds_opt_set_tkt_life(opts,
+                                                 config->ticket_lifetime);
+        if (config->renew_lifetime != 0)
+            krb5_get_init_creds_opt_set_renew_life(opts,
+                                                   config->renew_lifetime);
+        krb5_get_init_creds_opt_set_change_password_prompt(
+            opts, (config->defer_pwchange || config->fail_pwchange) ? 0 : 1);
+    } else {
+        krb5_get_init_creds_opt_set_forwardable(opts, 0);
+        krb5_get_init_creds_opt_set_proxiable(opts, 0);
+        krb5_get_init_creds_opt_set_renew_life(opts, 0);
+    }
+    pamk5_fast_setup(args, opts);
+
+    /*
+     * Set options for PKINIT.  Only used with MIT Kerberos; Heimdal's
+     * implementation of PKINIT uses a separate API instead of setting
+     * get_init_creds options.
+     */
+#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PA
+    if (config->use_pkinit || config->try_pkinit) {
+        if (config->pkinit_user != NULL)
+            krb5_get_init_creds_opt_set_pa(c, opts, "X509_user_identity",
+                                           config->pkinit_user);
+        if (config->pkinit_anchors != NULL)
+            krb5_get_init_creds_opt_set_pa(c, opts, "X509_anchors",
+                                           config->pkinit_anchors);
+        if (config->preauth_opt != NULL && config->preauth_opt->count > 0) {
+            size_t i;
+            char *name, *value;
+            char save = '\0';
+
+            for (i = 0; i < config->preauth_opt->count; i++) {
+                name = config->preauth_opt->strings[i];
+                if (name == NULL)
+                    continue;
+                value = strchr(name, '=');
+                if (value != NULL) {
+                    save = *value;
+                    *value = '\0';
+                    value++;
+                }
+                krb5_get_init_creds_opt_set_pa(
+                    c, opts, name, (value != NULL) ? value : "yes");
+                if (value != NULL)
+                    value[-1] = save;
+            }
+        }
+    }
+#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PA */
+}
+
+
+/*
+ * Retrieve the existing password (authtok) stored in the PAM data if
+ * appropriate and if available.  We decide whether to retrieve it based on
+ * the PAM configuration, and also decied whether failing to retrieve it is a
+ * fatal error.  Takes the PAM arguments, the PAM authtok code to retrieve
+ * (may be PAM_AUTHTOK or PAM_OLDAUTHTOK depending on whether we're
+ * authenticating or changing the password), and the place to store the
+ * password.  Returns a PAM status code.
+ *
+ * If try_first_pass, use_first_pass, or force_first_pass is set, grab the old
+ * password (if set).  If force_first_pass is set, fail if the password is not
+ * already set.
+ *
+ * The empty password has to be handled separately, since the Kerberos
+ * libraries may treat it as equivalent to no password and prompt when we
+ * don't want them to.  We make the assumption here that the empty password is
+ * always invalid and is an authentication failure.
+ */
+static int
+maybe_retrieve_password(struct pam_args *args, int authtok, const char **pass)
+{
+    int status;
+    const bool try_first = args->config->try_first_pass;
+    const bool use = args->config->use_first_pass;
+    const bool force = args->config->force_first_pass;
+
+    *pass = NULL;
+    if (!try_first && !use && !force)
+        return PAM_SUCCESS;
+    status = pam_get_item(args->pamh, authtok, (PAM_CONST void **) pass);
+    if (*pass != NULL && **pass == '\0') {
+        if (use || force) {
+            putil_debug(args, "rejecting empty password");
+            return PAM_AUTH_ERR;
+        }
+        *pass = NULL;
+    }
+    if (*pass != NULL && strlen(*pass) > PAM_MAX_RESP_SIZE - 1) {
+        putil_debug(args, "rejecting password longer than %d",
+                    PAM_MAX_RESP_SIZE - 1);
+        return PAM_AUTH_ERR;
+    }
+    if (force && (status != PAM_SUCCESS || *pass == NULL)) {
+        putil_debug_pam(args, status, "no stored password");
+        return PAM_AUTH_ERR;
+    }
+    return PAM_SUCCESS;
+}
+
+
+/*
+ * Prompt for the password.  Takes the PAM arguments, the authtok for which
+ * we're prompting (may be PAM_AUTHTOK or PAM_OLDAUTHTOK depending on whether
+ * we're authenticating or changing the password), and the place to store the
+ * password.  Returns a PAM status code.
+ *
+ * If we successfully get a password, store it in the PAM data, free it, and
+ * then return the password as retrieved from the PAM data so that we don't
+ * have to worry about memory allocation later.
+ *
+ * The empty password has to be handled separately, since the Kerberos
+ * libraries may treat it as equivalent to no password and prompt when we
+ * don't want them to.  We make the assumption here that the empty password is
+ * always invalid and is an authentication failure.
+ */
+static int
+prompt_password(struct pam_args *args, int authtok, const char **pass)
+{
+    char *password;
+    int status;
+    const char *prompt = (authtok == PAM_AUTHTOK) ? NULL : "Current";
+
+    *pass = NULL;
+    status = pamk5_get_password(args, prompt, &password);
+    if (status != PAM_SUCCESS) {
+        putil_debug_pam(args, status, "error getting password");
+        return PAM_AUTH_ERR;
+    }
+    if (password[0] == '\0') {
+        putil_debug(args, "rejecting empty password");
+        free(password);
+        return PAM_AUTH_ERR;
+    }
+    if (strlen(password) > PAM_MAX_RESP_SIZE - 1) {
+        putil_debug(args, "rejecting password longer than %d",
+                    PAM_MAX_RESP_SIZE - 1);
+        explicit_bzero(password, strlen(password));
+        free(password);
+        return PAM_AUTH_ERR;
+    }
+
+    /* Set this for the next PAM module. */
+    status = pam_set_item(args->pamh, authtok, password);
+    explicit_bzero(password, strlen(password));
+    free(password);
+    if (status != PAM_SUCCESS) {
+        putil_err_pam(args, status, "error storing password");
+        return PAM_AUTH_ERR;
+    }
+
+    /* Return the password retrieved from PAM. */
+    status = pam_get_item(args->pamh, authtok, (PAM_CONST void **) pass);
+    if (status != PAM_SUCCESS) {
+        putil_err_pam(args, status, "error retrieving password");
+        status = PAM_AUTH_ERR;
+    }
+    return status;
+}
+
+
+/*
+ * Authenticate via password.
+ *
+ * This is our basic authentication function.  Log what principal we're
+ * attempting to authenticate with and then attempt password authentication.
+ * Returns 0 on success or a Kerberos error on failure.
+ */
+static krb5_error_code
+password_auth(struct pam_args *args, krb5_creds *creds,
+              krb5_get_init_creds_opt *opts, const char *service,
+              const char *pass)
+{
+    struct context *ctx = args->config->ctx;
+    krb5_error_code retval;
+
+    /* Log the principal as which we're attempting authentication. */
+    if (args->debug) {
+        char *principal;
+
+        retval = krb5_unparse_name(ctx->context, ctx->princ, &principal);
+        if (retval != 0)
+            putil_debug_krb5(args, retval, "krb5_unparse_name failed");
+        else {
+            if (service == NULL)
+                putil_debug(args, "attempting authentication as %s",
+                            principal);
+            else
+                putil_debug(args, "attempting authentication as %s for %s",
+                            principal, service);
+            free(principal);
+        }
+    }
+
+    /* Do the authentication. */
+    retval = krb5_get_init_creds_password(ctx->context, creds, ctx->princ,
+                                          (char *) pass, pamk5_prompter_krb5,
+                                          args, 0, (char *) service, opts);
+
+    /*
+     * Heimdal may return an expired key error even if the password is
+     * incorrect.  To avoid accepting any incorrect password for the user
+     * in the fully correct password change case, confirm that we can get
+     * a password change ticket for the user using this password, and
+     * otherwise change the error to invalid password.
+     */
+    if (retval == KRB5KDC_ERR_KEY_EXP) {
+        krb5_get_init_creds_opt *heimdal_opts = NULL;
+
+        retval = krb5_get_init_creds_opt_alloc(ctx->context, &heimdal_opts);
+        if (retval == 0) {
+            set_credential_options(args, opts, 1);
+            retval = krb5_get_init_creds_password(
+                ctx->context, creds, ctx->princ, (char *) pass,
+                pamk5_prompter_krb5, args, 0, (char *) "kadmin/changepw",
+                heimdal_opts);
+            krb5_get_init_creds_opt_free(ctx->context, heimdal_opts);
+        }
+        if (retval == 0) {
+            retval = KRB5KDC_ERR_KEY_EXP;
+            krb5_free_cred_contents(ctx->context, creds);
+            explicit_bzero(creds, sizeof(krb5_creds));
+        }
+    }
+    return retval;
+}
+
+
+/*
+ * Authenticate by trying each principal in the .k5login file.
+ *
+ * Read through each line that parses correctly as a principal and use the
+ * provided password to try to authenticate as that user.  If at any point we
+ * succeed, fill out creds, set princ to the successful principal in the
+ * context, and return 0.  Otherwise, return either a Kerberos error code or
+ * errno for a system error.
+ */
+static krb5_error_code
+k5login_password_auth(struct pam_args *args, krb5_creds *creds,
+                      krb5_get_init_creds_opt *opts, const char *service,
+                      const char *pass)
+{
+    struct context *ctx = args->config->ctx;
+    char *filename = NULL;
+    char line[BUFSIZ];
+    size_t len;
+    FILE *k5login;
+    struct passwd *pwd;
+    struct stat st;
+    krb5_error_code k5_errno, retval;
+    krb5_principal princ;
+
+    /*
+     * C sucks at string manipulation.  Generate the filename for the user's
+     * .k5login file.  If the user doesn't exist, the .k5login file doesn't
+     * exist, or the .k5login file cannot be read, fall back on the easy way
+     * and assume ctx->princ is already set properly.
+     */
+    pwd = pam_modutil_getpwnam(args->pamh, ctx->name);
+    if (pwd != NULL)
+        if (asprintf(&filename, "%s/.k5login", pwd->pw_dir) < 0) {
+            putil_crit(args, "malloc failure: %s", strerror(errno));
+            return errno;
+        }
+    if (pwd == NULL || filename == NULL || access(filename, R_OK) != 0) {
+        free(filename);
+        return krb5_get_init_creds_password(ctx->context, creds, ctx->princ,
+                                            (char *) pass, pamk5_prompter_krb5,
+                                            args, 0, (char *) service, opts);
+    }
+
+    /*
+     * Make sure the ownership on .k5login is okay.  The user must own their
+     * own .k5login or it must be owned by root.  If that fails, set the
+     * Kerberos error code to errno.
+     */
+    k5login = fopen(filename, "r");
+    if (k5login == NULL) {
+        retval = errno;
+        free(filename);
+        return retval;
+    }
+    free(filename);
+    if (fstat(fileno(k5login), &st) != 0) {
+        retval = errno;
+        goto fail;
+    }
+    if (st.st_uid != 0 && (st.st_uid != pwd->pw_uid)) {
+        retval = EACCES;
+        putil_err(args, "unsafe .k5login ownership (saw %lu, expected %lu)",
+                  (unsigned long) st.st_uid, (unsigned long) pwd->pw_uid);
+        goto fail;
+    }
+
+    /*
+     * Parse the .k5login file and attempt authentication for each principal.
+     * Ignore any lines that are too long or that don't parse into a Kerberos
+     * principal.  Assume an invalid password error if there are no valid
+     * lines in .k5login.
+     */
+    retval = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+    while (fgets(line, BUFSIZ, k5login) != NULL) {
+        len = strlen(line);
+        if (line[len - 1] != '\n') {
+            while (fgets(line, BUFSIZ, k5login) != NULL) {
+                len = strlen(line);
+                if (line[len - 1] == '\n')
+                    break;
+            }
+            continue;
+        }
+        line[len - 1] = '\0';
+        k5_errno = krb5_parse_name(ctx->context, line, &princ);
+        if (k5_errno != 0)
+            continue;
+
+        /* Now, attempt to authenticate as that user. */
+        if (service == NULL)
+            putil_debug(args, "attempting authentication as %s", line);
+        else
+            putil_debug(args, "attempting authentication as %s for %s", line,
+                        service);
+        retval = krb5_get_init_creds_password(
+            ctx->context, creds, princ, (char *) pass, pamk5_prompter_krb5,
+            args, 0, (char *) service, opts);
+
+        /*
+         * If that worked, update ctx->princ and return success.  Otherwise,
+         * continue on to the next line.
+         */
+        if (retval == 0) {
+            if (ctx->princ != NULL)
+                krb5_free_principal(ctx->context, ctx->princ);
+            ctx->princ = princ;
+            fclose(k5login);
+            return 0;
+        }
+        krb5_free_principal(ctx->context, princ);
+    }
+
+fail:
+    fclose(k5login);
+    return retval;
+}
+
+
+#if (defined(HAVE_KRB5_HEIMDAL)                           \
+     && defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT)) \
+    || defined(HAVE_KRB5_GET_PROMPT_TYPES)
+/*
+ * Attempt authentication via PKINIT.  Currently, this uses an API specific to
+ * Heimdal.  Once MIT Kerberos supports PKINIT, some of the details may need
+ * to move into the compat layer.
+ *
+ * Some smart card readers require the user to enter the PIN at the keyboard
+ * after inserting the smart card.  Others have a pad on the card and no
+ * prompting by PAM is required.  The Kerberos library prompting functions
+ * should be able to work out which is required.
+ *
+ * PKINIT is just one of many pre-authentication mechanisms that could be
+ * used.  It's handled separately because of possible smart card interactions
+ * and the possibility that some users may be authenticated via PKINIT and
+ * others may not.
+ *
+ * Takes the same arguments as pamk5_password_auth and returns a
+ * krb5_error_code.  If successful, the credentials will be stored in creds.
+ */
+static krb5_error_code
+pkinit_auth(struct pam_args *args, const char *service, krb5_creds **creds)
+{
+    struct context *ctx = args->config->ctx;
+    krb5_get_init_creds_opt *opts = NULL;
+    krb5_error_code retval;
+    char *dummy = NULL;
+
+    /*
+     * We may not be able to dive directly into the PKINIT functions because
+     * the user may not have a chance to enter the smart card.  For example,
+     * gnome-screensaver jumps into PAM as soon as the mouse is moved and
+     * expects to be prompted for a password, which may not happen if the
+     * smart card is the type that has a pad for the PIN on the card.
+     *
+     * Allow the user to set pkinit_prompt as an option.  If set, we tell the
+     * user they need to insert the card.
+     *
+     * We always ignore the input.  If the user wants to use a password
+     * instead, they'll be prompted later when the PKINIT code discovers that
+     * no smart card is available.
+     */
+    if (args->config->pkinit_prompt) {
+        pamk5_conv(args,
+                   args->config->use_pkinit
+                       ? "Insert smart card and press Enter: "
+                       : "Insert smart card if desired, then press Enter: ",
+                   PAM_PROMPT_ECHO_OFF, &dummy);
+    }
+
+    /*
+     * Set credential options.  We have to use the allocated version of the
+     * credential option struct to store the PKINIT options.
+     */
+    *creds = calloc(1, sizeof(krb5_creds));
+    if (*creds == NULL)
+        return ENOMEM;
+    retval = krb5_get_init_creds_opt_alloc(ctx->context, &opts);
+    if (retval != 0)
+        return retval;
+    set_credential_options(args, opts, service != NULL);
+
+    /* Finally, do the actual work and return the results. */
+#    ifdef HAVE_KRB5_HEIMDAL
+    retval = krb5_get_init_creds_opt_set_pkinit(
+        ctx->context, opts, ctx->princ, args->config->pkinit_user,
+        args->config->pkinit_anchors, NULL, NULL, 0, pamk5_prompter_krb5, args,
+        NULL);
+    if (retval == 0)
+        retval = krb5_get_init_creds_password(ctx->context, *creds, ctx->princ,
+                                              NULL, NULL, args, 0,
+                                              (char *) service, opts);
+#    else  /* !HAVE_KRB5_HEIMDAL */
+    retval = krb5_get_init_creds_password(
+        ctx->context, *creds, ctx->princ, NULL,
+        pamk5_prompter_krb5_no_password, args, 0, (char *) service, opts);
+#    endif /* !HAVE_KRB5_HEIMDAL */
+
+    krb5_get_init_creds_opt_free(ctx->context, opts);
+    if (retval != 0) {
+        krb5_free_cred_contents(ctx->context, *creds);
+        free(*creds);
+        *creds = NULL;
+    }
+    return retval;
+}
+#endif
+
+
+/*
+ * Attempt authentication once with a given password.  This is the core of the
+ * authentication loop, and handles alt_auth_map and search_k5login.  It takes
+ * the PAM arguments, the service for which to get tickets (NULL for the
+ * default TGT), the initial credential options, and the password, and returns
+ * a Kerberos status code or errno.  On success (return status 0), it stores
+ * the obtained credentials in the provided creds argument.
+ */
+static krb5_error_code
+password_auth_attempt(struct pam_args *args, const char *service,
+                      krb5_get_init_creds_opt *opts, const char *pass,
+                      krb5_creds *creds)
+{
+    krb5_error_code retval;
+
+    /*
+     * First, try authenticating as the alternate principal if one were
+     * configured.  If that fails or wasn't configured, continue on to trying
+     * search_k5login or a regular authentication unless configuration
+     * indicates that regular authentication should not be attempted.
+     */
+    if (args->config->alt_auth_map != NULL) {
+        retval = pamk5_alt_auth(args, service, opts, pass, creds);
+        if (retval == 0)
+            return retval;
+
+        /* If only_alt_auth is set, we cannot continue. */
+        if (args->config->only_alt_auth)
+            return retval;
+
+        /*
+         * If force_alt_auth is set, skip attempting normal authentication iff
+         * the alternate principal exists.
+         */
+        if (args->config->force_alt_auth)
+            if (retval != KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN)
+                return retval;
+    }
+
+    /* Attempt regular authentication, via either search_k5login or normal. */
+    if (args->config->search_k5login)
+        retval = k5login_password_auth(args, creds, opts, service, pass);
+    else
+        retval = password_auth(args, creds, opts, service, pass);
+    if (retval != 0)
+        putil_debug_krb5(args, retval, "krb5_get_init_creds_password");
+    return retval;
+}
+
+
+/*
+ * Try to verify credentials by obtaining and checking a service ticket.  This
+ * is required to verify that no one is spoofing the KDC, but requires read
+ * access to a keytab with a valid key.  By default, the Kerberos library will
+ * silently succeed if no verification keys are available, but the user can
+ * change this by setting verify_ap_req_nofail in [libdefaults] in
+ * /etc/krb5.conf.
+ *
+ * The MIT Kerberos implementation of krb5_verify_init_creds hardwires the
+ * host key for the local system as the desired principal if no principal is
+ * given.  If we have an explicitly configured keytab, instead read that
+ * keytab, find the first principal in that keytab, and use that.
+ *
+ * Returns a Kerberos status code (0 for success).
+ */
+static krb5_error_code
+verify_creds(struct pam_args *args, krb5_creds *creds)
+{
+    krb5_verify_init_creds_opt opts;
+    krb5_keytab keytab = NULL;
+    krb5_kt_cursor cursor;
+    int cursor_valid = 0;
+    krb5_keytab_entry entry;
+    krb5_principal princ = NULL;
+    krb5_error_code retval;
+    krb5_context c = args->config->ctx->context;
+
+    memset(&entry, 0, sizeof(entry));
+    krb5_verify_init_creds_opt_init(&opts);
+    if (args->config->keytab) {
+        retval = krb5_kt_resolve(c, args->config->keytab, &keytab);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "cannot open keytab %s",
+                           args->config->keytab);
+            keytab = NULL;
+        }
+        if (retval == 0)
+            retval = krb5_kt_start_seq_get(c, keytab, &cursor);
+        if (retval == 0) {
+            cursor_valid = 1;
+            retval = krb5_kt_next_entry(c, keytab, &entry, &cursor);
+        }
+        if (retval == 0)
+            retval = krb5_copy_principal(c, entry.principal, &princ);
+        if (retval != 0)
+            putil_err_krb5(args, retval, "error reading keytab %s",
+                           args->config->keytab);
+        if (entry.principal != NULL)
+            krb5_kt_free_entry(c, &entry);
+        if (cursor_valid)
+            krb5_kt_end_seq_get(c, keytab, &cursor);
+    }
+    retval = krb5_verify_init_creds(c, creds, princ, keytab, NULL, &opts);
+    if (retval != 0)
+        putil_err_krb5(args, retval, "credential verification failed");
+    if (princ != NULL)
+        krb5_free_principal(c, princ);
+    if (keytab != NULL)
+        krb5_kt_close(c, keytab);
+    return retval;
+}
+
+
+/*
+ * Give the user a nicer error message when we've attempted PKINIT without
+ * success.  We can only do this if the rich status codes are available.
+ * Currently, this only works with Heimdal.
+ */
+static void UNUSED
+report_pkinit_error(struct pam_args *args, krb5_error_code retval UNUSED)
+{
+    const char *message;
+
+#ifdef HAVE_HX509_ERR_H
+    switch (retval) {
+#    ifdef HX509_PKCS11_PIN_LOCKED
+    case HX509_PKCS11_PIN_LOCKED:
+        message = "PKINIT failed: user PIN locked";
+        break;
+#    endif
+#    ifdef HX509_PKCS11_PIN_EXPIRED
+    case HX509_PKCS11_PIN_EXPIRED:
+        message = "PKINIT failed: user PIN expired";
+        break;
+#    endif
+#    ifdef HX509_PKCS11_PIN_INCORRECT
+    case HX509_PKCS11_PIN_INCORRECT:
+        message = "PKINIT failed: user PIN incorrect";
+        break;
+#    endif
+#    ifdef HX509_PKCS11_PIN_NOT_INITIALIZED
+    case HX509_PKCS11_PIN_NOT_INITIALIZED:
+        message = "PKINIT fialed: user PIN not initialized";
+        break;
+#    endif
+    default:
+        message = "PKINIT failed";
+        break;
+    }
+#else
+    message = "PKINIT failed";
+#endif
+    pamk5_conv(args, message, PAM_TEXT_INFO, NULL);
+}
+
+
+/*
+ * Prompt the user for a password and authenticate the password with the KDC.
+ * If correct, fill in creds with the obtained TGT or ticket.  service, if
+ * non-NULL, specifies the service to get tickets for; the only interesting
+ * non-null case is kadmin/changepw for changing passwords.  Therefore, if it
+ * is non-null, we look for the password in PAM_OLDAUTHOK and save it there
+ * instead of using PAM_AUTHTOK.
+ */
+int
+pamk5_password_auth(struct pam_args *args, const char *service,
+                    krb5_creds **creds)
+{
+    struct context *ctx;
+    krb5_get_init_creds_opt *opts = NULL;
+    krb5_error_code retval = 0;
+    int status = PAM_SUCCESS;
+    bool retry, prompt;
+    bool creds_valid = false;
+    const char *pass = NULL;
+    int authtok = (service == NULL) ? PAM_AUTHTOK : PAM_OLDAUTHTOK;
+
+    /* Sanity check and initialization. */
+    if (args->config->ctx == NULL)
+        return PAM_SERVICE_ERR;
+    ctx = args->config->ctx;
+
+    /*
+     * Fill in the default principal to authenticate as.  alt_auth_map or
+     * search_k5login may change this later.
+     */
+    if (ctx->princ == NULL) {
+        retval = parse_name(args);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "parse_name failed");
+            return PAM_SERVICE_ERR;
+        }
+    }
+
+    /*
+     * If PKINIT is available and we were configured to attempt it, try
+     * authenticating with PKINIT first.  Otherwise, fail all authentication
+     * if PKINIT is not available and use_pkinit was set.  Fake an error code
+     * that gives an approximately correct error message.
+     */
+#if defined(HAVE_KRB5_HEIMDAL) \
+    && defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT)
+    if (args->config->use_pkinit || args->config->try_pkinit) {
+        retval = pkinit_auth(args, service, creds);
+        if (retval == 0)
+            goto verify;
+        putil_debug_krb5(args, retval, "PKINIT failed");
+        if (retval != HX509_PKCS11_NO_TOKEN && retval != HX509_PKCS11_NO_SLOT)
+            goto done;
+        if (retval != 0) {
+            report_pkinit_error(args, retval);
+            if (args->config->use_pkinit)
+                goto done;
+        }
+    }
+#elif defined(HAVE_KRB5_GET_PROMPT_TYPES)
+    if (args->config->use_pkinit) {
+        retval = pkinit_auth(args, service, creds);
+        if (retval == 0)
+            goto verify;
+        putil_debug_krb5(args, retval, "PKINIT failed");
+        report_pkinit_error(args, retval);
+        goto done;
+    }
+#endif
+
+    /* Allocate cred structure and set credential options. */
+    *creds = calloc(1, sizeof(krb5_creds));
+    if (*creds == NULL) {
+        putil_crit(args, "cannot allocate memory: %s", strerror(errno));
+        status = PAM_SERVICE_ERR;
+        goto done;
+    }
+    retval = krb5_get_init_creds_opt_alloc(ctx->context, &opts);
+    if (retval != 0) {
+        putil_crit_krb5(args, retval, "cannot allocate credential options");
+        goto done;
+    }
+    set_credential_options(args, opts, service != NULL);
+
+    /*
+     * Obtain the saved password, if appropriate and available, and determine
+     * our retry strategy.  If try_first_pass is set, we will prompt for a
+     * password and retry the authentication if the stored password didn't
+     * work.
+     */
+    status = maybe_retrieve_password(args, authtok, &pass);
+    if (status != PAM_SUCCESS)
+        goto done;
+
+    /*
+     * Main authentication loop.
+     *
+     * If we had no stored password, we prompt for a password the first time
+     * through.  If try_first_pass is set and we had an old password, we try
+     * with it.  If the old password doesn't work, we loop once, prompt for a
+     * password, and retry.  If use_first_pass is set, we'll prompt once if
+     * the password isn't already set but won't retry.
+     *
+     * If we don't have a password but try_pkinit or no_prompt are true, we
+     * don't attempt to prompt for a password and we go into the Kerberos
+     * libraries with no password.  We rely on the Kerberos libraries to do
+     * the prompting if PKINIT fails.  In this case, make sure we don't retry.
+     * Be aware that in this case, we also have no way of saving whatever
+     * password or other credentials the user might enter, so subsequent PAM
+     * modules will not see a stored authtok.
+     *
+     * We've already handled empty passwords in our other functions.
+     */
+    retry = args->config->try_first_pass;
+    prompt = !(args->config->try_pkinit || args->config->no_prompt);
+    do {
+        if (pass == NULL)
+            retry = false;
+        if (pass == NULL && prompt) {
+            status = prompt_password(args, authtok, &pass);
+            if (status != PAM_SUCCESS)
+                goto done;
+        }
+
+        /*
+         * Attempt authentication.  If we succeeded, we're done.  Otherwise,
+         * clear the password and then see if we should try again after
+         * prompting for a password.
+         */
+        retval = password_auth_attempt(args, service, opts, pass, *creds);
+        if (retval == 0) {
+            creds_valid = true;
+            break;
+        }
+        pass = NULL;
+    } while (retry
+             && (retval == KRB5KRB_AP_ERR_BAD_INTEGRITY
+                 || retval == KRB5KRB_AP_ERR_MODIFIED
+                 || retval == KRB5KDC_ERR_PREAUTH_FAILED
+                 || retval == KRB5_GET_IN_TKT_LOOP
+                 || retval == KRB5_BAD_ENCTYPE));
+
+verify:
+    UNUSED
+    /*
+     * If we think we succeeded, whether through the regular path or via
+     * PKINIT, try to verify the credentials.  Don't do this if we're
+     * authenticating for password changes (or any other case where we're not
+     * getting a TGT).  We can't get a service ticket from a kadmin/changepw
+     * ticket.
+     */
+    if (retval == 0 && service == NULL)
+        retval = verify_creds(args, *creds);
+
+done:
+    /*
+     * Free resources, including any credentials we have sitting around if we
+     * failed, and return the appropriate PAM error code.  If status is
+     * already set to something other than PAM_SUCCESS, we encountered a PAM
+     * error and will just return that code.  Otherwise, we need to map the
+     * Kerberos status code in retval to a PAM error code.
+     */
+    if (status == PAM_SUCCESS) {
+        switch (retval) {
+        case 0:
+            status = PAM_SUCCESS;
+            break;
+        case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
+            status = PAM_USER_UNKNOWN;
+            break;
+        case KRB5KDC_ERR_KEY_EXP:
+            status = PAM_NEW_AUTHTOK_REQD;
+            break;
+        case KRB5KDC_ERR_NAME_EXP:
+            status = PAM_ACCT_EXPIRED;
+            break;
+        case KRB5_KDC_UNREACH:
+        case KRB5_LIBOS_CANTREADPWD:
+        case KRB5_REALM_CANT_RESOLVE:
+        case KRB5_REALM_UNKNOWN:
+            status = PAM_AUTHINFO_UNAVAIL;
+            break;
+        default:
+            status = PAM_AUTH_ERR;
+            break;
+        }
+    }
+    if (status != PAM_SUCCESS && *creds != NULL) {
+        if (creds_valid)
+            krb5_free_cred_contents(ctx->context, *creds);
+        free(*creds);
+        *creds = NULL;
+    }
+    if (opts != NULL)
+        krb5_get_init_creds_opt_free(ctx->context, opts);
+
+    /* Whatever the results, destroy the anonymous FAST cache. */
+    if (ctx->fast_cache != NULL) {
+        krb5_cc_destroy(ctx->context, ctx->fast_cache);
+        ctx->fast_cache = NULL;
+    }
+    return status;
+}
+
+
+/*
+ * Authenticate a user via Kerberos.
+ *
+ * It would be nice to be able to save the ticket cache temporarily as a
+ * memory cache and then only write it out to disk during the session
+ * initialization.  Unfortunately, OpenSSH 4.2 and later do PAM authentication
+ * in a subprocess and therefore has no saved module-specific data available
+ * once it opens a session, so we have to save the ticket cache to disk and
+ * store in the environment where it is.  The alternative is to use something
+ * like System V shared memory, which seems like more trouble than it's worth.
+ */
+int
+pamk5_authenticate(struct pam_args *args)
+{
+    struct context *ctx = NULL;
+    krb5_creds *creds = NULL;
+    char *pass = NULL;
+    char *principal;
+    int pamret;
+    bool set_context = false;
+    krb5_error_code retval;
+
+    /* Temporary backward compatibility. */
+    if (args->config->use_authtok && !args->config->force_first_pass) {
+        putil_err(args, "use_authtok option in authentication group should"
+                        " be changed to force_first_pass");
+        args->config->force_first_pass = true;
+    }
+
+    /* Create a context and obtain the user. */
+    pamret = pamk5_context_new(args);
+    if (pamret != PAM_SUCCESS)
+        goto done;
+    ctx = args->config->ctx;
+
+    /* Check whether we should ignore this user. */
+    if (pamk5_should_ignore(args, ctx->name)) {
+        pamret = PAM_USER_UNKNOWN;
+        goto done;
+    }
+
+    /*
+     * Do the actual authentication.
+     *
+     * The complexity arises if the password was expired (which means the
+     * Kerberos library was also unable to prompt for the password change
+     * internally).  In that case, there are three possibilities:
+     * fail_pwchange says we treat that as an authentication failure and stop,
+     * defer_pwchange says to set a flag that will result in an error at the
+     * acct_mgmt step, and force_pwchange says that we should change the
+     * password here and now.
+     *
+     * defer_pwchange is the formally correct behavior.  Set a flag in the
+     * context and return success.  That flag will later be checked by
+     * pam_sm_acct_mgmt.  We need to set the context as PAM data in the
+     * defer_pwchange case, but we don't want to set the PAM data until we've
+     * checked .k5login.  If we've stacked multiple pam-krb5 invocations in
+     * different realms as optional, we don't want to override a previous
+     * successful authentication.
+     *
+     * Note this means that, if the user can authenticate with multiple realms
+     * and authentication succeeds in one realm and is then expired in a later
+     * realm, the expiration in the latter realm wins.  This isn't ideal, but
+     * avoiding that case is more complicated than it's worth.
+     *
+     * We would like to set the current password as PAM_OLDAUTHTOK so that
+     * when the application subsequently calls pam_chauthtok, the user won't
+     * be reprompted.  However, the PAM library clears all the auth tokens
+     * when pam_authenticate exits, so this isn't possible.
+     *
+     * In the force_pwchange case, try to use the password the user just
+     * entered to authenticate to the password changing service, but don't
+     * throw an error if that doesn't work.  We have to move it from
+     * PAM_AUTHTOK to PAM_OLDAUTHTOK to be in the place where password
+     * changing expects, and have to unset PAM_AUTHTOK or we'll just change
+     * the password to the same thing it was.
+     */
+    pamret = pamk5_password_auth(args, NULL, &creds);
+    if (pamret == PAM_NEW_AUTHTOK_REQD) {
+        if (args->config->fail_pwchange)
+            pamret = PAM_AUTH_ERR;
+        else if (args->config->defer_pwchange) {
+            putil_debug(args, "expired account, deferring failure");
+            ctx->expired = 1;
+            pamret = PAM_SUCCESS;
+        } else if (args->config->force_pwchange) {
+            pam_syslog(args->pamh, LOG_INFO,
+                       "user %s password expired, forcing password change",
+                       ctx->name);
+            pamk5_conv(args, "Password expired.  You must change it now.",
+                       PAM_TEXT_INFO, NULL);
+            pamret = pam_get_item(args->pamh, PAM_AUTHTOK,
+                                  (PAM_CONST void **) &pass);
+            if (pamret == PAM_SUCCESS && pass != NULL)
+                pam_set_item(args->pamh, PAM_OLDAUTHTOK, pass);
+            pam_set_item(args->pamh, PAM_AUTHTOK, NULL);
+            args->config->use_first_pass = true;
+            pamret = pamk5_password_change(args, false);
+            if (pamret == PAM_SUCCESS)
+                putil_debug(args, "successfully changed expired password");
+        }
+    }
+    if (pamret != PAM_SUCCESS) {
+        putil_log_failure(args, "authentication failure");
+        goto done;
+    }
+
+    /* Check .k5login and alt_auth_map. */
+    pamret = pamk5_authorized(args);
+    if (pamret != PAM_SUCCESS) {
+        putil_log_failure(args, "failed authorization check");
+        goto done;
+    }
+
+    /* Reset PAM_USER in case we canonicalized, but ignore errors. */
+    if (!ctx->expired && !args->config->no_update_user) {
+        pamret = pam_set_item(args->pamh, PAM_USER, ctx->name);
+        if (pamret != PAM_SUCCESS)
+            putil_err_pam(args, pamret, "cannot set PAM_USER");
+    }
+
+    /* Log the successful authentication. */
+    retval = krb5_unparse_name(ctx->context, ctx->princ, &principal);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "krb5_unparse_name failed");
+        pam_syslog(args->pamh, LOG_INFO, "user %s authenticated as UNKNOWN",
+                   ctx->name);
+    } else {
+        pam_syslog(args->pamh, LOG_INFO, "user %s authenticated as %s%s",
+                   ctx->name, principal, ctx->expired ? " (expired)" : "");
+        krb5_free_unparsed_name(ctx->context, principal);
+    }
+
+    /* Now that we know we're successful, we can store the context. */
+    pamret = pam_set_data(args->pamh, "pam_krb5", ctx, pamk5_context_destroy);
+    if (pamret != PAM_SUCCESS) {
+        putil_err_pam(args, pamret, "cannot set context data");
+        pamk5_context_free(args);
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    set_context = true;
+
+    /*
+     * If we have an expired account or if we're not creating a ticket cache,
+     * we're done.  Otherwise, store the obtained credentials in a temporary
+     * cache.
+     */
+    if (!args->config->no_ccache && !ctx->expired)
+        pamret = pamk5_cache_init_random(args, creds);
+
+done:
+    if (creds != NULL && ctx != NULL) {
+        krb5_free_cred_contents(ctx->context, creds);
+        free(creds);
+    }
+
+    /*
+     * Don't free our Kerberos context if we set a context, since the context
+     * will take care of that.
+     */
+    if (set_context)
+        args->ctx = NULL;
+
+    /*
+     * Clear the context on failure so that the account management module
+     * knows that we didn't authenticate with Kerberos.  Only clear the
+     * context if we set it.  Otherwise, we may be blowing away the context of
+     * a previous successful authentication.
+     */
+    if (pamret != PAM_SUCCESS) {
+        if (set_context)
+            pam_set_data(args->pamh, "pam_krb5", NULL, NULL);
+        else
+            pamk5_context_free(args);
+    }
+    return pamret;
+}
diff --git a/module/cache.c b/module/cache.c
new file mode 100644
index 000000000000..7acfef07b8eb
--- /dev/null
+++ b/module/cache.c
@@ -0,0 +1,185 @@
+/*
+ * Ticket cache initialization.
+ *
+ * Provides functions for creating ticket caches, used by pam_authenticate,
+ * pam_setcred, and pam_chauthtok after changing an expired password.
+ *
+ * Copyright 2005-2009, 2014, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Get the name of a cache.  Takes the name of the environment variable that
+ * should be set to indicate which cache to use, either the permanent cache
+ * (KRB5CCNAME) or the temporary cache (PAM_KRB5CCNAME).
+ *
+ * Treat an empty environment variable setting the same as if the variable
+ * was not set, since on FreeBSD we can't delete the environment variable,
+ * only set it to an empty value.
+ */
+const char *
+pamk5_get_krb5ccname(struct pam_args *args, const char *key)
+{
+    const char *name;
+
+    /* When refreshing a cache, we need to try the regular environment. */
+    name = pam_getenv(args->pamh, key);
+    if (name == NULL || *name == '\0')
+        name = getenv(key);
+    if (name == NULL || *name == '\0')
+        return NULL;
+    else
+        return name;
+}
+
+
+/*
+ * Put the ticket cache information into the environment.  Takes the path and
+ * the environment variable to set, since this is used both for the permanent
+ * cache (KRB5CCNAME) and the temporary cache (PAM_KRB5CCNAME).  Returns a PAM
+ * status code.
+ */
+int
+pamk5_set_krb5ccname(struct pam_args *args, const char *name, const char *key)
+{
+    char *env_name = NULL;
+    int pamret;
+
+    if (asprintf(&env_name, "%s=%s", key, name) < 0) {
+        putil_crit(args, "asprintf failed: %s", strerror(errno));
+        pamret = PAM_BUF_ERR;
+        goto done;
+    }
+    pamret = pam_putenv(args->pamh, env_name);
+    if (pamret != PAM_SUCCESS) {
+        putil_err_pam(args, pamret, "pam_putenv failed");
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    pamret = PAM_SUCCESS;
+
+done:
+    free(env_name);
+    return pamret;
+}
+
+
+/*
+ * Given the template for a ticket cache name, initialize that file securely
+ * mkstemp.  Returns a PAM success or error code.
+ */
+int
+pamk5_cache_mkstemp(struct pam_args *args, char *template)
+{
+    int ccfd, oerrno;
+
+    ccfd = mkstemp(template);
+    if (ccfd < 0) {
+        oerrno = errno;
+        putil_crit(args, "mkstemp(\"%s\") failed: %s", template,
+                   strerror(errno));
+        errno = oerrno;
+        return PAM_SERVICE_ERR;
+    }
+    close(ccfd);
+    return PAM_SUCCESS;
+}
+
+
+/*
+ * Given a cache name and the initial credentials, initialize the cache, store
+ * the credentials in that cache, and return a pointer to the new cache in the
+ * cache argument.  Returns a PAM success or error code.
+ */
+int
+pamk5_cache_init(struct pam_args *args, const char *ccname, krb5_creds *creds,
+                 krb5_ccache *cache)
+{
+    struct context *ctx;
+    int retval;
+
+    if (args == NULL || args->config == NULL || args->config->ctx == NULL
+        || args->config->ctx->context == NULL)
+        return PAM_SERVICE_ERR;
+    ctx = args->config->ctx;
+    retval = krb5_cc_resolve(ctx->context, ccname, cache);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot resolve ticket cache %s", ccname);
+        retval = PAM_SERVICE_ERR;
+        goto done;
+    }
+    retval = krb5_cc_initialize(ctx->context, *cache, ctx->princ);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot initialize ticket cache %s",
+                       ccname);
+        retval = PAM_SERVICE_ERR;
+        goto done;
+    }
+    retval = krb5_cc_store_cred(ctx->context, *cache, creds);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot store credentials in %s", ccname);
+        retval = PAM_SERVICE_ERR;
+        goto done;
+    }
+
+done:
+    if (retval != PAM_SUCCESS && *cache != NULL) {
+        krb5_cc_destroy(ctx->context, *cache);
+        *cache = NULL;
+    }
+    return retval;
+}
+
+
+/*
+ * Initialize an internal ticket cache with a random name, store the given
+ * credentials in the cache, and store the cache in the context.  Put the path
+ * in PAM_KRB5CCNAME where it can be picked up later by pam_setcred.  Returns
+ * a PAM success or error code.
+ */
+int
+pamk5_cache_init_random(struct pam_args *args, krb5_creds *creds)
+{
+    char *cache_name = NULL;
+    const char *dir;
+    int pamret;
+
+    /* Store the obtained credentials in a temporary cache. */
+    dir = args->config->ccache_dir;
+    if (strncmp("FILE:", args->config->ccache_dir, strlen("FILE:")) == 0)
+        dir += strlen("FILE:");
+    if (asprintf(&cache_name, "%s/krb5cc_pam_XXXXXX", dir) < 0) {
+        putil_crit(args, "malloc failure: %s", strerror(errno));
+        return PAM_SERVICE_ERR;
+    }
+    pamret = pamk5_cache_mkstemp(args, cache_name);
+    if (pamret != PAM_SUCCESS)
+        goto done;
+    pamret =
+        pamk5_cache_init(args, cache_name, creds, &args->config->ctx->cache);
+    if (pamret != PAM_SUCCESS)
+        goto done;
+    putil_debug(args, "temporarily storing credentials in %s", cache_name);
+    pamret = pamk5_set_krb5ccname(args, cache_name, "PAM_KRB5CCNAME");
+
+done:
+    free(cache_name);
+    return pamret;
+}
diff --git a/module/context.c b/module/context.c
new file mode 100644
index 000000000000..bd90f51f5549
--- /dev/null
+++ b/module/context.c
@@ -0,0 +1,177 @@
+/*
+ * Manage context structure.
+ *
+ * The context structure is the internal state maintained by the pam-krb5
+ * module between calls to the various public interfaces.
+ *
+ * Copyright 2005-2009, 2014, 2020-2021 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Create a new context and populate it with the user from PAM and the current
+ * Kerberos context.  Set the default realm if one was configured.
+ */
+int
+pamk5_context_new(struct pam_args *args)
+{
+    struct context *ctx;
+    int retval;
+    PAM_CONST char *name;
+
+    ctx = calloc(1, sizeof(struct context));
+    if (ctx == NULL) {
+        retval = PAM_BUF_ERR;
+        goto done;
+    }
+    ctx->cache = NULL;
+    ctx->princ = NULL;
+    ctx->creds = NULL;
+    ctx->fast_cache = NULL;
+    ctx->context = args->ctx;
+    args->config->ctx = ctx;
+
+    /*
+     * This will prompt for the username if it's not already set (generally it
+     * will be).  Otherwise, grab the saved username.
+     */
+    retval = pam_get_user(args->pamh, &name, NULL);
+    if (retval != PAM_SUCCESS || name == NULL) {
+        if (retval == PAM_CONV_AGAIN)
+            retval = PAM_INCOMPLETE;
+        else
+            retval = PAM_SERVICE_ERR;
+        goto done;
+    }
+    ctx->name = strdup(name);
+    args->user = ctx->name;
+
+    /* Set a default realm if one was configured. */
+    if (args->realm != NULL) {
+        retval = krb5_set_default_realm(ctx->context, args->realm);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "cannot set default realm");
+            retval = PAM_SERVICE_ERR;
+            goto done;
+        }
+    }
+
+done:
+    if (ctx != NULL && retval != PAM_SUCCESS)
+        pamk5_context_free(args);
+    return retval;
+}
+
+
+/*
+ * Retrieve a context from the PAM data structures, returning failure if no
+ * context was present.  Note that OpenSSH loses contexts between authenticate
+ * and setcred, so failure shouldn't always be fatal.
+ */
+int
+pamk5_context_fetch(struct pam_args *args)
+{
+    int pamret;
+
+    pamret = pam_get_data(args->pamh, "pam_krb5", (void *) &args->config->ctx);
+    if (pamret != PAM_SUCCESS)
+        args->config->ctx = NULL;
+    if (pamret == PAM_SUCCESS && args->config->ctx == NULL)
+        return PAM_SERVICE_ERR;
+    if (args->config->ctx != NULL)
+        args->user = args->config->ctx->name;
+    return pamret;
+}
+
+
+/*
+ * Free a context and all of the data that's stored in it.  Normally this also
+ * includes destroying the ticket cache, but don't do this (just close it) if
+ * a flag was set to preserve it.
+ *
+ * This function is common code between pamk5_context_free (called internally
+ * by our code) and pamk5_context_destroy (called by PAM as a data callback).
+ */
+static void
+context_free(struct context *ctx, bool free_context)
+{
+    if (ctx == NULL)
+        return;
+    free(ctx->name);
+    if (ctx->context != NULL) {
+        if (ctx->princ != NULL)
+            krb5_free_principal(ctx->context, ctx->princ);
+        if (ctx->cache != NULL) {
+            if (ctx->dont_destroy_cache)
+                krb5_cc_close(ctx->context, ctx->cache);
+            else
+                krb5_cc_destroy(ctx->context, ctx->cache);
+        }
+        if (ctx->creds != NULL) {
+            krb5_free_cred_contents(ctx->context, ctx->creds);
+            free(ctx->creds);
+        }
+        if (free_context)
+            krb5_free_context(ctx->context);
+    }
+    if (ctx->fast_cache != NULL)
+        krb5_cc_destroy(ctx->context, ctx->fast_cache);
+    free(ctx);
+}
+
+
+/*
+ * Free the current context, used internally by pam-krb5 code.  This is a
+ * wrapper around context_free that makes sure we don't destroy the Kerberos
+ * context if it's the same as the top-level context and handles other
+ * bookkeeping in the top-level pam_args struct.
+ */
+void
+pamk5_context_free(struct pam_args *args)
+{
+    if (args->config->ctx == NULL)
+        return;
+    if (args->user == args->config->ctx->name)
+        args->user = NULL;
+    context_free(args->config->ctx, args->ctx != args->config->ctx->context);
+    args->config->ctx = NULL;
+}
+
+
+/*
+ * The PAM callback to destroy the context stored in the PAM data structures.
+ */
+void
+pamk5_context_destroy(pam_handle_t *pamh UNUSED, void *data,
+                      int pam_end_status)
+{
+    struct context *ctx = (struct context *) data;
+
+    /*
+     * Do not destroy the cache if the status contains PAM_DATA_SILENT, since
+     * in that case we may be in a child and the parent will still rely on
+     * underlying resources such as the ticket cache to exist.
+     */
+    if (PAM_DATA_SILENT != 0 && (pam_end_status & PAM_DATA_SILENT))
+        ctx->dont_destroy_cache = true;
+
+    /* The rest of the work is in context_free. */
+    if (ctx != NULL)
+        context_free(ctx, true);
+}
diff --git a/module/fast.c b/module/fast.c
new file mode 100644
index 000000000000..466199977fad
--- /dev/null
+++ b/module/fast.c
@@ -0,0 +1,288 @@
+/*
+ * Support for FAST (Flexible Authentication Secure Tunneling).
+ *
+ * FAST is a mechanism to protect Kerberos against password guessing attacks
+ * and provide other security improvements.  It requires existing credentials
+ * to protect the initial preauthentication exchange.  These can come either
+ * from a ticket cache for another principal or via anonymous PKINIT.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Contributions from Sam Hartman and Yair Yarom
+ * Copyright 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010, 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Initialize an internal anonymous ticket cache with a random name and store
+ * the resulting ticket cache in the ccache argument.  Returns a Kerberos
+ * error code.
+ */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ANONYMOUS
+
+static krb5_error_code
+cache_init_anonymous(struct pam_args *args, krb5_ccache *ccache UNUSED)
+{
+    putil_debug(args, "not built with anonymous FAST support");
+    return KRB5KDC_ERR_BADOPTION;
+}
+
+#else /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ANONYMOUS */
+
+static krb5_error_code
+cache_init_anonymous(struct pam_args *args, krb5_ccache *ccache)
+{
+    krb5_context c = args->config->ctx->context;
+    krb5_error_code retval;
+    krb5_principal princ = NULL;
+    char *realm;
+    char *name = NULL;
+    krb5_creds creds;
+    bool creds_valid = false;
+    krb5_get_init_creds_opt *opts = NULL;
+
+    *ccache = NULL;
+    memset(&creds, 0, sizeof(creds));
+
+    /* Construct the anonymous principal name. */
+    retval = krb5_get_default_realm(c, &realm);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval, "cannot find realm for anonymous FAST");
+        return retval;
+    }
+    retval = krb5_build_principal_ext(
+        c, &princ, (unsigned int) strlen(realm), realm,
+        strlen(KRB5_WELLKNOWN_NAME), KRB5_WELLKNOWN_NAME,
+        strlen(KRB5_ANON_NAME), KRB5_ANON_NAME, NULL);
+    if (retval != 0) {
+        krb5_free_default_realm(c, realm);
+        putil_debug_krb5(args, retval, "cannot create anonymous principal");
+        return retval;
+    }
+    krb5_free_default_realm(c, realm);
+
+    /*
+     * Set up the credential cache the anonymous credentials.  We use a
+     * memory cache whose name is based on the pointer value of our Kerberos
+     * context, since that should be unique among threads.
+     */
+    if (asprintf(&name, "MEMORY:%p", (void *) c) < 0) {
+        putil_crit(args, "malloc failure: %s", strerror(errno));
+        retval = errno;
+        goto done;
+    }
+    retval = krb5_cc_resolve(c, name, ccache);
+    if (retval != 0) {
+        putil_err_krb5(args, retval,
+                       "cannot create anonymous FAST credential cache %s",
+                       name);
+        goto done;
+    }
+
+    /* Obtain the credentials. */
+    retval = krb5_get_init_creds_opt_alloc(c, &opts);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot create FAST credential options");
+        goto done;
+    }
+    krb5_get_init_creds_opt_set_anonymous(opts, 1);
+    krb5_get_init_creds_opt_set_tkt_life(opts, 60);
+#    ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_OUT_CCACHE
+    krb5_get_init_creds_opt_set_out_ccache(c, opts, *ccache);
+#    endif
+    retval = krb5_get_init_creds_password(c, &creds, princ, NULL, NULL, NULL,
+                                          0, NULL, opts);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval,
+                         "cannot obtain anonymous credentials for FAST");
+        goto done;
+    }
+    creds_valid = true;
+
+    /*
+     * If set_out_ccache was available, we're done.  Otherwise, we have to
+     * manually set up the ticket cache.  Use the principal from the acquired
+     * credentials when initializing the ticket cache, since the realm will
+     * not match the realm of our input principal.
+     */
+#    ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_OUT_CCACHE
+    retval = krb5_cc_initialize(c, *ccache, creds.client);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot initialize FAST ticket cache");
+        goto done;
+    }
+    retval = krb5_cc_store_cred(c, *ccache, &creds);
+    if (retval != 0) {
+        putil_err_krb5(args, retval, "cannot store FAST credentials");
+        goto done;
+    }
+#    endif /* !HAVE_KRB5_GET_INIT_CREDS_OPT_SET_OUT_CCACHE */
+
+done:
+    if (retval != 0 && *ccache != NULL) {
+        krb5_cc_destroy(c, *ccache);
+        *ccache = NULL;
+    }
+    if (princ != NULL)
+        krb5_free_principal(c, princ);
+    free(name);
+    if (opts != NULL)
+        krb5_get_init_creds_opt_free(c, opts);
+    if (creds_valid)
+        krb5_free_cred_contents(c, &creds);
+    return retval;
+}
+#endif     /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ANONYMOUS */
+
+
+/*
+ * Attempt to use an existing ticket cache for FAST.  Checks whether
+ * fast_ccache is set in the options and, if so, opens that cache and does
+ * some sanity checks, returning the cache name to use if everything checks
+ * out in newly allocated memory.  Caller is responsible for freeing.  If not,
+ * returns NULL.
+ */
+UNUSED static char *
+fast_setup_cache(struct pam_args *args)
+{
+    krb5_context c = args->config->ctx->context;
+    krb5_error_code retval;
+    krb5_principal princ;
+    krb5_ccache ccache;
+    char *result;
+    const char *cache = args->config->fast_ccache;
+
+    if (cache == NULL)
+        return NULL;
+    retval = krb5_cc_resolve(c, cache, &ccache);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval, "cannot open FAST ccache %s", cache);
+        return NULL;
+    }
+    retval = krb5_cc_get_principal(c, ccache, &princ);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval,
+                         "failed to get principal from FAST"
+                         " ccache %s",
+                         cache);
+        krb5_cc_close(c, ccache);
+        return NULL;
+    } else {
+        krb5_free_principal(c, princ);
+        krb5_cc_close(c, ccache);
+        result = strdup(cache);
+        if (result == NULL)
+            putil_crit(args, "strdup failure: %s", strerror(errno));
+        return result;
+    }
+}
+
+
+/*
+ * Attempt to use an anonymous ticket cache for FAST.  Checks whether
+ * anon_fast is set in the options and, if so, opens that cache and does some
+ * sanity checks, returning the cache name to use if everything checks out in
+ * newly allocated memory.  Caller is responsible for freeing.  If not,
+ * returns NULL.
+ *
+ * If successful, store the anonymous FAST cache in the context where it will
+ * be freed following authentication.
+ */
+UNUSED static char *
+fast_setup_anon(struct pam_args *args)
+{
+    krb5_context c = args->config->ctx->context;
+    krb5_error_code retval;
+    krb5_ccache ccache;
+    char *cache, *result;
+
+    if (!args->config->anon_fast)
+        return NULL;
+    retval = cache_init_anonymous(args, &ccache);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval, "skipping anonymous FAST");
+        return NULL;
+    }
+    retval = krb5_cc_get_full_name(c, ccache, &cache);
+    if (retval != 0) {
+        putil_debug_krb5(args, retval,
+                         "cannot get name of anonymous FAST"
+                         " credential cache");
+        krb5_cc_destroy(c, ccache);
+        return NULL;
+    }
+    result = strdup(cache);
+    if (result == NULL) {
+        putil_crit(args, "strdup failure: %s", strerror(errno));
+        krb5_cc_destroy(c, ccache);
+    }
+    krb5_free_string(c, cache);
+    putil_debug(args, "anonymous authentication for FAST succeeded");
+    if (args->config->ctx->fast_cache != NULL)
+        krb5_cc_destroy(c, args->config->ctx->fast_cache);
+    args->config->ctx->fast_cache = ccache;
+    return result;
+}
+
+
+/*
+ * Set initial credential options for FAST if support is available.
+ *
+ * If fast_ccache is set, we try to use that ticket cache first.  Open it and
+ * read the principal from it first to ensure that the cache exists and
+ * contains credentials.  If that fails, skip setting the FAST cache.
+ *
+ * If anon_fast is set and fast_ccache is not or is skipped for the reasons
+ * described above, try to obtain anonymous credentials and then use them as
+ * FAST armor.
+ *
+ * Note that this function cannot fail.  If anything about FAST setup doesn't
+ * work, we continue without FAST.
+ */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME
+
+void
+pamk5_fast_setup(struct pam_args *args UNUSED,
+                 krb5_get_init_creds_opt *opts UNUSED)
+{
+}
+
+#else /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME */
+
+void
+pamk5_fast_setup(struct pam_args *args, krb5_get_init_creds_opt *opts)
+{
+    krb5_context c = args->config->ctx->context;
+    krb5_error_code retval;
+    char *cache;
+
+    /* First try to use fast_ccache, and then fall back on anon_fast. */
+    cache = fast_setup_cache(args);
+    if (cache == NULL)
+        cache = fast_setup_anon(args);
+    if (cache == NULL)
+        return;
+
+    /* We have a valid FAST ticket cache.  Set the option. */
+    retval = krb5_get_init_creds_opt_set_fast_ccache_name(c, opts, cache);
+    if (retval != 0)
+        putil_err_krb5(args, retval, "failed to set FAST ccache");
+    else
+        putil_debug(args, "setting FAST credential cache to %s", cache);
+    free(cache);
+}
+
+#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME */
diff --git a/module/internal.h b/module/internal.h
new file mode 100644
index 000000000000..f3d832a17248
--- /dev/null
+++ b/module/internal.h
@@ -0,0 +1,261 @@
+/*
+ * Internal prototypes and structures for pam-krb5.
+ *
+ * Copyright 2005-2009, 2014, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011, 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#ifndef INTERNAL_H
+#define INTERNAL_H 1
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/macros.h>
+#include <portable/pam.h>
+
+#include <stdarg.h>
+#include <syslog.h>
+
+/* Forward declarations to avoid unnecessary includes. */
+struct pam_args;
+struct passwd;
+struct vector;
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+/*
+ * An authentication context, including all the data we want to preserve
+ * across calls to the public entry points.  This context is stored in the PAM
+ * state and a pointer to it is stored in the pam_args struct that is passed
+ * as the first argument to most internal functions.
+ */
+struct context {
+    char *name;             /* Username being authenticated. */
+    krb5_context context;   /* Kerberos context. */
+    krb5_ccache cache;      /* Active credential cache, if any. */
+    krb5_principal princ;   /* Principal being authenticated. */
+    int expired;            /* If set, account was expired. */
+    int dont_destroy_cache; /* If set, don't destroy cache on shutdown. */
+    int initialized;        /* If set, ticket cache initialized. */
+    krb5_creds *creds;      /* Credentials for password changing. */
+    krb5_ccache fast_cache; /* Temporary credential cache for FAST. */
+};
+
+/*
+ * The global structure holding our arguments, both from krb5.conf and from
+ * the PAM configuration.  Filled in by pamk5_init and stored in the pam_args
+ * struct passed as a first argument to most internal functions.  Sort by
+ * documentation order.
+ */
+struct pam_config {
+    /* Authorization. */
+    char *alt_auth_map;  /* An sprintf pattern to map principals. */
+    bool force_alt_auth; /* Alt principal must be used if it exists. */
+    bool ignore_k5login; /* Don't check .k5login files. */
+    bool ignore_root;    /* Skip authentication for root. */
+    long minimum_uid;    /* Ignore users below this UID. */
+    bool only_alt_auth;  /* Alt principal must be used. */
+    bool search_k5login; /* Try password with each line of .k5login. */
+
+    /* Kerberos behavior. */
+    char *fast_ccache;           /* Cache containing armor ticket. */
+    bool anon_fast;              /* sets up an anonymous fast armor cache */
+    bool forwardable;            /* Obtain forwardable tickets. */
+    char *keytab;                /* Keytab for credential validation. */
+    char *realm;                 /* Default realm for Kerberos. */
+    krb5_deltat renew_lifetime;  /* Renewable lifetime of credentials. */
+    krb5_deltat ticket_lifetime; /* Lifetime of credentials. */
+    char *user_realm;            /* Default realm for user principals. */
+
+    /* PAM behavior. */
+    bool clear_on_fail;  /* Delete saved password on change failure. */
+    bool debug;          /* Log debugging information. */
+    bool defer_pwchange; /* Defer expired account fail to account. */
+    bool fail_pwchange;  /* Treat expired password as auth failure. */
+    bool force_pwchange; /* Change expired passwords in auth. */
+    bool no_update_user; /* Don't update PAM_USER with local name. */
+    bool silent;         /* Suppress text and errors (PAM_SILENT). */
+    char *trace;         /* File name for trace logging. */
+
+    /* PKINIT. */
+    char *pkinit_anchors;       /* Trusted certificates, usually per realm. */
+    bool pkinit_prompt;         /* Prompt user to insert smart card. */
+    char *pkinit_user;          /* User ID to pass to PKINIT. */
+    struct vector *preauth_opt; /* Preauth options. */
+    bool try_pkinit;            /* Attempt PKINIT, fall back to password. */
+    bool use_pkinit;            /* Require PKINIT. */
+
+    /* Prompting. */
+    char *banner;          /* Addition to password changing prompts. */
+    bool expose_account;   /* Display principal in password prompts. */
+    bool force_first_pass; /* Require a previous password be stored. */
+    bool no_prompt;        /* Let Kerberos handle password prompting. */
+    bool prompt_principal; /* Prompt for the Kerberos principal. */
+    bool try_first_pass;   /* Try the previously entered password. */
+    bool use_authtok;      /* Use the stored new password for changes. */
+    bool use_first_pass;   /* Always use the previous password. */
+
+    /* Ticket caches. */
+    char *ccache;            /* Path to write ticket cache to. */
+    char *ccache_dir;        /* Directory for ticket cache. */
+    bool no_ccache;          /* Don't create a ticket cache. */
+    bool retain_after_close; /* Don't destroy the cache on session end. */
+
+    /* The authentication context, which bundles together Kerberos data. */
+    struct context *ctx;
+};
+
+/* Default to a hidden visibility for all internal functions. */
+#pragma GCC visibility push(hidden)
+
+/* Parse the PAM flags, arguments, and krb5.conf and fill out pam_args. */
+struct pam_args *pamk5_init(pam_handle_t *, int flags, int, const char **);
+
+/* Free the pam_args struct when we're done. */
+void pamk5_free(struct pam_args *);
+
+/*
+ * The underlying functions between several of the major PAM interfaces.
+ */
+int pamk5_account(struct pam_args *);
+int pamk5_authenticate(struct pam_args *);
+
+/*
+ * The underlying function below pam_sm_chauthtok.  If the second argument is
+ * true, we're doing the preliminary check and shouldn't actually change the
+ * password.
+ */
+int pamk5_password(struct pam_args *, bool only_auth);
+
+/*
+ * Create or refresh the user's ticket cache.  This is the underlying function
+ * beneath pam_sm_setcred and pam_sm_open_session.
+ */
+int pamk5_setcred(struct pam_args *, bool refresh);
+
+/*
+ * Authenticate the user.  Prompts for the password as needed and obtains
+ * tickets for in_tkt_service, krbtgt/<realm> by default.  Stores the initial
+ * credentials in the final argument, allocating a new krb5_creds structure.
+ * If possible, the initial credentials are verified by checking them against
+ * the local system key.
+ */
+int pamk5_password_auth(struct pam_args *, const char *service, krb5_creds **);
+
+/*
+ * Prompt the user for a new password, twice so that they can confirm.  Sets
+ * PAM_AUTHTOK and puts the new password in newly allocated memory in pass if
+ * it's not NULL.
+ */
+int pamk5_password_prompt(struct pam_args *, char **pass);
+
+/*
+ * Change the user's password.  Prompts for the current password as needed and
+ * the new password.  If the second argument is true, only obtains the
+ * necessary credentials without changing anything.
+ */
+int pamk5_password_change(struct pam_args *, bool only_auth);
+
+/*
+ * Generic conversation function to display messages or get information from
+ * the user.  Takes the message, the message type, and a place to put the
+ * result of a prompt.
+ */
+int pamk5_conv(struct pam_args *, const char *, int, char **);
+
+/*
+ * Function specifically for getting a password.  Takes a prefix (if non-NULL,
+ * args->banner will also be prepended) and a pointer into which to store the
+ * password.  The password must be freed by the caller.
+ */
+int pamk5_get_password(struct pam_args *, const char *, char **);
+
+/* Prompting function for the Kerberos libraries. */
+krb5_error_code pamk5_prompter_krb5(krb5_context, void *data, const char *name,
+                                    const char *banner, int, krb5_prompt *);
+
+/* Prompting function that doesn't allow passwords. */
+krb5_error_code pamk5_prompter_krb5_no_password(krb5_context, void *data,
+                                                const char *name,
+                                                const char *banner, int,
+                                                krb5_prompt *);
+
+/* Check the user with krb5_kuserok or the configured equivalent. */
+int pamk5_authorized(struct pam_args *);
+
+/* Returns true if we should ignore this user (root or low UID). */
+int pamk5_should_ignore(struct pam_args *, PAM_CONST char *);
+
+/*
+ * alt_auth_map support.
+ *
+ * pamk5_map_principal attempts to map the user to a Kerberos principal
+ * according to alt_auth_map.  Returns 0 on success, storing the mapped
+ * principal name in newly allocated memory in principal.  The caller is
+ * responsiple for freeing. Returns an errno value on any error.
+ *
+ * pamk5_alt_auth attempts an authentication to the given service with the
+ * given options and password and returns a Kerberos error code.  On success,
+ * the new credentials are stored in krb5_creds.
+ *
+ * pamk5_alt_auth_verify verifies that Kerberos credentials are authorized to
+ * access the account given the configured alt_auth_map and is meant to be
+ * called from pamk5_authorized.  It returns a PAM status code.
+ */
+int pamk5_map_principal(struct pam_args *, const char *username,
+                        char **principal);
+krb5_error_code pamk5_alt_auth(struct pam_args *, const char *service,
+                               krb5_get_init_creds_opt *, const char *pass,
+                               krb5_creds *);
+int pamk5_alt_auth_verify(struct pam_args *);
+
+/* FAST support.  Set up FAST protection of authentication. */
+void pamk5_fast_setup(struct pam_args *, krb5_get_init_creds_opt *);
+
+/* Context management. */
+int pamk5_context_new(struct pam_args *);
+int pamk5_context_fetch(struct pam_args *);
+void pamk5_context_free(struct pam_args *);
+void pamk5_context_destroy(pam_handle_t *, void *data, int pam_end_status);
+
+/* Get and set environment variables for the ticket cache. */
+const char *pamk5_get_krb5ccname(struct pam_args *, const char *key);
+int pamk5_set_krb5ccname(struct pam_args *, const char *, const char *key);
+
+/*
+ * Create a ticket cache file securely given a mkstemp template.  Modifies
+ * template in place to store the name of the created file.
+ */
+int pamk5_cache_mkstemp(struct pam_args *, char *template);
+
+/*
+ * Create a ticket cache and initialize it with the provided credentials,
+ * returning the new cache in the last argument
+ */
+int pamk5_cache_init(struct pam_args *, const char *ccname, krb5_creds *,
+                     krb5_ccache *);
+
+/*
+ * Create a ticket cache with a random path, initialize it with the provided
+ * credentials, store it in the context, and put the path into PAM_KRB5CCNAME.
+ */
+int pamk5_cache_init_random(struct pam_args *, krb5_creds *);
+
+/*
+ * Compatibility functions.  Depending on whether pam_krb5 is built with MIT
+ * Kerberos or Heimdal, appropriate implementations for the Kerberos
+ * implementation will be provided.
+ */
+krb5_error_code pamk5_compat_set_realm(struct pam_config *, const char *);
+void pamk5_compat_free_realm(struct pam_config *);
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+#endif /* !INTERNAL_H */
diff --git a/module/options.c b/module/options.c
new file mode 100644
index 000000000000..f2c3791d895a
--- /dev/null
+++ b/module/options.c
@@ -0,0 +1,259 @@
+/*
+ * Option handling for pam-krb5.
+ *
+ * Responsible for initializing the args struct that's passed to nearly all
+ * internal functions.  Retrieves configuration information from krb5.conf and
+ * parses the PAM configuration.
+ *
+ * Copyright 2005-2010, 2014, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+#include <pam-util/options.h>
+#include <pam-util/vector.h>
+
+/* Our option definition.  Must be sorted. */
+#define K(name) (#name), offsetof(struct pam_config, name)
+/* clang-format off */
+static const struct option options[] = {
+    { K(alt_auth_map),       true,  STRING (NULL)  },
+    { K(anon_fast),          true,  BOOL   (false) },
+    { K(banner),             true,  STRING ("Kerberos") },
+    { K(ccache),             true,  STRING (NULL)  },
+    { K(ccache_dir),         true,  STRING ("FILE:/tmp") },
+    { K(clear_on_fail),      true,  BOOL   (false) },
+    { K(debug),              true,  BOOL   (false) },
+    { K(defer_pwchange),     true,  BOOL   (false) },
+    { K(expose_account),     true,  BOOL   (false) },
+    { K(fail_pwchange),      true,  BOOL   (false) },
+    { K(fast_ccache),        true,  STRING (NULL)  },
+    { K(force_alt_auth),     true,  BOOL   (false) },
+    { K(force_first_pass),   false, BOOL   (false) },
+    { K(force_pwchange),     true,  BOOL   (false) },
+    { K(forwardable),        true,  BOOL   (false) },
+    { K(ignore_k5login),     true,  BOOL   (false) },
+    { K(ignore_root),        true,  BOOL   (false) },
+    { K(keytab),             true,  STRING (NULL)  },
+    { K(minimum_uid),        true,  NUMBER (0)     },
+    { K(no_ccache),          false, BOOL   (false) },
+    { K(no_prompt),          true,  BOOL   (false) },
+    { K(no_update_user),     true,  BOOL   (false) },
+    { K(only_alt_auth),      true,  BOOL   (false) },
+    { K(pkinit_anchors),     true,  STRING (NULL)  },
+    { K(pkinit_prompt),      true,  BOOL   (false) },
+    { K(pkinit_user),        true,  STRING (NULL)  },
+    { K(preauth_opt),        true,  LIST   (NULL)  },
+    { K(prompt_principal),   true,  BOOL   (false) },
+    { K(realm),              false, STRING (NULL)  },
+    { K(renew_lifetime),     true,  TIME   (0)     },
+    { K(retain_after_close), true,  BOOL   (false) },
+    { K(search_k5login),     true,  BOOL   (false) },
+    { K(silent),             false, BOOL   (false) },
+    { K(ticket_lifetime),    true,  TIME   (0)     },
+    { K(trace),              false, STRING (NULL)  },
+    { K(try_first_pass),     false, BOOL   (false) },
+    { K(try_pkinit),         true,  BOOL   (false) },
+    { K(use_authtok),        false, BOOL   (false) },
+    { K(use_first_pass),     false, BOOL   (false) },
+    { K(use_pkinit),         true,  BOOL   (false) },
+    { K(user_realm),         true,  STRING (NULL)  },
+};
+/* clang-format on */
+static const size_t optlen = sizeof(options) / sizeof(options[0]);
+
+
+/*
+ * Allocate a new struct pam_args and initialize its data members, including
+ * parsing the arguments and getting settings from krb5.conf.  Check the
+ * resulting options for consistency.
+ */
+struct pam_args *
+pamk5_init(pam_handle_t *pamh, int flags, int argc, const char **argv)
+{
+    int i;
+    struct pam_args *args;
+    struct pam_config *config = NULL;
+
+    args = putil_args_new(pamh, flags);
+    if (args == NULL) {
+        return NULL;
+    }
+    config = calloc(1, sizeof(struct pam_config));
+    if (config == NULL) {
+        goto nomem;
+    }
+    args->config = config;
+
+    /*
+     * Do an initial scan to see if the realm is already set in our options.
+     * If so, make sure that's set before we start loading option values,
+     * since it affects what comes out of krb5.conf.
+     *
+     * We will then ignore args->config->realm, set later by option parsing,
+     * in favor of using args->realm extracted here.  However, the latter must
+     * exist to avoid throwing unknown option errors.
+     */
+    for (i = 0; i < argc; i++) {
+        if (strncmp(argv[i], "realm=", 6) != 0)
+            continue;
+        free(args->realm);
+        args->realm = strdup(&argv[i][strlen("realm=")]);
+        if (args->realm == NULL)
+            goto nomem;
+    }
+
+    if (!putil_args_defaults(args, options, optlen)) {
+        free(config);
+        putil_args_free(args);
+        return NULL;
+    }
+    if (!putil_args_krb5(args, "pam", options, optlen)) {
+        goto fail;
+    }
+    if (!putil_args_parse(args, argc, argv, options, optlen)) {
+        goto fail;
+    }
+    if (config->debug) {
+        args->debug = true;
+    }
+    if (config->silent) {
+        args->silent = true;
+    }
+
+    /* An empty banner should be treated the same as not having one. */
+    if (config->banner != NULL && config->banner[0] == '\0') {
+        free(config->banner);
+        config->banner = NULL;
+    }
+
+    /* Sanity-check try_first_pass, use_first_pass, and force_first_pass. */
+    if (config->force_first_pass && config->try_first_pass) {
+        putil_err(args, "force_first_pass set, ignoring try_first_pass");
+        config->try_first_pass = 0;
+    }
+    if (config->force_first_pass && config->use_first_pass) {
+        putil_err(args, "force_first_pass set, ignoring use_first_pass");
+        config->use_first_pass = 0;
+    }
+    if (config->use_first_pass && config->try_first_pass) {
+        putil_err(args, "use_first_pass set, ignoring try_first_pass");
+        config->try_first_pass = 0;
+    }
+
+    /*
+     * Don't set expose_account if we're using search_k5login.  The user will
+     * get a principal formed from the account into which they're logging in,
+     * which isn't the password they'll use (that's the whole point of
+     * search_k5login).
+     */
+    if (config->search_k5login) {
+        config->expose_account = 0;
+    }
+
+    /* UIDs are unsigned on some systems. */
+    if (config->minimum_uid < 0) {
+        config->minimum_uid = 0;
+    }
+
+    /*
+     * Warn if PKINIT options were set and PKINIT isn't supported.  The MIT
+     * method (krb5_get_init_creds_opt_set_pa) can't support use_pkinit.
+     */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT
+#    ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PA
+    if (config->try_pkinit) {
+        putil_err(args, "try_pkinit requested but PKINIT not available");
+    } else if (config->use_pkinit) {
+        putil_err(args, "use_pkinit requested but PKINIT not available");
+    }
+#    endif
+#    ifndef HAVE_KRB5_GET_PROMPT_TYPES
+    if (config->use_pkinit) {
+        putil_err(args, "use_pkinit requested but PKINIT cannot be enforced");
+    }
+#    endif
+#endif
+
+    /* Warn if the FAST option was set and FAST isn't supported. */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME
+    if (config->fast_ccache || config->anon_fast) {
+        putil_err(args, "fast_ccache or anon_fast requested but FAST not"
+                        " supported by Kerberos libraries");
+    }
+#endif
+
+    /* If tracing was requested enable it if possible. */
+#ifdef HAVE_KRB5_SET_TRACE_FILENAME
+    if (config->trace != NULL) {
+        krb5_error_code retval;
+
+        retval = krb5_set_trace_filename(args->ctx, config->trace);
+        if (retval == 0)
+            putil_debug(args, "enabled trace logging to %s", config->trace);
+        else
+            putil_err_krb5(args, retval, "cannot enable trace logging to %s",
+                           config->trace);
+    }
+#else
+    if (config->trace != NULL) {
+        putil_err(args, "trace logging requested but not supported");
+    }
+#endif
+
+    return args;
+
+nomem:
+    putil_crit(args, "cannot allocate memory: %s", strerror(errno));
+    free(config);
+    putil_args_free(args);
+    return NULL;
+
+fail:
+    pamk5_free(args);
+    return NULL;
+}
+
+
+/*
+ * Free the allocated args struct and any memory it points to.
+ */
+void
+pamk5_free(struct pam_args *args)
+{
+    struct pam_config *config;
+
+    if (args == NULL)
+        return;
+    config = args->config;
+    if (config != NULL) {
+        free(config->alt_auth_map);
+        free(config->banner);
+        free(config->ccache);
+        free(config->ccache_dir);
+        free(config->fast_ccache);
+        free(config->keytab);
+        free(config->pkinit_anchors);
+        free(config->pkinit_user);
+        vector_free(config->preauth_opt);
+        free(config->realm);
+        free(config->trace);
+        free(config->user_realm);
+        free(args->config);
+        args->config = NULL;
+    }
+    putil_args_free(args);
+}
diff --git a/module/pam_krb5.map b/module/pam_krb5.map
new file mode 100644
index 000000000000..b187908ee26a
--- /dev/null
+++ b/module/pam_krb5.map
@@ -0,0 +1,11 @@
+{
+    global:
+        pam_sm_acct_mgmt;
+        pam_sm_authenticate;
+        pam_sm_chauthtok;
+        pam_sm_close_session;
+        pam_sm_open_session;
+        pam_sm_setcred;
+    local:
+        *;
+};
diff --git a/module/pam_krb5.sym b/module/pam_krb5.sym
new file mode 100644
index 000000000000..1e7fc6b967c9
--- /dev/null
+++ b/module/pam_krb5.sym
@@ -0,0 +1,6 @@
+pam_sm_acct_mgmt
+pam_sm_authenticate
+pam_sm_chauthtok
+pam_sm_close_session
+pam_sm_open_session
+pam_sm_setcred
diff --git a/module/password.c b/module/password.c
new file mode 100644
index 000000000000..c1371234fa07
--- /dev/null
+++ b/module/password.c
@@ -0,0 +1,401 @@
+/*
+ * Kerberos password changing.
+ *
+ * Copyright 2005-2009, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Get the new password.  Store it in PAM_AUTHTOK if we obtain it and verify
+ * it successfully and return it in the pass parameter.  If pass is set to
+ * NULL, only store the new password in PAM_AUTHTOK.
+ *
+ * Returns a PAM error code, usually either PAM_AUTHTOK_ERR or PAM_SUCCESS.
+ */
+int
+pamk5_password_prompt(struct pam_args *args, char **pass)
+{
+    int pamret = PAM_AUTHTOK_ERR;
+    char *pass1 = NULL;
+    char *pass2;
+    PAM_CONST void *tmp;
+
+    /* Use the password from a previous module, if so configured. */
+    if (pass != NULL)
+        *pass = NULL;
+    if (args->config->use_authtok) {
+        pamret = pam_get_item(args->pamh, PAM_AUTHTOK, &tmp);
+        if (tmp == NULL) {
+            putil_debug_pam(args, pamret, "no stored password");
+            pamret = PAM_AUTHTOK_ERR;
+            goto done;
+        }
+        if (strlen(tmp) > PAM_MAX_RESP_SIZE - 1) {
+            putil_debug(args, "rejecting password longer than %d",
+                        PAM_MAX_RESP_SIZE - 1);
+            pamret = PAM_AUTHTOK_ERR;
+            goto done;
+        }
+        pass1 = strdup((const char *) tmp);
+    }
+
+    /* Prompt for the new password if necessary. */
+    if (pass1 == NULL) {
+        pamret = pamk5_get_password(args, "Enter new", &pass1);
+        if (pamret != PAM_SUCCESS) {
+            putil_debug_pam(args, pamret, "error getting new password");
+            pamret = PAM_AUTHTOK_ERR;
+            goto done;
+        }
+        if (strlen(pass1) > PAM_MAX_RESP_SIZE - 1) {
+            putil_debug(args, "rejecting password longer than %d",
+                        PAM_MAX_RESP_SIZE - 1);
+            pamret = PAM_AUTHTOK_ERR;
+            explicit_bzero(pass1, strlen(pass1));
+            free(pass1);
+            goto done;
+        }
+        pamret = pamk5_get_password(args, "Retype new", &pass2);
+        if (pamret != PAM_SUCCESS) {
+            putil_debug_pam(args, pamret, "error getting new password");
+            pamret = PAM_AUTHTOK_ERR;
+            explicit_bzero(pass1, strlen(pass1));
+            free(pass1);
+            goto done;
+        }
+        if (strcmp(pass1, pass2) != 0) {
+            putil_debug(args, "new passwords don't match");
+            pamk5_conv(args, "Passwords don't match", PAM_ERROR_MSG, NULL);
+            explicit_bzero(pass1, strlen(pass1));
+            free(pass1);
+            explicit_bzero(pass2, strlen(pass2));
+            free(pass2);
+            pamret = PAM_AUTHTOK_ERR;
+            goto done;
+        }
+        explicit_bzero(pass2, strlen(pass2));
+        free(pass2);
+
+        /* Save the new password for other modules. */
+        pamret = pam_set_item(args->pamh, PAM_AUTHTOK, pass1);
+        if (pamret != PAM_SUCCESS) {
+            putil_err_pam(args, pamret, "error storing password");
+            pamret = PAM_AUTHTOK_ERR;
+            explicit_bzero(pass1, strlen(pass1));
+            free(pass1);
+            goto done;
+        }
+    }
+    if (pass != NULL)
+        *pass = pass1;
+    else {
+        explicit_bzero(pass1, strlen(pass1));
+        free(pass1);
+    }
+
+done:
+    return pamret;
+}
+
+
+/*
+ * We've obtained credentials for the password changing interface and gotten
+ * the new password, so do the work of actually changing the password.
+ */
+static int
+change_password(struct pam_args *args, const char *pass)
+{
+    struct context *ctx;
+    int retval = PAM_SUCCESS;
+    int result_code;
+    krb5_data result_code_string, result_string;
+    const char *message;
+
+    /* Sanity check. */
+    if (args == NULL || args->config == NULL || args->config->ctx == NULL
+        || args->config->ctx->creds == NULL)
+        return PAM_AUTHTOK_ERR;
+    ctx = args->config->ctx;
+
+    /*
+     * The actual change.
+     *
+     * There are two password protocols in use: the change password protocol,
+     * which doesn't allow specification of the principal, and the newer set
+     * password protocol, which does.  For our purposes, either will do.
+     *
+     * Both Heimdal and MIT provide krb5_set_password.  With Heimdal,
+     * krb5_change_password is deprecated and krb5_set_password tries both
+     * protocols in turn, so will work with new and old servers.  With MIT,
+     * krb5_set_password will use the old protocol if the principal is NULL
+     * and the new protocol if it is not.
+     *
+     * We would like to just use krb5_set_password with a NULL principal
+     * argument, but Heimdal 1.5 uses the default principal for the local user
+     * rather than the principal from the credentials, so we need to pass in a
+     * principal for Heimdal.  So we're stuck with an #ifdef.
+     */
+#ifdef HAVE_KRB5_MIT
+    retval =
+        krb5_set_password(ctx->context, ctx->creds, (char *) pass, NULL,
+                          &result_code, &result_code_string, &result_string);
+#else
+    retval =
+        krb5_set_password(ctx->context, ctx->creds, (char *) pass, ctx->princ,
+                          &result_code, &result_code_string, &result_string);
+#endif
+
+    /* Everything from here on is just handling diagnostics and output. */
+    if (retval != 0) {
+        putil_debug_krb5(args, retval, "krb5_change_password failed");
+        message = krb5_get_error_message(ctx->context, retval);
+        pamk5_conv(args, message, PAM_ERROR_MSG, NULL);
+        krb5_free_error_message(ctx->context, message);
+        retval = PAM_AUTHTOK_ERR;
+        goto done;
+    }
+    if (result_code != 0) {
+        char *output;
+        int status;
+
+        putil_debug(args, "krb5_change_password: %s",
+                    (char *) result_code_string.data);
+        retval = PAM_AUTHTOK_ERR;
+        status =
+            asprintf(&output, "%.*s%s%.*s", (int) result_code_string.length,
+                     (char *) result_code_string.data,
+                     result_string.length == 0 ? "" : ": ",
+                     (int) result_string.length, (char *) result_string.data);
+        if (status < 0)
+            putil_crit(args, "asprintf failed: %s", strerror(errno));
+        else {
+            pamk5_conv(args, output, PAM_ERROR_MSG, NULL);
+            free(output);
+        }
+    }
+    krb5_free_data_contents(ctx->context, &result_string);
+    krb5_free_data_contents(ctx->context, &result_code_string);
+
+done:
+    /*
+     * On failure, when clear_on_fail is set, we set the new password to NULL
+     * so that subsequent password change PAM modules configured with
+     * use_authtok will also fail.  Otherwise, since the order of the stack is
+     * fixed once the pre-check function runs, subsequent modules would
+     * continue even when we failed.
+     */
+    if (retval != PAM_SUCCESS && args->config->clear_on_fail) {
+        if (pam_set_item(args->pamh, PAM_AUTHTOK, NULL))
+            putil_err(args, "error clearing password");
+    }
+    return retval;
+}
+
+
+/*
+ * Change a user's password.  Returns a PAM status code for success or
+ * failure.  This does the work of pam_sm_chauthtok, but also needs to be
+ * called from pam_sm_authenticate if we're working around a library that
+ * can't handle password change during authentication.
+ *
+ * If the second argument is true, only do the authentication without actually
+ * doing the password change (PAM_PRELIM_CHECK).
+ */
+int
+pamk5_password_change(struct pam_args *args, bool only_auth)
+{
+    struct context *ctx = args->config->ctx;
+    int pamret = PAM_SUCCESS;
+    char *pass = NULL;
+
+    /*
+     * Authenticate to the password changing service using the old password.
+     */
+    if (ctx->creds == NULL) {
+        pamret = pamk5_password_auth(args, "kadmin/changepw", &ctx->creds);
+        if (pamret == PAM_SERVICE_ERR || pamret == PAM_AUTH_ERR)
+            pamret = PAM_AUTHTOK_RECOVER_ERR;
+        if (pamret != PAM_SUCCESS)
+            goto done;
+    }
+
+    /*
+     * Now, get the new password and change it unless we're just doing the
+     * first check.
+     */
+    if (only_auth)
+        goto done;
+    pamret = pamk5_password_prompt(args, &pass);
+    if (pamret != PAM_SUCCESS)
+        goto done;
+    pamret = change_password(args, pass);
+    if (pamret == PAM_SUCCESS)
+        pam_syslog(args->pamh, LOG_INFO, "user %s changed Kerberos password",
+                   ctx->name);
+
+done:
+    if (pass != NULL) {
+        explicit_bzero(pass, strlen(pass));
+        free(pass);
+    }
+    return pamret;
+}
+
+
+/*
+ * The function underlying the main PAM interface for password changing.
+ * Performs preliminary checks, user notification, and any reauthentication
+ * that's required.
+ *
+ * If the second argument is true, only do the authentication without actually
+ * doing the password change (PAM_PRELIM_CHECK).
+ */
+int
+pamk5_password(struct pam_args *args, bool only_auth)
+{
+    struct context *ctx = NULL;
+    int pamret, status;
+    PAM_CONST char *user;
+    char *pass = NULL;
+    bool set_context = false;
+
+    /*
+     * Check whether we should ignore this user.
+     *
+     * If we do ignore this user, and we're not in the preliminary check
+     * phase, still prompt the user for the new password, but suppress our
+     * banner.  This is a little strange, but it allows another module to be
+     * stacked behind pam-krb5 with use_authtok and have it still work for
+     * ignored users.
+     *
+     * We ignore the return status when prompting for the new password in this
+     * case.  The worst thing that can happen is to fail to get the password,
+     * in which case the other module will fail (or might even not care).
+     */
+    if (args->config->ignore_root || args->config->minimum_uid > 0) {
+        status = pam_get_user(args->pamh, &user, NULL);
+        if (status == PAM_SUCCESS && pamk5_should_ignore(args, user)) {
+            if (!only_auth) {
+                if (args->config->banner != NULL) {
+                    free(args->config->banner);
+                    args->config->banner = NULL;
+                }
+                pamk5_password_prompt(args, NULL);
+            }
+            pamret = PAM_IGNORE;
+            goto done;
+        }
+    }
+
+    /*
+     * If we weren't able to find an existing context to use, we're going
+     * into this fresh and need to create a new context.
+     */
+    if (args->config->ctx == NULL) {
+        pamret = pamk5_context_new(args);
+        if (pamret != PAM_SUCCESS) {
+            putil_debug_pam(args, pamret, "creating context failed");
+            pamret = PAM_AUTHTOK_ERR;
+            goto done;
+        }
+        pamret = pam_set_data(args->pamh, "pam_krb5", args->config->ctx,
+                              pamk5_context_destroy);
+        if (pamret != PAM_SUCCESS) {
+            putil_err_pam(args, pamret, "cannot set context data");
+            pamret = PAM_AUTHTOK_ERR;
+            goto done;
+        }
+        set_context = true;
+    }
+    ctx = args->config->ctx;
+
+    /*
+     * Tell the user what's going on if we're handling an expiration, but not
+     * if we were configured to use the same password as an earlier module in
+     * the stack.  The correct behavior here is not clear (what if the
+     * Kerberos password expired but the other one didn't?), but warning
+     * unconditionally leads to a strange message in the middle of doing the
+     * password change.
+     */
+    if (ctx->expired && ctx->creds == NULL)
+        if (!args->config->force_first_pass && !args->config->use_first_pass)
+            pamk5_conv(args, "Password expired.  You must change it now.",
+                       PAM_TEXT_INFO, NULL);
+
+    /*
+     * Do the password change.  This may only get tickets if we're doing the
+     * preliminary check phase.
+     */
+    pamret = pamk5_password_change(args, only_auth);
+    if (only_auth)
+        goto done;
+
+    /*
+     * If we were handling a forced password change for an expired password,
+     * now try to get a ticket cache with the new password.  If this succeeds,
+     * clear the expired flag in the context.
+     */
+    if (pamret == PAM_SUCCESS && ctx->expired) {
+        krb5_creds *creds = NULL;
+        char *principal;
+        krb5_error_code retval;
+
+        putil_debug(args, "obtaining credentials with new password");
+        args->config->force_first_pass = 1;
+        pamret = pamk5_password_auth(args, NULL, &creds);
+        if (pamret != PAM_SUCCESS)
+            goto done;
+        retval = krb5_unparse_name(ctx->context, ctx->princ, &principal);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "krb5_unparse_name failed");
+            pam_syslog(args->pamh, LOG_INFO,
+                       "user %s authenticated as UNKNOWN", ctx->name);
+        } else {
+            pam_syslog(args->pamh, LOG_INFO, "user %s authenticated as %s",
+                       ctx->name, principal);
+            krb5_free_unparsed_name(ctx->context, principal);
+        }
+        ctx->expired = false;
+        pamret = pamk5_cache_init_random(args, creds);
+        krb5_free_cred_contents(ctx->context, creds);
+        free(creds);
+    }
+
+done:
+    if (pass != NULL) {
+        explicit_bzero(pass, strlen(pass));
+        free(pass);
+    }
+
+    /*
+     * Don't free our Kerberos context if we set a context, since the context
+     * will take care of that.
+     */
+    if (set_context)
+        args->ctx = NULL;
+
+    if (pamret != PAM_SUCCESS) {
+        if (pamret == PAM_SERVICE_ERR || pamret == PAM_AUTH_ERR)
+            pamret = PAM_AUTHTOK_ERR;
+        if (pamret == PAM_AUTHINFO_UNAVAIL)
+            pamret = PAM_AUTHTOK_ERR;
+    }
+    return pamret;
+}
diff --git a/module/prompting.c b/module/prompting.c
new file mode 100644
index 000000000000..506fb8fd2b22
--- /dev/null
+++ b/module/prompting.c
@@ -0,0 +1,481 @@
+/*
+ * Prompt users for information.
+ *
+ * Handles all interaction with the PAM conversation, either directly or
+ * indirectly through the Kerberos libraries.
+ *
+ * Copyright 2005-2007, 2009, 2014, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <assert.h>
+#include <errno.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Build a password prompt.
+ *
+ * The default prompt is simply "Password:".  Optionally, a string describing
+ * the type of password is passed in as prefix.  In this case, the prompts is:
+ *
+ *     <prefix> <banner> password:
+ *
+ * where <prefix> is the argument passed and <banner> is the value of
+ * args->banner (defaulting to "Kerberos").
+ *
+ * If args->config->expose_account is set, we append the principal name (taken
+ * from args->config->ctx->princ) before the colon, so the prompts are:
+ *
+ *     Password for <principal>:
+ *     <prefix> <banner> password for <principal>:
+ *
+ * Normally this is not done because it exposes the realm and possibly any
+ * username to principal mappings, plus may confuse some ssh clients if sshd
+ * passes the prompt back to the client.
+ *
+ * Returns newly-allocated memory or NULL on failure.  The caller is
+ * responsible for freeing.
+ */
+static char *
+build_password_prompt(struct pam_args *args, const char *prefix)
+{
+    struct context *ctx = args->config->ctx;
+    char *principal = NULL;
+    const char *banner, *bspace;
+    char *prompt, *tmp;
+    bool expose_account;
+    krb5_error_code k5_errno;
+    int retval;
+
+    /* If we're exposing the account, format the principal name. */
+    if (args->config->expose_account || prefix != NULL)
+        if (ctx != NULL && ctx->context != NULL && ctx->princ != NULL) {
+            k5_errno = krb5_unparse_name(ctx->context, ctx->princ, &principal);
+            if (k5_errno != 0)
+                putil_debug_krb5(args, k5_errno, "krb5_unparse_name failed");
+        }
+
+    /* Build the part of the prompt without the principal name. */
+    if (prefix == NULL)
+        tmp = strdup("Password");
+    else {
+        banner = (args->config->banner == NULL) ? "" : args->config->banner;
+        bspace = (args->config->banner == NULL) ? "" : " ";
+        retval = asprintf(&tmp, "%s%s%s password", prefix, bspace, banner);
+        if (retval < 0)
+            tmp = NULL;
+    }
+    if (tmp == NULL)
+        goto fail;
+
+    /* Add the principal, if desired, and the colon and space. */
+    expose_account = args->config->expose_account && principal != NULL;
+    if (expose_account)
+        retval = asprintf(&prompt, "%s for %s: ", tmp, principal);
+    else
+        retval = asprintf(&prompt, "%s: ", tmp);
+    free(tmp);
+    if (retval < 0)
+        goto fail;
+
+    /* Clean up and return. */
+    if (principal != NULL)
+        krb5_free_unparsed_name(ctx->context, principal);
+    return prompt;
+
+fail:
+    if (principal != NULL)
+        krb5_free_unparsed_name(ctx->context, principal);
+    return NULL;
+}
+
+
+/*
+ * Prompt for a password.
+ *
+ * The entered password is stored in password.  The memory is allocated by the
+ * application and returned as part of the PAM conversation.  It must be freed
+ * by the caller.
+ *
+ * Returns a PAM success or error code.
+ */
+int
+pamk5_get_password(struct pam_args *args, const char *prefix, char **password)
+{
+    char *prompt;
+    int retval;
+
+    prompt = build_password_prompt(args, prefix);
+    if (prompt == NULL)
+        return PAM_BUF_ERR;
+    retval = pamk5_conv(args, prompt, PAM_PROMPT_ECHO_OFF, password);
+    free(prompt);
+    return retval;
+}
+
+
+/*
+ * Get information from the user or display a message to the user, as
+ * determined by type.  If PAM_SILENT was given, don't pass any text or error
+ * messages to the application.
+ *
+ * The response variable is set to the response returned by the conversation
+ * function on a successful return if a response was desired.  Caller is
+ * responsible for freeing it.
+ */
+int
+pamk5_conv(struct pam_args *args, const char *message, int type,
+           char **response)
+{
+    int pamret;
+    struct pam_message msg;
+    PAM_CONST struct pam_message *pmsg;
+    struct pam_response *resp = NULL;
+    struct pam_conv *conv;
+    int want_reply;
+
+    if (args->silent && (type == PAM_ERROR_MSG || type == PAM_TEXT_INFO))
+        return PAM_SUCCESS;
+    pamret = pam_get_item(args->pamh, PAM_CONV, (PAM_CONST void **) &conv);
+    if (pamret != PAM_SUCCESS)
+        return pamret;
+    if (conv->conv == NULL)
+        return PAM_CONV_ERR;
+    pmsg = &msg;
+    msg.msg_style = type;
+    msg.msg = (PAM_CONST char *) message;
+    pamret = conv->conv(1, &pmsg, &resp, conv->appdata_ptr);
+    if (pamret != PAM_SUCCESS)
+        return pamret;
+
+    /*
+     * Only expect a response for PAM_PROMPT_ECHO_OFF or PAM_PROMPT_ECHO_ON
+     * message types.  This mildly annoying logic makes sure that everything
+     * is freed properly (except the response itself, if wanted, which is
+     * returned for the caller to free) and that the success status is set
+     * based on whether the reply matched our expectations.
+     *
+     * If we got a reply even though we didn't want one, still overwrite the
+     * reply before freeing in case it was a password.
+     */
+    want_reply = (type == PAM_PROMPT_ECHO_OFF || type == PAM_PROMPT_ECHO_ON);
+    if (resp == NULL || resp->resp == NULL)
+        pamret = want_reply ? PAM_CONV_ERR : PAM_SUCCESS;
+    else if (want_reply && response != NULL) {
+        *response = resp->resp;
+        pamret = PAM_SUCCESS;
+    } else {
+        explicit_bzero(resp->resp, strlen(resp->resp));
+        free(resp->resp);
+        pamret = want_reply ? PAM_SUCCESS : PAM_CONV_ERR;
+    }
+    free(resp);
+    return pamret;
+}
+
+
+/*
+ * Allocate memory to copy all of the prompts into a pam_message.
+ *
+ * Linux PAM and Solaris PAM expect different things here.  Solaris PAM
+ * expects to receive a pointer to a pointer to an array of pam_message
+ * structs.  Linux PAM expects to receive a pointer to an array of pointers to
+ * pam_message structs.  In order for the module to work with either PAM
+ * implementation, we need to set up a structure that is valid either way you
+ * look at it.
+ *
+ * We do this by making msg point to the array of struct pam_message pointers
+ * (what Linux PAM expects), and then make the first one of those pointers
+ * point to the array of pam_message structs.  Solaris will then be happy,
+ * looking at only the first element of the outer array and finding it
+ * pointing to the inner array.  Then, for Linux, we point the other elements
+ * of the outer array to the storage allocated in the inner array.
+ *
+ * All this also means we have to be careful how we free the resulting
+ * structure since it's double-linked in a subtle way.  Thankfully, we get to
+ * free it ourselves.
+ */
+static struct pam_message **
+allocate_pam_message(size_t total_prompts)
+{
+    struct pam_message **msg;
+    size_t i;
+
+    msg = calloc(total_prompts, sizeof(struct pam_message *));
+    if (msg == NULL)
+        return NULL;
+    *msg = calloc(total_prompts, sizeof(struct pam_message));
+    if (*msg == NULL) {
+        free(msg);
+        return NULL;
+    }
+    for (i = 1; i < total_prompts; i++)
+        msg[i] = msg[0] + i;
+    return msg;
+}
+
+
+/*
+ * Free the structure created by allocate_pam_message.
+ */
+static void
+free_pam_message(struct pam_message **msg, size_t total_prompts)
+{
+    size_t i;
+
+    for (i = 0; i < total_prompts; i++)
+        free((char *) msg[i]->msg);
+    free(*msg);
+    free(msg);
+}
+
+
+/*
+ * Free the responses returned by the conversation function.  These may
+ * contain passwords, so we overwrite them before we free them.
+ */
+static void
+free_pam_responses(struct pam_response *resp, size_t total_prompts)
+{
+    size_t i;
+
+    if (resp == NULL)
+        return;
+    for (i = 0; i < total_prompts; i++) {
+        if (resp[i].resp != NULL) {
+            explicit_bzero(resp[i].resp, strlen(resp[i].resp));
+            free(resp[i].resp);
+        }
+    }
+    free(resp);
+}
+
+
+/*
+ * Format a Kerberos prompt into a PAM prompt.  Takes a krb5_prompt as input
+ * and writes the resulting PAM prompt into a struct pam_message.
+ */
+static krb5_error_code
+format_prompt(krb5_prompt *prompt, struct pam_message *message)
+{
+    size_t len = strlen(prompt->prompt);
+    bool has_colon;
+    const char *colon;
+    int retval, style;
+
+    /*
+     * Heimdal adds the trailing colon and space, while MIT does not.
+     * Work around the difference by looking to see if there's a trailing
+     * colon and space already and only adding it if there is not.
+     */
+    has_colon = (len > 2 && memcmp(&prompt->prompt[len - 2], ": ", 2) == 0);
+    colon = has_colon ? "" : ": ";
+    retval = asprintf((char **) &message->msg, "%s%s", prompt->prompt, colon);
+    if (retval < 0)
+        return retval;
+    style = prompt->hidden ? PAM_PROMPT_ECHO_OFF : PAM_PROMPT_ECHO_ON;
+    message->msg_style = style;
+    return 0;
+}
+
+
+/*
+ * Given an array of struct pam_response elements, record the responses in the
+ * corresponding krb5_prompt structures.
+ */
+static krb5_error_code
+record_prompt_answers(struct pam_response *resp, int num_prompts,
+                      krb5_prompt *prompts)
+{
+    int i;
+
+    for (i = 0; i < num_prompts; i++) {
+        size_t len, allowed;
+
+        if (resp[i].resp == NULL)
+            return KRB5_LIBOS_CANTREADPWD;
+        len = strlen(resp[i].resp);
+        allowed = prompts[i].reply->length;
+        if (allowed == 0 || len > allowed - 1)
+            return KRB5_LIBOS_CANTREADPWD;
+
+        /*
+         * Since the first version of this module, it has copied a nul
+         * character into the prompt data buffer for MIT Kerberos with the
+         * note that "other applications expect it to be there."  I suspect
+         * this is incorrect and nothing cares about this nul, but have
+         * preserved this behavior out of an abundance of caution.
+         *
+         * Note that it shortens the maximum response length we're willing to
+         * accept by one (implemented above) and is the source of one prior
+         * security vulnerability.
+         */
+        memcpy(prompts[i].reply->data, resp[i].resp, len + 1);
+        prompts[i].reply->length = (unsigned int) len;
+    }
+    return 0;
+}
+
+
+/*
+ * This is the generic prompting function called by both MIT Kerberos and
+ * Heimdal prompting implementations.
+ *
+ * There are a lot of structures and different layers of code at work here,
+ * making this code quite confusing.  This function is a prompter function to
+ * pass into the Kerberos library, in particular krb5_get_init_creds_password.
+ * It is used by the Kerberos library to prompt for a password if need be, and
+ * also to prompt for password changes if the password was expired.
+ *
+ * The purpose of this function is to serve as glue between the Kerberos
+ * library and the application (by way of the PAM glue).  PAM expects us to
+ * pass back to the conversation function an array of prompts and receive from
+ * the application an array of responses to those prompts.  We pass the
+ * application an array of struct pam_message pointers, and the application
+ * passes us an array of struct pam_response pointers.
+ *
+ * Kerberos, meanwhile, passes us in an array of krb5_prompt structs.  This
+ * struct contains the prompt, a flag saying whether to suppress echoing of
+ * what the user types for that prompt, and a buffer into which to store the
+ * response.
+ *
+ * Therefore, what we're doing here is copying the prompts from the
+ * krb5_prompt structs into pam_message structs, calling the conversation
+ * function, and then copying the responses back out of pam_response structs
+ * into the krb5_prompt structs to return to the Kerberos library.
+ */
+krb5_error_code
+pamk5_prompter_krb5(krb5_context context UNUSED, void *data, const char *name,
+                    const char *banner, int num_prompts, krb5_prompt *prompts)
+{
+    struct pam_args *args = data;
+    int current_prompt, retval, pamret, i, offset;
+    int total_prompts = num_prompts;
+    struct pam_message **msg;
+    struct pam_response *resp = NULL;
+    struct pam_conv *conv;
+
+    /* Treat the name and banner as prompts that doesn't need input. */
+    if (name != NULL && !args->silent)
+        total_prompts++;
+    if (banner != NULL && !args->silent)
+        total_prompts++;
+
+    /* If we have zero prompts, do nothing, silently. */
+    if (total_prompts == 0)
+        return 0;
+
+    /* Obtain the conversation function from the application. */
+    pamret = pam_get_item(args->pamh, PAM_CONV, (PAM_CONST void **) &conv);
+    if (pamret != 0)
+        return KRB5_LIBOS_CANTREADPWD;
+    if (conv->conv == NULL)
+        return KRB5_LIBOS_CANTREADPWD;
+
+    /* Allocate memory to copy all of the prompts into a pam_message. */
+    msg = allocate_pam_message(total_prompts);
+    if (msg == NULL)
+        return ENOMEM;
+
+    /* current_prompt is an index into msg and a count when we're done. */
+    current_prompt = 0;
+    if (name != NULL && !args->silent) {
+        msg[current_prompt]->msg = strdup(name);
+        if (msg[current_prompt]->msg == NULL) {
+            retval = ENOMEM;
+            goto cleanup;
+        }
+        msg[current_prompt]->msg_style = PAM_TEXT_INFO;
+        current_prompt++;
+    }
+    if (banner != NULL && !args->silent) {
+        assert(current_prompt < total_prompts);
+        msg[current_prompt]->msg = strdup(banner);
+        if (msg[current_prompt]->msg == NULL) {
+            retval = ENOMEM;
+            goto cleanup;
+        }
+        msg[current_prompt]->msg_style = PAM_TEXT_INFO;
+        current_prompt++;
+    }
+    for (i = 0; i < num_prompts; i++) {
+        assert(current_prompt < total_prompts);
+        retval = format_prompt(&prompts[i], msg[current_prompt]);
+        if (retval < 0)
+            goto cleanup;
+        current_prompt++;
+    }
+
+    /* Call into the application conversation function. */
+    pamret = conv->conv(total_prompts, (PAM_CONST struct pam_message **) msg,
+                        &resp, conv->appdata_ptr);
+    if (pamret != 0 || resp == NULL) {
+        retval = KRB5_LIBOS_CANTREADPWD;
+        goto cleanup;
+    }
+
+    /*
+     * Record the answers in the Kerberos data structure.  If name or banner
+     * were provided, skip over the initial PAM responses that correspond to
+     * those messages.
+     */
+    offset = 0;
+    if (name != NULL && !args->silent)
+        offset++;
+    if (banner != NULL && !args->silent)
+        offset++;
+    retval = record_prompt_answers(resp + offset, num_prompts, prompts);
+
+cleanup:
+    free_pam_message(msg, total_prompts);
+    free_pam_responses(resp, total_prompts);
+    return retval;
+}
+
+
+/*
+ * This is a special version of krb5_prompter_krb5 that returns an error if
+ * the Kerberos library asks for a password.  It is only used with MIT
+ * Kerberos as part of the implementation of try_pkinit and use_pkinit.
+ * (Heimdal has a different API for PKINIT authentication.)
+ */
+#ifdef HAVE_KRB5_GET_PROMPT_TYPES
+krb5_error_code
+pamk5_prompter_krb5_no_password(krb5_context context, void *data,
+                                const char *name, const char *banner,
+                                int num_prompts, krb5_prompt *prompts)
+{
+    krb5_prompt_type *ptypes;
+    int i;
+
+    ptypes = krb5_get_prompt_types(context);
+    for (i = 0; i < num_prompts; i++)
+        if (ptypes != NULL && ptypes[i] == KRB5_PROMPT_TYPE_PASSWORD)
+            return KRB5_LIBOS_CANTREADPWD;
+    return pamk5_prompter_krb5(context, data, name, banner, num_prompts,
+                               prompts);
+}
+#else  /* !HAVE_KRB5_GET_PROMPT_TYPES */
+krb5_error_code
+pamk5_prompter_krb5_no_password(krb5_context context, void *data,
+                                const char *name, const char *banner,
+                                int num_prompts, krb5_prompt *prompts)
+{
+    return pamk5_prompter_krb5(context, data, name, banner, num_prompts,
+                               prompts);
+}
+#endif /* !HAVE_KRB5_GET_PROMPT_TYPES */
diff --git a/module/public.c b/module/public.c
new file mode 100644
index 000000000000..44d5f7736794
--- /dev/null
+++ b/module/public.c
@@ -0,0 +1,260 @@
+/*
+ * The public APIs of the pam-afs-session PAM module.
+ *
+ * Provides the public pam_sm_authenticate, pam_sm_setcred,
+ * pam_sm_open_session, pam_sm_close_session, and pam_sm_chauthtok functions.
+ * These must all be specified in the same file to work with the symbol export
+ * and linking mechanism used in OpenPAM, since OpenPAM will mark them all as
+ * static functions and export a function table instead.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2005-2009, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+/* Get prototypes for all of the functions. */
+#define PAM_SM_ACCOUNT
+#define PAM_SM_AUTH
+#define PAM_SM_PASSWORD
+#define PAM_SM_SESSION
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * The main PAM interface for authorization checking.
+ */
+PAM_EXTERN int
+pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
+{
+    struct pam_args *args;
+    int pamret;
+
+    args = pamk5_init(pamh, flags, argc, argv);
+    if (args == NULL) {
+        pamret = PAM_AUTH_ERR;
+        goto done;
+    }
+    pamret = pamk5_context_fetch(args);
+    ENTRY(args, flags);
+
+    /*
+     * Succeed if the user did not use krb5 to login.  Ideally, we should
+     * probably fail and require that the user set up policy properly in their
+     * PAM configuration, but it's not common for the user to do so and that's
+     * not how other krb5 PAM modules work.  If we don't do this, root logins
+     * with the system root password fail, which is a bad failure mode.
+     */
+    if (pamret != PAM_SUCCESS || args->config->ctx == NULL) {
+        pamret = PAM_IGNORE;
+        putil_debug(args, "skipping non-Kerberos login");
+        goto done;
+    }
+
+    pamret = pamk5_account(args);
+
+done:
+    EXIT(args, pamret);
+    pamk5_free(args);
+    return pamret;
+}
+
+
+/*
+ * The main PAM interface for authentication.  We also do authorization checks
+ * here, since many applications don't call pam_acct_mgmt.
+ */
+PAM_EXTERN int
+pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
+{
+    struct pam_args *args;
+    int pamret;
+
+    args = pamk5_init(pamh, flags, argc, argv);
+    if (args == NULL) {
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    ENTRY(args, flags);
+
+    pamret = pamk5_authenticate(args);
+
+done:
+    EXIT(args, pamret);
+    pamk5_free(args);
+    return pamret;
+}
+
+
+/*
+ * The main PAM interface, in the auth stack, for establishing credentials
+ * obtained during authentication.
+ */
+PAM_EXTERN int
+pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
+{
+    struct pam_args *args;
+    bool refresh = false;
+    int pamret, allow;
+
+    args = pamk5_init(pamh, flags, argc, argv);
+    if (args == NULL) {
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    ENTRY(args, flags);
+
+    /*
+     * Special case.  Just free the context data, which will destroy the
+     * ticket cache as well.
+     */
+    if (flags & PAM_DELETE_CRED) {
+        pamret = pam_set_data(pamh, "pam_krb5", NULL, NULL);
+        if (pamret != PAM_SUCCESS)
+            putil_err_pam(args, pamret, "cannot clear context data");
+        goto done;
+    }
+
+    /*
+     * Reinitialization requested, which means that rather than creating a new
+     * ticket cache and setting KRB5CCNAME, we should figure out the existing
+     * ticket cache and just refresh its tickets.
+     */
+    if (flags & (PAM_REINITIALIZE_CRED | PAM_REFRESH_CRED))
+        refresh = true;
+    if (refresh && (flags & PAM_ESTABLISH_CRED)) {
+        putil_err(args, "requested establish and refresh at the same time");
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    allow = PAM_REINITIALIZE_CRED | PAM_REFRESH_CRED | PAM_ESTABLISH_CRED;
+    if (!(flags & allow)) {
+        putil_err(args, "invalid pam_setcred flags %d", flags);
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+
+    /* Do the work. */
+    pamret = pamk5_setcred(args, refresh);
+
+    /*
+     * Never return PAM_IGNORE from pam_setcred since this can confuse the
+     * Linux PAM library, at least for applications that call pam_setcred
+     * without pam_authenticate (possibly because authentication was done
+     * some other way), when used with jumps with the [] syntax.  Since we
+     * do nothing in this case, and since the stack is already frozen from
+     * the auth group, success makes sense.
+     *
+     * Don't return an error here or the PAM stack will fail if pam-krb5 is
+     * used with [success=ok default=1], since jumps are treated as required
+     * during the second pass with pam_setcred.
+     */
+    if (pamret == PAM_IGNORE)
+        pamret = PAM_SUCCESS;
+
+done:
+    EXIT(args, pamret);
+    pamk5_free(args);
+    return pamret;
+}
+
+
+/*
+ * The main PAM interface for password changing.
+ */
+PAM_EXTERN int
+pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
+{
+    struct pam_args *args;
+    int pamret;
+
+    args = pamk5_init(pamh, flags, argc, argv);
+    if (args == NULL) {
+        pamret = PAM_AUTHTOK_ERR;
+        goto done;
+    }
+    pamk5_context_fetch(args);
+    ENTRY(args, flags);
+
+    /* We only support password changes. */
+    if (!(flags & PAM_UPDATE_AUTHTOK) && !(flags & PAM_PRELIM_CHECK)) {
+        putil_err(args, "invalid pam_chauthtok flags %d", flags);
+        pamret = PAM_AUTHTOK_ERR;
+        goto done;
+    }
+
+    pamret = pamk5_password(args, (flags & PAM_PRELIM_CHECK) != 0);
+
+done:
+    EXIT(args, pamret);
+    pamk5_free(args);
+    return pamret;
+}
+
+
+/*
+ * The main PAM interface for opening a session.
+ */
+PAM_EXTERN int
+pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv)
+{
+    struct pam_args *args;
+    int pamret;
+
+    args = pamk5_init(pamh, flags, argc, argv);
+    if (args == NULL) {
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    ENTRY(args, flags);
+    pamret = pamk5_setcred(args, 0);
+
+done:
+    EXIT(args, pamret);
+    pamk5_free(args);
+    return pamret;
+}
+
+
+/*
+ * The main PAM interface for closing a session.
+ */
+PAM_EXTERN int
+pam_sm_close_session(pam_handle_t *pamh, int flags, int argc,
+                     const char **argv)
+{
+    struct pam_args *args;
+    int pamret;
+
+    args = pamk5_init(pamh, flags, argc, argv);
+    if (args == NULL) {
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    ENTRY(args, flags);
+    pamret = pam_set_data(pamh, "pam_krb5", NULL, NULL);
+    if (pamret != PAM_SUCCESS)
+        putil_err_pam(args, pamret, "cannot clear context data");
+
+done:
+    EXIT(args, pamret);
+    pamk5_free(args);
+    return pamret;
+}
+
+
+/* OpenPAM uses this macro to set up a table of entry points. */
+#ifdef PAM_MODULE_ENTRY
+PAM_MODULE_ENTRY("pam_krb5");
+#endif
diff --git a/module/setcred.c b/module/setcred.c
new file mode 100644
index 000000000000..5b98b2919c88
--- /dev/null
+++ b/module/setcred.c
@@ -0,0 +1,474 @@
+/*
+ * Ticket creation routines for pam-krb5.
+ *
+ * pam_setcred and pam_open_session need to do similar but not identical work
+ * to create the user's ticket cache.  The shared code is abstracted here into
+ * the pamk5_setcred function.
+ *
+ * Copyright 2005-2009, 2014, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <pwd.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Given a cache name and an existing cache, initialize a new cache, store the
+ * credentials from the existing cache in it, and return a pointer to the new
+ * cache in the cache argument.  Returns either PAM_SUCCESS or
+ * PAM_SERVICE_ERR.
+ */
+static int
+cache_init_from_cache(struct pam_args *args, const char *ccname,
+                      krb5_ccache old, krb5_ccache *cache)
+{
+    struct context *ctx;
+    krb5_creds creds;
+    krb5_cc_cursor cursor;
+    int pamret;
+    krb5_error_code status;
+
+    *cache = NULL;
+    memset(&creds, 0, sizeof(creds));
+    if (args == NULL || args->config == NULL || args->config->ctx == NULL
+        || args->config->ctx->context == NULL)
+        return PAM_SERVICE_ERR;
+    if (old == NULL)
+        return PAM_SERVICE_ERR;
+    ctx = args->config->ctx;
+    status = krb5_cc_start_seq_get(ctx->context, old, &cursor);
+    if (status != 0) {
+        putil_err_krb5(args, status, "cannot open new credentials");
+        return PAM_SERVICE_ERR;
+    }
+    status = krb5_cc_next_cred(ctx->context, old, &cursor, &creds);
+    if (status != 0) {
+        putil_err_krb5(args, status, "cannot read new credentials");
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    pamret = pamk5_cache_init(args, ccname, &creds, cache);
+    if (pamret != PAM_SUCCESS) {
+        krb5_free_cred_contents(ctx->context, &creds);
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    krb5_free_cred_contents(ctx->context, &creds);
+
+    /*
+     * There probably won't be any additional credentials, but check for them
+     * and copy them just in case.
+     */
+    while (krb5_cc_next_cred(ctx->context, old, &cursor, &creds) == 0) {
+        status = krb5_cc_store_cred(ctx->context, *cache, &creds);
+        krb5_free_cred_contents(ctx->context, &creds);
+        if (status != 0) {
+            putil_err_krb5(args, status,
+                           "cannot store additional credentials"
+                           " in %s",
+                           ccname);
+            pamret = PAM_SERVICE_ERR;
+            goto done;
+        }
+    }
+    pamret = PAM_SUCCESS;
+
+done:
+    krb5_cc_end_seq_get(ctx->context, ctx->cache, &cursor);
+    if (pamret != PAM_SUCCESS && *cache != NULL) {
+        krb5_cc_destroy(ctx->context, *cache);
+        *cache = NULL;
+    }
+    return pamret;
+}
+
+
+/*
+ * Determine the name of a new ticket cache.  Handles ccache and ccache_dir
+ * PAM options and returns newly allocated memory.
+ *
+ * The ccache option, if set, contains a string with possible %u and %p
+ * escapes.  The former is replaced by the UID and the latter is replaced by
+ * the PID (a suitable unique string).
+ */
+static char *
+build_ccache_name(struct pam_args *args, uid_t uid)
+{
+    char *cache_name = NULL;
+    int retval;
+
+    if (args->config->ccache == NULL) {
+        retval = asprintf(&cache_name, "%s/krb5cc_%d_XXXXXX",
+                          args->config->ccache_dir, (int) uid);
+        if (retval < 0) {
+            putil_crit(args, "malloc failure: %s", strerror(errno));
+            return NULL;
+        }
+    } else {
+        size_t len = 0, delta;
+        char *p, *q;
+
+        for (p = args->config->ccache; *p != '\0'; p++) {
+            if (p[0] == '%' && p[1] == 'u') {
+                len += snprintf(NULL, 0, "%ld", (long) uid);
+                p++;
+            } else if (p[0] == '%' && p[1] == 'p') {
+                len += snprintf(NULL, 0, "%ld", (long) getpid());
+                p++;
+            } else {
+                len++;
+            }
+        }
+        len++;
+        cache_name = malloc(len);
+        if (cache_name == NULL) {
+            putil_crit(args, "malloc failure: %s", strerror(errno));
+            return NULL;
+        }
+        for (p = args->config->ccache, q = cache_name; *p != '\0'; p++) {
+            if (p[0] == '%' && p[1] == 'u') {
+                delta = snprintf(q, len, "%ld", (long) uid);
+                q += delta;
+                len -= delta;
+                p++;
+            } else if (p[0] == '%' && p[1] == 'p') {
+                delta = snprintf(q, len, "%ld", (long) getpid());
+                q += delta;
+                len -= delta;
+                p++;
+            } else {
+                *q = *p;
+                q++;
+                len--;
+            }
+        }
+        *q = '\0';
+    }
+    return cache_name;
+}
+
+
+/*
+ * Create a new context for a session if we've lost the context created during
+ * authentication (such as when running under OpenSSH).  Return PAM_IGNORE if
+ * we're ignoring this user or if apparently our pam_authenticate never
+ * succeeded.
+ */
+static int
+create_session_context(struct pam_args *args)
+{
+    struct context *ctx = NULL;
+    PAM_CONST char *user;
+    const char *tmpname;
+    int status, pamret;
+
+    /* If we're going to ignore the user anyway, don't even bother. */
+    if (args->config->ignore_root || args->config->minimum_uid > 0) {
+        pamret = pam_get_user(args->pamh, &user, NULL);
+        if (pamret == PAM_SUCCESS && pamk5_should_ignore(args, user)) {
+            pamret = PAM_IGNORE;
+            goto fail;
+        }
+    }
+
+    /*
+     * Create the context and locate the temporary ticket cache.  Load the
+     * ticket cache back into the context and flush out the other data that
+     * would have been set if we'd kept our original context.
+     */
+    pamret = pamk5_context_new(args);
+    if (pamret != PAM_SUCCESS) {
+        putil_crit_pam(args, pamret, "creating session context failed");
+        goto fail;
+    }
+    ctx = args->config->ctx;
+    tmpname = pamk5_get_krb5ccname(args, "PAM_KRB5CCNAME");
+    if (tmpname == NULL) {
+        putil_debug(args, "unable to get PAM_KRB5CCNAME, assuming"
+                          " non-Kerberos login");
+        pamret = PAM_IGNORE;
+        goto fail;
+    }
+    putil_debug(args, "found initial ticket cache at %s", tmpname);
+    status = krb5_cc_resolve(ctx->context, tmpname, &ctx->cache);
+    if (status != 0) {
+        putil_err_krb5(args, status, "cannot resolve cache %s", tmpname);
+        pamret = PAM_SERVICE_ERR;
+        goto fail;
+    }
+    status = krb5_cc_get_principal(ctx->context, ctx->cache, &ctx->princ);
+    if (status != 0) {
+        putil_err_krb5(args, status, "cannot retrieve principal");
+        pamret = PAM_SERVICE_ERR;
+        goto fail;
+    }
+
+    /*
+     * We've rebuilt the context.  Push it back into the PAM state for any
+     * further calls to session or account management, which OpenSSH does keep
+     * the context for.
+     */
+    pamret = pam_set_data(args->pamh, "pam_krb5", ctx, pamk5_context_destroy);
+    if (pamret != PAM_SUCCESS) {
+        putil_err_pam(args, pamret, "cannot set context data");
+        goto fail;
+    }
+    return PAM_SUCCESS;
+
+fail:
+    pamk5_context_free(args);
+    return pamret;
+}
+
+
+/*
+ * Sets user credentials by creating the permanent ticket cache and setting
+ * the proper ownership.  This function may be called by either pam_sm_setcred
+ * or pam_sm_open_session.  The refresh flag should be set to true if we
+ * should reinitialize an existing ticket cache instead of creating a new one.
+ */
+int
+pamk5_setcred(struct pam_args *args, bool refresh)
+{
+    struct context *ctx = NULL;
+    krb5_ccache cache = NULL;
+    char *cache_name = NULL;
+    bool set_context = false;
+    int status = 0;
+    int pamret;
+    struct passwd *pw = NULL;
+    uid_t uid;
+    gid_t gid;
+
+    /* If configured not to create a cache, we have nothing to do. */
+    if (args->config->no_ccache) {
+        pamret = PAM_SUCCESS;
+        goto done;
+    }
+
+    /*
+     * If we weren't able to obtain a context, we were probably run by OpenSSH
+     * with its weird PAM handling, so we're going to cobble up a new context
+     * for ourselves.
+     */
+    pamret = pamk5_context_fetch(args);
+    if (pamret != PAM_SUCCESS) {
+        putil_debug(args, "no context found, creating one");
+        pamret = create_session_context(args);
+        if (pamret != PAM_SUCCESS || args->config->ctx == NULL)
+            goto done;
+        set_context = true;
+    }
+    ctx = args->config->ctx;
+
+    /*
+     * Some programs (xdm, for instance) appear to call setcred over and over
+     * again, so avoid doing useless work.
+     */
+    if (ctx->initialized) {
+        pamret = PAM_SUCCESS;
+        goto done;
+    }
+
+    /*
+     * Get the uid.  The user is not required to be a local account for
+     * pam_authenticate, but for either pam_setcred (other than DELETE) or for
+     * pam_open_session, the user must be a local account.
+     */
+    pw = pam_modutil_getpwnam(args->pamh, ctx->name);
+    if (pw == NULL) {
+        putil_err(args, "getpwnam failed for %s", ctx->name);
+        pamret = PAM_USER_UNKNOWN;
+        goto done;
+    }
+    uid = pw->pw_uid;
+    gid = pw->pw_gid;
+
+    /* Get the cache name.  If reinitializing, this is our existing cache. */
+    if (refresh) {
+        const char *name, *k5name;
+
+        /*
+         * Solaris su calls pam_setcred as root with PAM_REINITIALIZE_CREDS,
+         * preserving the user-supplied environment.  An xlock program may
+         * also do this if it's setuid root and doesn't drop credentials
+         * before calling pam_setcred.
+         *
+         * There isn't any safe way of reinitializing the exiting ticket cache
+         * for the user if we're setuid without calling setreuid().  Calling
+         * setreuid() is possible, but if the calling application is threaded,
+         * it will change credentials for the whole application, with possibly
+         * bizarre and unintended (and insecure) results.  Trying to verify
+         * ownership of the existing ticket cache before using it fails under
+         * various race conditions (for example, having one of the elements of
+         * the path be a symlink and changing the target of that symlink
+         * between our check and the call to krb5_cc_resolve).  Without
+         * calling setreuid(), we run the risk of replacing a file owned by
+         * another user with a credential cache.
+         *
+         * We could fail with an error in the setuid case, which would be
+         * maximally safe, but it would prevent use of the module for
+         * authentication with programs such as Solaris su.  Failure to
+         * reinitialize the cache is normally not a serious problem, just a
+         * missing feature.  We therefore log an error and exit with
+         * PAM_SUCCESS for the setuid case.
+         *
+         * We do not use issetugid here since it always returns true if setuid
+         * was was involved anywhere in the process of running the binary.
+         * This would prevent a setuid screensaver that drops permissions from
+         * refreshing a credential cache.  The issetugid behavior is safer,
+         * since the environment should ideally not be trusted even if the
+         * binary completely changed users away from the original user, but in
+         * that case the binary needs to take some responsibility for either
+         * sanitizing the environment or being certain that the calling user
+         * is permitted to act as the target user.
+         */
+        if (getuid() != geteuid() || getgid() != getegid()) {
+            putil_err(args, "credential reinitialization in a setuid context"
+                            " ignored");
+            pamret = PAM_SUCCESS;
+            goto done;
+        }
+        name = pamk5_get_krb5ccname(args, "KRB5CCNAME");
+        if (name == NULL)
+            name = krb5_cc_default_name(ctx->context);
+        if (name == NULL) {
+            putil_err(args, "unable to get ticket cache name");
+            pamret = PAM_SERVICE_ERR;
+            goto done;
+        }
+        if (strncmp(name, "FILE:", strlen("FILE:")) == 0)
+            name += strlen("FILE:");
+
+        /*
+         * If the cache we have in the context and the cache we're
+         * reinitializing are the same cache, don't do anything; otherwise,
+         * we'll end up destroying the cache.  This should never happen; this
+         * case triggering is a sign of a bug, probably in the calling
+         * application.
+         */
+        if (ctx->cache != NULL) {
+            k5name = krb5_cc_get_name(ctx->context, ctx->cache);
+            if (k5name != NULL) {
+                if (strncmp(k5name, "FILE:", strlen("FILE:")) == 0)
+                    k5name += strlen("FILE:");
+                if (strcmp(name, k5name) == 0) {
+                    pamret = PAM_SUCCESS;
+                    goto done;
+                }
+            }
+        }
+
+        cache_name = strdup(name);
+        if (cache_name == NULL) {
+            putil_crit(args, "malloc failure: %s", strerror(errno));
+            pamret = PAM_BUF_ERR;
+            goto done;
+        }
+        putil_debug(args, "refreshing ticket cache %s", cache_name);
+
+        /*
+         * If we're refreshing the cache, we didn't really create it and the
+         * user's open session created by login is probably still managing
+         * it.  Thus, don't remove it when PAM is shut down.
+         */
+        ctx->dont_destroy_cache = 1;
+    } else {
+        char *cache_name_tmp;
+        size_t len;
+
+        cache_name = build_ccache_name(args, uid);
+        if (cache_name == NULL) {
+            pamret = PAM_BUF_ERR;
+            goto done;
+        }
+        len = strlen(cache_name);
+        if (len > 6 && strncmp("XXXXXX", cache_name + len - 6, 6) == 0) {
+            if (strncmp(cache_name, "FILE:", strlen("FILE:")) == 0)
+                cache_name_tmp = cache_name + strlen("FILE:");
+            else
+                cache_name_tmp = cache_name;
+            pamret = pamk5_cache_mkstemp(args, cache_name_tmp);
+            if (pamret != PAM_SUCCESS)
+                goto done;
+        }
+        putil_debug(args, "initializing ticket cache %s", cache_name);
+    }
+
+    /*
+     * Initialize the new ticket cache and point the environment at it.  Only
+     * chown the cache if the cache is of type FILE or has no type (making the
+     * assumption that the default cache type is FILE; otherwise, due to the
+     * type prefix, we'd end up with an invalid path.
+     */
+    pamret = cache_init_from_cache(args, cache_name, ctx->cache, &cache);
+    if (pamret != PAM_SUCCESS)
+        goto done;
+    if (strncmp(cache_name, "FILE:", strlen("FILE:")) == 0)
+        status = chown(cache_name + strlen("FILE:"), uid, gid);
+    else if (strchr(cache_name, ':') == NULL)
+        status = chown(cache_name, uid, gid);
+    if (status == -1) {
+        putil_crit(args, "chown of ticket cache failed: %s", strerror(errno));
+        pamret = PAM_SERVICE_ERR;
+        goto done;
+    }
+    pamret = pamk5_set_krb5ccname(args, cache_name, "KRB5CCNAME");
+    if (pamret != PAM_SUCCESS) {
+        putil_crit(args, "setting KRB5CCNAME failed: %s", strerror(errno));
+        goto done;
+    }
+
+    /*
+     * If we had a temporary ticket cache, delete the environment variable so
+     * that we won't get confused and think we still have a temporary ticket
+     * cache when called again.
+     *
+     * FreeBSD PAM, at least as of 7.2, doesn't support deleting environment
+     * variables using the syntax supported by Solaris and Linux.  Work
+     * around that by setting the variable to an empty value if deleting it
+     * fails.
+     */
+    if (pam_getenv(args->pamh, "PAM_KRB5CCNAME") != NULL) {
+        pamret = pam_putenv(args->pamh, "PAM_KRB5CCNAME");
+        if (pamret != PAM_SUCCESS)
+            pamret = pam_putenv(args->pamh, "PAM_KRB5CCNAME=");
+        if (pamret != PAM_SUCCESS)
+            goto done;
+    }
+
+    /* Destroy the temporary cache and put the new cache in the context. */
+    krb5_cc_destroy(ctx->context, ctx->cache);
+    ctx->cache = cache;
+    cache = NULL;
+    ctx->initialized = 1;
+    if (args->config->retain_after_close)
+        ctx->dont_destroy_cache = 1;
+
+done:
+    if (ctx != NULL && cache != NULL)
+        krb5_cc_destroy(ctx->context, cache);
+    free(cache_name);
+
+    /* If we stored our Kerberos context in PAM data, don't free it. */
+    if (set_context)
+        args->ctx = NULL;
+
+    return pamret;
+}
diff --git a/module/support.c b/module/support.c
new file mode 100644
index 000000000000..79b654ed2f32
--- /dev/null
+++ b/module/support.c
@@ -0,0 +1,141 @@
+/*
+ * Support functions for pam-krb5.
+ *
+ * Some general utility functions used by multiple PAM groups that aren't
+ * associated with any particular chunk of functionality.
+ *
+ * Copyright 2005-2007, 2009, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ * Copyright 2005 Andres Salomon <dilinger@debian.org>
+ * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+#include <pwd.h>
+
+#include <module/internal.h>
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Given the PAM arguments and the user we're authenticating, see if we should
+ * ignore that user because they're root or have a low-numbered UID and we
+ * were configured to ignore such users.  Returns true if we should ignore
+ * them, false otherwise.  Ignores any fully-qualified principal names.
+ */
+int
+pamk5_should_ignore(struct pam_args *args, PAM_CONST char *username)
+{
+    struct passwd *pwd;
+
+    if (args->config->ignore_root && strcmp("root", username) == 0) {
+        putil_debug(args, "ignoring root user");
+        return 1;
+    }
+    if (args->config->minimum_uid > 0 && strchr(username, '@') == NULL) {
+        pwd = pam_modutil_getpwnam(args->pamh, username);
+        if (pwd != NULL && pwd->pw_uid < (uid_t) args->config->minimum_uid) {
+            putil_debug(args, "ignoring low-UID user (%lu < %ld)",
+                        (unsigned long) pwd->pw_uid,
+                        args->config->minimum_uid);
+            return 1;
+        }
+    }
+    return 0;
+}
+
+
+/*
+ * Verify the user authorization.  Call krb5_kuserok if this is a local
+ * account, or do the krb5_aname_to_localname verification if ignore_k5login
+ * was requested.  For non-local accounts, the principal must match the
+ * authentication identity.
+ */
+int
+pamk5_authorized(struct pam_args *args)
+{
+    struct context *ctx;
+    krb5_context c;
+    krb5_error_code retval;
+    int status;
+    struct passwd *pwd;
+    char kuser[65]; /* MAX_USERNAME == 65 (MIT Kerberos 1.4.1). */
+
+    if (args == NULL || args->config == NULL || args->config->ctx == NULL
+        || args->config->ctx->context == NULL)
+        return PAM_SERVICE_ERR;
+    ctx = args->config->ctx;
+    if (ctx->name == NULL)
+        return PAM_SERVICE_ERR;
+    c = ctx->context;
+
+    /*
+     * If alt_auth_map was set, authorize the user if the authenticated
+     * principal matches the mapped principal.  alt_auth_map essentially
+     * serves as a supplemental .k5login.  PAM_SERVICE_ERR indicates fatal
+     * errors that should abort remaining processing; PAM_AUTH_ERR indicates
+     * that it just didn't match, in which case we continue to try other
+     * authorization methods.
+     */
+    if (args->config->alt_auth_map != NULL) {
+        status = pamk5_alt_auth_verify(args);
+        if (status == PAM_SUCCESS || status == PAM_SERVICE_ERR)
+            return status;
+    }
+
+    /*
+     * If the name to which we're authenticating contains @ (is fully
+     * qualified), it must match the principal exactly.
+     */
+    if (strchr(ctx->name, '@') != NULL) {
+        char *principal;
+
+        retval = krb5_unparse_name(c, ctx->princ, &principal);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "krb5_unparse_name failed");
+            return PAM_SERVICE_ERR;
+        }
+        if (strcmp(principal, ctx->name) != 0) {
+            putil_err(args, "user %s does not match principal %s", ctx->name,
+                      principal);
+            krb5_free_unparsed_name(c, principal);
+            return PAM_AUTH_ERR;
+        }
+        krb5_free_unparsed_name(c, principal);
+        return PAM_SUCCESS;
+    }
+
+    /*
+     * Otherwise, apply either krb5_aname_to_localname or krb5_kuserok
+     * depending on the situation.
+     */
+    pwd = pam_modutil_getpwnam(args->pamh, ctx->name);
+    if (args->config->ignore_k5login || pwd == NULL) {
+        retval = krb5_aname_to_localname(c, ctx->princ, sizeof(kuser), kuser);
+        if (retval != 0) {
+            putil_err_krb5(args, retval, "cannot convert principal to user");
+            return PAM_AUTH_ERR;
+        }
+        if (strcmp(kuser, ctx->name) != 0) {
+            putil_err(args, "user %s does not match local name %s", ctx->name,
+                      kuser);
+            return PAM_AUTH_ERR;
+        }
+    } else {
+        if (!krb5_kuserok(c, ctx->princ, ctx->name)) {
+            putil_err(args, "krb5_kuserok for user %s failed", ctx->name);
+            return PAM_AUTH_ERR;
+        }
+    }
+
+    return PAM_SUCCESS;
+}
diff --git a/pam-util/args.c b/pam-util/args.c
new file mode 100644
index 000000000000..293988b8cd1a
--- /dev/null
+++ b/pam-util/args.c
@@ -0,0 +1,105 @@
+/*
+ * Constructor and destructor for PAM data.
+ *
+ * The PAM utility functions often need an initial argument that encapsulates
+ * the PAM handle, some configuration information, and possibly a Kerberos
+ * context.  This implements a constructor and destructor for that data
+ * structure.
+ *
+ * The individual PAM modules should provide a definition of the pam_config
+ * struct appropriate to that module.  None of the PAM utility functions need
+ * to know what that configuration struct looks like, and it must be freed
+ * before calling putil_args_free().
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010, 2012-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+
+/*
+ * Allocate a new pam_args struct and return it, or NULL on memory allocation
+ * or Kerberos initialization failure.  If HAVE_KRB5 is defined, we also
+ * allocate a Kerberos context.
+ */
+struct pam_args *
+putil_args_new(pam_handle_t *pamh, int flags)
+{
+    struct pam_args *args;
+#ifdef HAVE_KRB5
+    krb5_error_code status;
+#endif
+
+    args = calloc(1, sizeof(struct pam_args));
+    if (args == NULL) {
+        putil_crit(NULL, "cannot allocate memory: %s", strerror(errno));
+        return NULL;
+    }
+    args->pamh = pamh;
+    args->silent = ((flags & PAM_SILENT) == PAM_SILENT);
+
+#ifdef HAVE_KRB5
+    if (issetugid())
+        status = krb5_init_secure_context(&args->ctx);
+    else
+        status = krb5_init_context(&args->ctx);
+    if (status != 0) {
+        putil_err_krb5(args, status, "cannot create Kerberos context");
+        free(args);
+        return NULL;
+    }
+#endif /* HAVE_KRB5 */
+    return args;
+}
+
+
+/*
+ * Free a pam_args struct.  The config member must be freed separately.
+ */
+void
+putil_args_free(struct pam_args *args)
+{
+    if (args == NULL)
+        return;
+#ifdef HAVE_KRB5
+    free(args->realm);
+    if (args->ctx != NULL)
+        krb5_free_context(args->ctx);
+#endif
+    free(args);
+}
diff --git a/pam-util/args.h b/pam-util/args.h
new file mode 100644
index 000000000000..79b5d046ab60
--- /dev/null
+++ b/pam-util/args.h
@@ -0,0 +1,84 @@
+/*
+ * Standard structure for PAM data.
+ *
+ * The PAM utility functions often need an initial argument that encapsulates
+ * the PAM handle, some configuration information, and possibly a Kerberos
+ * context.  This header provides a standard structure definition.
+ *
+ * The individual PAM modules should provide a definition of the pam_config
+ * struct appropriate to that module.  None of the PAM utility functions need
+ * to know what that configuration struct looks like.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef PAM_UTIL_ARGS_H
+#define PAM_UTIL_ARGS_H 1
+
+#include <config.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/pam.h>
+#include <portable/stdbool.h>
+
+/* Opaque struct from the PAM utility perspective. */
+struct pam_config;
+
+struct pam_args {
+    pam_handle_t *pamh;        /* Pointer back to the PAM handle. */
+    struct pam_config *config; /* Per-module PAM configuration. */
+    bool debug;                /* Log debugging information. */
+    bool silent;               /* Do not pass text to the application. */
+    const char *user;          /* User being authenticated. */
+
+#ifdef HAVE_KRB5
+    krb5_context ctx; /* Context for Kerberos operations. */
+    char *realm;      /* Kerberos realm for configuration. */
+#endif
+};
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all internal functions. */
+#pragma GCC visibility push(hidden)
+
+/*
+ * Allocate and free the pam_args struct.  We assume that user is a pointer to
+ * a string maintained elsewhere and don't free it here.  config must be freed
+ * separately by the caller.
+ */
+struct pam_args *putil_args_new(pam_handle_t *, int flags);
+void putil_args_free(struct pam_args *);
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+#endif /* !PAM_UTIL_ARGS_H */
diff --git a/pam-util/logging.c b/pam-util/logging.c
new file mode 100644
index 000000000000..460993315870
--- /dev/null
+++ b/pam-util/logging.c
@@ -0,0 +1,345 @@
+/*
+ * Logging functions for PAM modules.
+ *
+ * Logs errors and debugging messages from PAM modules.  The debug versions
+ * only log anything if debugging was enabled; the crit and err versions
+ * always log.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2015, 2018, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2005-2007, 2009-2010, 2012-2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <syslog.h>
+
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+
+#ifndef LOG_AUTHPRIV
+#    define LOG_AUTHPRIV LOG_AUTH
+#endif
+
+/* Used for iterating through arrays. */
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
+
+/*
+ * Mappings of PAM flags to symbolic names for logging when entering a PAM
+ * module function.
+ */
+static const struct {
+    int flag;
+    const char *name;
+} FLAGS[] = {
+    /* clang-format off */
+    {PAM_CHANGE_EXPIRED_AUTHTOK, "expired"  },
+    {PAM_DELETE_CRED,            "delete"   },
+    {PAM_DISALLOW_NULL_AUTHTOK,  "nonull"   },
+    {PAM_ESTABLISH_CRED,         "establish"},
+    {PAM_PRELIM_CHECK,           "prelim"   },
+    {PAM_REFRESH_CRED,           "refresh"  },
+    {PAM_REINITIALIZE_CRED,      "reinit"   },
+    {PAM_SILENT,                 "silent"   },
+    {PAM_UPDATE_AUTHTOK,         "update"   },
+    /* clang-format on */
+};
+
+
+/*
+ * Utility function to format a message into newly allocated memory, reporting
+ * an error via syslog if vasprintf fails.
+ */
+static char *__attribute__((__format__(printf, 1, 0)))
+format(const char *fmt, va_list args)
+{
+    char *msg;
+
+    if (vasprintf(&msg, fmt, args) < 0) {
+        syslog(LOG_CRIT | LOG_AUTHPRIV, "vasprintf failed: %m");
+        return NULL;
+    }
+    return msg;
+}
+
+
+/*
+ * Log wrapper function that adds the user.  Log a message with the given
+ * priority, prefixed by (user <user>) with the account name being
+ * authenticated if known.
+ */
+static void __attribute__((__format__(printf, 3, 0)))
+log_vplain(struct pam_args *pargs, int priority, const char *fmt, va_list args)
+{
+    char *msg;
+
+    if (priority == LOG_DEBUG && (pargs == NULL || !pargs->debug))
+        return;
+    if (pargs != NULL && pargs->user != NULL) {
+        msg = format(fmt, args);
+        if (msg == NULL)
+            return;
+        pam_syslog(pargs->pamh, priority, "(user %s) %s", pargs->user, msg);
+        free(msg);
+    } else if (pargs != NULL) {
+        pam_vsyslog(pargs->pamh, priority, fmt, args);
+    } else {
+        msg = format(fmt, args);
+        if (msg == NULL)
+            return;
+        syslog(priority | LOG_AUTHPRIV, "%s", msg);
+        free(msg);
+    }
+}
+
+
+/*
+ * Wrapper around log_vplain with variadic arguments.
+ */
+static void __attribute__((__format__(printf, 3, 4)))
+log_plain(struct pam_args *pargs, int priority, const char *fmt, ...)
+{
+    va_list args;
+
+    va_start(args, fmt);
+    log_vplain(pargs, priority, fmt, args);
+    va_end(args);
+}
+
+
+/*
+ * Log wrapper function for reporting a PAM error.  Log a message with the
+ * given priority, prefixed by (user <user>) with the account name being
+ * authenticated if known, followed by a colon and the formatted PAM error.
+ * However, do not include the colon and the PAM error if the PAM status is
+ * PAM_SUCCESS.
+ */
+static void __attribute__((__format__(printf, 4, 0)))
+log_pam(struct pam_args *pargs, int priority, int status, const char *fmt,
+        va_list args)
+{
+    char *msg;
+
+    if (priority == LOG_DEBUG && (pargs == NULL || !pargs->debug))
+        return;
+    msg = format(fmt, args);
+    if (msg == NULL)
+        return;
+    if (pargs == NULL)
+        log_plain(NULL, priority, "%s", msg);
+    else if (status == PAM_SUCCESS)
+        log_plain(pargs, priority, "%s", msg);
+    else
+        log_plain(pargs, priority, "%s: %s", msg,
+                  pam_strerror(pargs->pamh, status));
+    free(msg);
+}
+
+
+/*
+ * The public interfaces.  For each common log level (crit, err, and debug),
+ * generate a putil_<level> function and one for _pam.  Do this with the
+ * preprocessor to save duplicate code.
+ */
+/* clang-format off */
+#define LOG_FUNCTION(level, priority)                             \
+    void __attribute__((__format__(printf, 2, 3)))                \
+    putil_ ## level(struct pam_args *pargs, const char *fmt, ...) \
+    {                                                             \
+        va_list args;                                             \
+                                                                  \
+        va_start(args, fmt);                                      \
+        log_vplain(pargs, priority, fmt, args);                   \
+        va_end(args);                                             \
+    }                                                             \
+    void __attribute__((__format__(printf, 3, 4)))                \
+    putil_ ## level ## _pam(struct pam_args *pargs, int status,   \
+                            const char *fmt, ...)                 \
+    {                                                             \
+        va_list args;                                             \
+                                                                  \
+        va_start(args, fmt);                                      \
+        log_pam(pargs, priority, status, fmt, args);              \
+        va_end(args);                                             \
+    }
+LOG_FUNCTION(crit,   LOG_CRIT)
+LOG_FUNCTION(err,    LOG_ERR)
+LOG_FUNCTION(notice, LOG_NOTICE)
+LOG_FUNCTION(debug,  LOG_DEBUG)
+/* clang-format on */
+
+
+/*
+ * Report entry into a function.  Takes the PAM arguments, the function name,
+ * and the flags and maps the flags to symbolic names.
+ */
+void
+putil_log_entry(struct pam_args *pargs, const char *func, int flags)
+{
+    size_t i, length, offset;
+    char *out = NULL, *nout;
+
+    if (!pargs->debug)
+        return;
+    if (flags != 0)
+        for (i = 0; i < ARRAY_SIZE(FLAGS); i++) {
+            if (!(flags & FLAGS[i].flag))
+                continue;
+            if (out == NULL) {
+                out = strdup(FLAGS[i].name);
+                if (out == NULL)
+                    break;
+            } else {
+                length = strlen(FLAGS[i].name);
+                nout = realloc(out, strlen(out) + length + 2);
+                if (nout == NULL) {
+                    free(out);
+                    out = NULL;
+                    break;
+                }
+                out = nout;
+                offset = strlen(out);
+                out[offset] = '|';
+                memcpy(out + offset + 1, FLAGS[i].name, length);
+                out[offset + 1 + length] = '\0';
+            }
+        }
+    if (out == NULL)
+        pam_syslog(pargs->pamh, LOG_DEBUG, "%s: entry", func);
+    else {
+        pam_syslog(pargs->pamh, LOG_DEBUG, "%s: entry (%s)", func, out);
+        free(out);
+    }
+}
+
+
+/*
+ * Report an authentication failure.  This is a separate function since we
+ * want to include various PAM metadata in the log message and put it in a
+ * standard format.  The format here is modeled after the pam_unix
+ * authentication failure message from Linux PAM.
+ */
+void __attribute__((__format__(printf, 2, 3)))
+putil_log_failure(struct pam_args *pargs, const char *fmt, ...)
+{
+    char *msg;
+    va_list args;
+    const char *ruser = NULL;
+    const char *rhost = NULL;
+    const char *tty = NULL;
+    const char *name = NULL;
+
+    if (pargs->user != NULL)
+        name = pargs->user;
+    va_start(args, fmt);
+    msg = format(fmt, args);
+    va_end(args);
+    if (msg == NULL)
+        return;
+    pam_get_item(pargs->pamh, PAM_RUSER, (PAM_CONST void **) &ruser);
+    pam_get_item(pargs->pamh, PAM_RHOST, (PAM_CONST void **) &rhost);
+    pam_get_item(pargs->pamh, PAM_TTY, (PAM_CONST void **) &tty);
+
+    /* clang-format off */
+    pam_syslog(pargs->pamh, LOG_NOTICE, "%s; logname=%s uid=%ld euid=%ld"
+               " tty=%s ruser=%s rhost=%s", msg,
+               (name  != NULL) ? name  : "",
+               (long) getuid(), (long) geteuid(),
+               (tty   != NULL) ? tty   : "",
+               (ruser != NULL) ? ruser : "",
+               (rhost != NULL) ? rhost : "");
+    /* clang-format on */
+
+    free(msg);
+}
+
+
+/*
+ * Below are the additional logging functions enabled if built with Kerberos
+ * support, used to report Kerberos errors.
+ */
+#ifdef HAVE_KRB5
+
+
+/*
+ * Log wrapper function for reporting a Kerberos error.  Log a message with
+ * the given priority, prefixed by (user <user>) with the account name being
+ * authenticated if known, followed by a colon and the formatted Kerberos
+ * error.
+ */
+__attribute__((__format__(printf, 4, 0))) static void
+log_krb5(struct pam_args *pargs, int priority, int status, const char *fmt,
+         va_list args)
+{
+    char *msg;
+    const char *k5_msg = NULL;
+
+    if (priority == LOG_DEBUG && (pargs == NULL || !pargs->debug))
+        return;
+    msg = format(fmt, args);
+    if (msg == NULL)
+        return;
+    if (pargs != NULL && pargs->ctx != NULL) {
+        k5_msg = krb5_get_error_message(pargs->ctx, status);
+        log_plain(pargs, priority, "%s: %s", msg, k5_msg);
+    } else {
+        log_plain(pargs, priority, "%s", msg);
+    }
+    free(msg);
+    if (k5_msg != NULL)
+        krb5_free_error_message(pargs->ctx, k5_msg);
+}
+
+
+/*
+ * The public interfaces.  Do this with the preprocessor to save duplicate
+ * code.
+ */
+/* clang-format off */
+#define LOG_FUNCTION_KRB5(level, priority)                              \
+    void __attribute__((__format__(printf, 3, 4)))                      \
+    putil_ ## level ## _krb5(struct pam_args *pargs, int status,        \
+                             const char *fmt, ...)                      \
+    {                                                                   \
+        va_list args;                                                   \
+                                                                        \
+        va_start(args, fmt);                                            \
+        log_krb5(pargs, priority, status, fmt, args);                   \
+        va_end(args);                                                   \
+    }
+LOG_FUNCTION_KRB5(crit,   LOG_CRIT)
+LOG_FUNCTION_KRB5(err,    LOG_ERR)
+LOG_FUNCTION_KRB5(notice, LOG_NOTICE)
+LOG_FUNCTION_KRB5(debug,  LOG_DEBUG)
+/* clang-format on */
+
+#endif /* HAVE_KRB5 */
diff --git a/pam-util/logging.h b/pam-util/logging.h
new file mode 100644
index 000000000000..bf95ea520ae2
--- /dev/null
+++ b/pam-util/logging.h
@@ -0,0 +1,131 @@
+/*
+ * Interface to standard PAM logging.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2010, 2012-2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef PAM_UTIL_LOGGING_H
+#define PAM_UTIL_LOGGING_H 1
+
+#include <config.h>
+#include <portable/macros.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/pam.h>
+
+#include <stddef.h>
+#include <syslog.h>
+
+/* Forward declarations to avoid extra includes. */
+struct pam_args;
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all internal functions. */
+#pragma GCC visibility push(hidden)
+
+/*
+ * Error reporting and debugging functions.  For each log level, there are two
+ * functions.  The _log function just prints out the message it's given.  The
+ * _log_pam function does the same but appends the pam_strerror results for
+ * the provided status code if it is not PAM_SUCCESS.
+ */
+void putil_crit(struct pam_args *, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+void putil_crit_pam(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void putil_err(struct pam_args *, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+void putil_err_pam(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void putil_notice(struct pam_args *, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+void putil_notice_pam(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void putil_debug(struct pam_args *, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+void putil_debug_pam(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+
+/*
+ * The Kerberos versions of the PAM logging and debugging functions, which
+ * report the last Kerberos error.  These are only available if built with
+ * Kerberos support.
+ */
+#ifdef HAVE_KRB5
+void putil_crit_krb5(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void putil_err_krb5(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void putil_notice_krb5(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void putil_debug_krb5(struct pam_args *, int, const char *, ...)
+    __attribute__((__format__(printf, 3, 4)));
+#endif
+
+/* Log entry to a PAM function. */
+void putil_log_entry(struct pam_args *, const char *, int flags)
+    __attribute__((__nonnull__));
+
+/* Log an authentication failure. */
+void putil_log_failure(struct pam_args *, const char *, ...)
+    __attribute__((__nonnull__, __format__(printf, 2, 3)));
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+/* __func__ is C99, but not provided by all implementations. */
+#if (__STDC_VERSION__ < 199901L) && !defined(__func__)
+#    if (__GNUC__ >= 2)
+#        define __func__ __FUNCTION__
+#    else
+#        define __func__ "<unknown>"
+#    endif
+#endif
+
+/* Macros to record entry and exit from the main PAM functions. */
+#define ENTRY(args, flags)                              \
+    do {                                                \
+        if (args->debug)                                \
+            putil_log_entry((args), __func__, (flags)); \
+    } while (0)
+#define EXIT(args, pamret)                                                \
+    do {                                                                  \
+        if (args != NULL && args->debug)                                  \
+            pam_syslog(                                                   \
+                (args)->pamh, LOG_DEBUG, "%s: exit (%s)", __func__,       \
+                ((pamret) == PAM_SUCCESS)                                 \
+                    ? "success"                                           \
+                    : (((pamret) == PAM_IGNORE) ? "ignore" : "failure")); \
+    } while (0)
+
+#endif /* !PAM_UTIL_LOGGING_H */
diff --git a/pam-util/options.c b/pam-util/options.c
new file mode 100644
index 000000000000..052e528a5be4
--- /dev/null
+++ b/pam-util/options.c
@@ -0,0 +1,720 @@
+/*
+ * Parse PAM options into a struct.
+ *
+ * Given a struct in which to store options and a specification for what
+ * options go where, parse both the PAM configuration options and any options
+ * from a Kerberos krb5.conf file and fill out the struct.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2008, 2010-2011, 2013-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+#include <pam-util/options.h>
+#include <pam-util/vector.h>
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+/*
+ * Macros used to resolve a void * pointer to the configuration struct and an
+ * offset into a pointer to the appropriate type.  Scary violations of the C
+ * type system lurk here.
+ */
+/* clang-format off */
+#define CONF_BOOL(c, o)   (bool *)          (void *)((char *) (c) + (o))
+#define CONF_NUMBER(c, o) (long *)          (void *)((char *) (c) + (o))
+#define CONF_STRING(c, o) (char **)         (void *)((char *) (c) + (o))
+#define CONF_LIST(c, o)   (struct vector **)(void *)((char *) (c) + (o))
+/* clang-format on */
+
+/*
+ * We can only process times properly if we have Kerberos.  If not, they fall
+ * back to longs and we convert them as numbers.
+ */
+/* clang-format off */
+#ifdef HAVE_KRB5
+#    define CONF_TIME(c, o) (krb5_deltat *)(void *)((char *) (c) + (o))
+#else
+#    define CONF_TIME(c, o) (long *)       (void *)((char *) (c) + (o))
+#endif
+/* clang-format on */
+
+
+/*
+ * Set a vector argument to its default.  This needs to do a deep copy of the
+ * vector so that we can safely free it when freeing the configuration.  Takes
+ * the PAM argument struct, the pointer in which to store the vector, and the
+ * default vector.  Returns true if the default was set correctly and false on
+ * memory allocation failure, which is also reported with putil_crit().
+ */
+static bool
+copy_default_list(struct pam_args *args, struct vector **setting,
+                  const struct vector *defval)
+{
+    struct vector *result = NULL;
+
+    *setting = NULL;
+    if (defval != NULL && defval->strings != NULL) {
+        result = vector_copy(defval);
+        if (result == NULL) {
+            putil_crit(args, "cannot allocate memory: %s", strerror(errno));
+            return false;
+        }
+        *setting = result;
+    }
+    return true;
+}
+
+
+/*
+ * Set a vector argument to a default based on a string.  Takes the PAM
+ * argument struct,t he pointer into which to store the vector, and the
+ * default string.  Returns true if the default was set correctly and false on
+ * memory allocation failure, which is also reported with putil_crit().
+ */
+static bool
+default_list_string(struct pam_args *args, struct vector **setting,
+                    const char *defval)
+{
+    struct vector *result = NULL;
+
+    *setting = NULL;
+    if (defval != NULL) {
+        result = vector_split_multi(defval, " \t,", NULL);
+        if (result == NULL) {
+            putil_crit(args, "cannot allocate memory: %s", strerror(errno));
+            return false;
+        }
+        *setting = result;
+    }
+    return true;
+}
+
+
+/*
+ * Set the defaults for the PAM configuration.  Takes the PAM arguments, an
+ * option table defined as above, and the number of entries in the table.  The
+ * config member of the args struct must already be allocated.  Returns true
+ * on success and false on error (generally out of memory).  Errors will
+ * already be reported using putil_crit().
+ *
+ * This function must be called before either putil_args_krb5() or
+ * putil_args_parse(), since neither of those functions set defaults.
+ */
+bool
+putil_args_defaults(struct pam_args *args, const struct option options[],
+                    size_t optlen)
+{
+    size_t opt;
+
+    for (opt = 0; opt < optlen; opt++) {
+        bool *bp;
+        long *lp;
+#ifdef HAVE_KRB5
+        krb5_deltat *tp;
+#else
+        long *tp;
+#endif
+        char **sp;
+        struct vector **vp;
+
+        switch (options[opt].type) {
+        case TYPE_BOOLEAN:
+            bp = CONF_BOOL(args->config, options[opt].location);
+            *bp = options[opt].defaults.boolean;
+            break;
+        case TYPE_NUMBER:
+            lp = CONF_NUMBER(args->config, options[opt].location);
+            *lp = options[opt].defaults.number;
+            break;
+        case TYPE_TIME:
+            tp = CONF_TIME(args->config, options[opt].location);
+            *tp = (krb5_deltat) options[opt].defaults.number;
+            break;
+        case TYPE_STRING:
+            sp = CONF_STRING(args->config, options[opt].location);
+            if (options[opt].defaults.string == NULL)
+                *sp = NULL;
+            else {
+                *sp = strdup(options[opt].defaults.string);
+                if (*sp == NULL) {
+                    putil_crit(args, "cannot allocate memory: %s",
+                               strerror(errno));
+                    return false;
+                }
+            }
+            break;
+        case TYPE_LIST:
+            vp = CONF_LIST(args->config, options[opt].location);
+            if (!copy_default_list(args, vp, options[opt].defaults.list))
+                return false;
+            break;
+        case TYPE_STRLIST:
+            vp = CONF_LIST(args->config, options[opt].location);
+            if (!default_list_string(args, vp, options[opt].defaults.string))
+                return false;
+            break;
+        }
+    }
+    return true;
+}
+
+
+#ifdef HAVE_KRB5
+/*
+ * Load a boolean option from Kerberos appdefaults.  Takes the PAM argument
+ * struct, the section name, the realm, the option, and the result location.
+ *
+ * The stupidity of rewriting the realm argument into a krb5_data is required
+ * by MIT Kerberos.
+ */
+static void
+default_boolean(struct pam_args *args, const char *section, const char *realm,
+                const char *opt, bool *result)
+{
+    int tmp;
+#    ifdef HAVE_KRB5_REALM
+    krb5_const_realm rdata = realm;
+#    else
+    krb5_data realm_struct;
+    const krb5_data *rdata;
+
+    if (realm == NULL)
+        rdata = NULL;
+    else {
+        rdata = &realm_struct;
+        realm_struct.magic = KV5M_DATA;
+        realm_struct.data = (void *) realm;
+        realm_struct.length = (unsigned int) strlen(realm);
+    }
+#    endif
+
+    /*
+     * The MIT version of krb5_appdefault_boolean takes an int * and the
+     * Heimdal version takes a krb5_boolean *, so hope that Heimdal always
+     * defines krb5_boolean to int or this will require more portability work.
+     */
+    krb5_appdefault_boolean(args->ctx, section, rdata, opt, *result, &tmp);
+    *result = tmp;
+}
+
+
+/*
+ * Load a number option from Kerberos appdefaults.  Takes the PAM argument
+ * struct, the section name, the realm, the option, and the result location.
+ * The native interface doesn't support numbers, so we actually read a string
+ * and then convert.
+ */
+static void
+default_number(struct pam_args *args, const char *section, const char *realm,
+               const char *opt, long *result)
+{
+    char *tmp = NULL;
+    char *end;
+    long value;
+#    ifdef HAVE_KRB5_REALM
+    krb5_const_realm rdata = realm;
+#    else
+    krb5_data realm_struct;
+    const krb5_data *rdata;
+
+    if (realm == NULL)
+        rdata = NULL;
+    else {
+        rdata = &realm_struct;
+        realm_struct.magic = KV5M_DATA;
+        realm_struct.data = (void *) realm;
+        realm_struct.length = (unsigned int) strlen(realm);
+    }
+#    endif
+
+    krb5_appdefault_string(args->ctx, section, rdata, opt, "", &tmp);
+    if (tmp != NULL && tmp[0] != '\0') {
+        errno = 0;
+        value = strtol(tmp, &end, 10);
+        if (errno != 0 || *end != '\0')
+            putil_err(args, "invalid number in krb5.conf setting for %s: %s",
+                      opt, tmp);
+        else
+            *result = value;
+    }
+    free(tmp);
+}
+
+
+/*
+ * Load a time option from Kerberos appdefaults.  Takes the PAM argument
+ * struct, the section name, the realm, the option, and the result location.
+ * The native interface doesn't support numbers, so we actually read a string
+ * and then convert using krb5_string_to_deltat.
+ */
+static void
+default_time(struct pam_args *args, const char *section, const char *realm,
+             const char *opt, krb5_deltat *result)
+{
+    char *tmp = NULL;
+    krb5_deltat value;
+    krb5_error_code retval;
+#    ifdef HAVE_KRB5_REALM
+    krb5_const_realm rdata = realm;
+#    else
+    krb5_data realm_struct;
+    const krb5_data *rdata;
+
+    if (realm == NULL)
+        rdata = NULL;
+    else {
+        rdata = &realm_struct;
+        realm_struct.magic = KV5M_DATA;
+        realm_struct.data = (void *) realm;
+        realm_struct.length = (unsigned int) strlen(realm);
+    }
+#    endif
+
+    krb5_appdefault_string(args->ctx, section, rdata, opt, "", &tmp);
+    if (tmp != NULL && tmp[0] != '\0') {
+        retval = krb5_string_to_deltat(tmp, &value);
+        if (retval != 0)
+            putil_err(args, "invalid time in krb5.conf setting for %s: %s",
+                      opt, tmp);
+        else
+            *result = value;
+    }
+    free(tmp);
+}
+
+
+/*
+ * Load a string option from Kerberos appdefaults.  Takes the PAM argument
+ * struct, the section name, the realm, the option, and the result location.
+ *
+ * This requires an annoying workaround because one cannot specify a default
+ * value of NULL with MIT Kerberos, since MIT Kerberos unconditionally calls
+ * strdup on the default value.  There's also no way to determine if memory
+ * allocation failed while parsing or while setting the default value, so we
+ * don't return an error code.
+ */
+static void
+default_string(struct pam_args *args, const char *section, const char *realm,
+               const char *opt, char **result)
+{
+    char *value = NULL;
+#    ifdef HAVE_KRB5_REALM
+    krb5_const_realm rdata = realm;
+#    else
+    krb5_data realm_struct;
+    const krb5_data *rdata;
+
+    if (realm == NULL)
+        rdata = NULL;
+    else {
+        rdata = &realm_struct;
+        realm_struct.magic = KV5M_DATA;
+        realm_struct.data = (void *) realm;
+        realm_struct.length = (unsigned int) strlen(realm);
+    }
+#    endif
+
+    krb5_appdefault_string(args->ctx, section, rdata, opt, "", &value);
+    if (value != NULL) {
+        if (value[0] == '\0')
+            free(value);
+        else {
+            if (*result != NULL)
+                free(*result);
+            *result = value;
+        }
+    }
+}
+
+
+/*
+ * Load a list option from Kerberos appdefaults.  Takes the PAM arguments, the
+ * context, the section name, the realm, the option, and the result location.
+ *
+ * We may fail here due to memory allocation problems, in which case we return
+ * false to indicate that PAM setup should abort.
+ */
+static bool
+default_list(struct pam_args *args, const char *section, const char *realm,
+             const char *opt, struct vector **result)
+{
+    char *tmp = NULL;
+    struct vector *value;
+
+    default_string(args, section, realm, opt, &tmp);
+    if (tmp != NULL) {
+        value = vector_split_multi(tmp, " \t,", NULL);
+        if (value == NULL) {
+            free(tmp);
+            putil_crit(args, "cannot allocate vector: %s", strerror(errno));
+            return false;
+        }
+        if (*result != NULL)
+            vector_free(*result);
+        *result = value;
+        free(tmp);
+    }
+    return true;
+}
+
+
+/*
+ * The public interface for getting configuration information from krb5.conf.
+ * Takes the PAM arguments, the krb5.conf section, the options specification,
+ * and the number of options in the options table.  The config member of the
+ * args struct must already be allocated.  Iterate through the option list
+ * and, for every option where krb5_config is true, see if it's set in the
+ * Kerberos configuration.
+ *
+ * This looks obviously slow, but there haven't been any reports of problems
+ * and there's no better interface.  But if you wonder where the cycles in
+ * your computer are getting wasted, well, here's one place.
+ */
+bool
+putil_args_krb5(struct pam_args *args, const char *section,
+                const struct option options[], size_t optlen)
+{
+    size_t i;
+    char *realm;
+    bool free_realm = false;
+
+    /* Having no local realm may be intentional, so don't report an error. */
+    if (args->realm != NULL)
+        realm = args->realm;
+    else {
+        if (krb5_get_default_realm(args->ctx, &realm) < 0)
+            realm = NULL;
+        else
+            free_realm = true;
+    }
+    for (i = 0; i < optlen; i++) {
+        const struct option *opt = &options[i];
+
+        if (!opt->krb5_config)
+            continue;
+        switch (opt->type) {
+        case TYPE_BOOLEAN:
+            default_boolean(args, section, realm, opt->name,
+                            CONF_BOOL(args->config, opt->location));
+            break;
+        case TYPE_NUMBER:
+            default_number(args, section, realm, opt->name,
+                           CONF_NUMBER(args->config, opt->location));
+            break;
+        case TYPE_TIME:
+            default_time(args, section, realm, opt->name,
+                         CONF_TIME(args->config, opt->location));
+            break;
+        case TYPE_STRING:
+            default_string(args, section, realm, opt->name,
+                           CONF_STRING(args->config, opt->location));
+            break;
+        case TYPE_LIST:
+        case TYPE_STRLIST:
+            if (!default_list(args, section, realm, opt->name,
+                              CONF_LIST(args->config, opt->location)))
+                return false;
+            break;
+        }
+    }
+    if (free_realm)
+        krb5_free_default_realm(args->ctx, realm);
+    return true;
+}
+
+#else /* !HAVE_KRB5 */
+
+/*
+ * Stub function for getting configuration information from krb5.conf used
+ * when the PAM module is not built with Kerberos support so that the function
+ * can be called unconditionally.
+ */
+bool
+putil_args_krb5(struct pam_args *args UNUSED, const char *section UNUSED,
+                const struct option options[] UNUSED, size_t optlen UNUSED)
+{
+    return true;
+}
+
+#endif /* !HAVE_KRB5 */
+
+
+/*
+ * bsearch comparison function for finding PAM arguments in an array of struct
+ * options.  We only compare up to the first '=' in the key so that we don't
+ * have to munge the string before searching.
+ */
+static int
+option_compare(const void *key, const void *member)
+{
+    const char *string = key;
+    const struct option *option = member;
+    const char *p;
+    size_t length;
+    int result;
+
+    p = strchr(string, '=');
+    if (p == NULL)
+        return strcmp(string, option->name);
+    else {
+        length = (size_t)(p - string);
+        if (length == 0)
+            return -1;
+        result = strncmp(string, option->name, length);
+        if (result == 0 && strlen(option->name) > length)
+            return -1;
+        return result;
+    }
+}
+
+
+/*
+ * Given a PAM argument, convert the value portion of the argument to a
+ * boolean and store it in the provided location.  If the value is missing,
+ * that's equivalent to a true value.  If the value is invalid, report an
+ * error and leave the location unchanged.
+ */
+static void
+convert_boolean(struct pam_args *args, const char *arg, bool *setting)
+{
+    const char *value;
+
+    value = strchr(arg, '=');
+    if (value == NULL)
+        *setting = true;
+    else {
+        value++;
+        /* clang-format off */
+        if      (   strcasecmp(value, "true") == 0
+                 || strcasecmp(value, "yes")  == 0
+                 || strcasecmp(value, "on")   == 0
+                 || strcmp    (value, "1")    == 0)
+            *setting = true;
+        else if (   strcasecmp(value, "false") == 0
+                 || strcasecmp(value, "no")    == 0
+                 || strcasecmp(value, "off")   == 0
+                 || strcmp    (value, "0")     == 0)
+            *setting = false;
+        else
+            putil_err(args, "invalid boolean in setting: %s", arg);
+        /* clang-format on */
+    }
+}
+
+
+/*
+ * Given a PAM argument, convert the value portion of the argument to a number
+ * and store it in the provided location.  If the value is missing or isn't a
+ * number, report an error and leave the location unchanged.
+ */
+static void
+convert_number(struct pam_args *args, const char *arg, long *setting)
+{
+    const char *value;
+    char *end;
+    long result;
+
+    value = strchr(arg, '=');
+    if (value == NULL || value[1] == '\0') {
+        putil_err(args, "value missing for option %s", arg);
+        return;
+    }
+    errno = 0;
+    result = strtol(value + 1, &end, 10);
+    if (errno != 0 || *end != '\0') {
+        putil_err(args, "invalid number in setting: %s", arg);
+        return;
+    }
+    *setting = result;
+}
+
+
+/*
+ * Given a PAM argument, convert the value portion of the argument from a
+ * Kerberos time string to a krb5_deltat and store it in the provided
+ * location.  If the value is missing or isn't a number, report an error and
+ * leave the location unchanged.
+ */
+#ifdef HAVE_KRB5
+static void
+convert_time(struct pam_args *args, const char *arg, krb5_deltat *setting)
+{
+    const char *value;
+    krb5_deltat result;
+    krb5_error_code retval;
+
+    value = strchr(arg, '=');
+    if (value == NULL || value[1] == '\0') {
+        putil_err(args, "value missing for option %s", arg);
+        return;
+    }
+    retval = krb5_string_to_deltat((char *) value + 1, &result);
+    if (retval != 0)
+        putil_err(args, "bad time value in setting: %s", arg);
+    else
+        *setting = result;
+}
+
+#else /* HAVE_KRB5 */
+
+static void
+convert_time(struct pam_args *args, const char *arg, long *setting)
+{
+    convert_number(args, arg, setting);
+}
+
+#endif /* !HAVE_KRB5 */
+
+
+/*
+ * Given a PAM argument, convert the value portion of the argument to a string
+ * and store it in the provided location.  If the value is missing, report an
+ * error and leave the location unchanged, returning true since that's a
+ * non-fatal error.  If memory allocation fails, return false, since PAM setup
+ * should abort.
+ */
+static bool
+convert_string(struct pam_args *args, const char *arg, char **setting)
+{
+    const char *value;
+    char *result;
+
+    value = strchr(arg, '=');
+    if (value == NULL) {
+        putil_err(args, "value missing for option %s", arg);
+        return true;
+    }
+    result = strdup(value + 1);
+    if (result == NULL) {
+        putil_crit(args, "cannot allocate memory: %s", strerror(errno));
+        return false;
+    }
+    free(*setting);
+    *setting = result;
+    return true;
+}
+
+
+/*
+ * Given a PAM argument, convert the value portion of the argument to a vector
+ * and store it in the provided location.  If the value is missing, report an
+ * error and leave the location unchanged, returning true since that's a
+ * non-fatal error.  If memory allocation fails, return false, since PAM setup
+ * should abort.
+ */
+static bool
+convert_list(struct pam_args *args, const char *arg, struct vector **setting)
+{
+    const char *value;
+    struct vector *result;
+
+    value = strchr(arg, '=');
+    if (value == NULL) {
+        putil_err(args, "value missing for option %s", arg);
+        return true;
+    }
+    result = vector_split_multi(value + 1, " \t,", NULL);
+    if (result == NULL) {
+        putil_crit(args, "cannot allocate vector: %s", strerror(errno));
+        return false;
+    }
+    vector_free(*setting);
+    *setting = result;
+    return true;
+}
+
+
+/*
+ * Parse the PAM arguments.  Takes the PAM argument struct, the argument count
+ * and vector, the option table, and the number of elements in the option
+ * table.  The config member of the args struct must already be allocated.
+ * Returns true on success and false on error.  An error return should be
+ * considered fatal.  Report errors using putil_crit().  Unknown options will
+ * also be diagnosed (to syslog at LOG_ERR using putil_err()), but are not
+ * considered fatal errors and will still return true.
+ *
+ * If options should be retrieved from krb5.conf, call putil_args_krb5()
+ * first, before calling this function.
+ */
+bool
+putil_args_parse(struct pam_args *args, int argc, const char *argv[],
+                 const struct option options[], size_t optlen)
+{
+    int i;
+    const struct option *option;
+
+    /*
+     * Second pass: find each option we were given and set the corresponding
+     * configuration parameter.
+     */
+    for (i = 0; i < argc; i++) {
+        option = bsearch(argv[i], options, optlen, sizeof(struct option),
+                         option_compare);
+        if (option == NULL) {
+            putil_err(args, "unknown option %s", argv[i]);
+            continue;
+        }
+        switch (option->type) {
+        case TYPE_BOOLEAN:
+            convert_boolean(args, argv[i],
+                            CONF_BOOL(args->config, option->location));
+            break;
+        case TYPE_NUMBER:
+            convert_number(args, argv[i],
+                           CONF_NUMBER(args->config, option->location));
+            break;
+        case TYPE_TIME:
+            convert_time(args, argv[i],
+                         CONF_TIME(args->config, option->location));
+            break;
+        case TYPE_STRING:
+            if (!convert_string(args, argv[i],
+                                CONF_STRING(args->config, option->location)))
+                return false;
+            break;
+        case TYPE_LIST:
+        case TYPE_STRLIST:
+            if (!convert_list(args, argv[i],
+                              CONF_LIST(args->config, option->location)))
+                return false;
+            break;
+        }
+    }
+    return true;
+}
diff --git a/pam-util/options.h b/pam-util/options.h
new file mode 100644
index 000000000000..062d095e8e7e
--- /dev/null
+++ b/pam-util/options.h
@@ -0,0 +1,205 @@
+/*
+ * Interface to PAM option parsing.
+ *
+ * This interface defines a lot of macros and types with very short names, and
+ * hence without a lot of namespace protection.  It should be included only in
+ * the file that's doing the option parsing and not elsewhere to remove the
+ * risk of clashes.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef PAM_UTIL_OPTIONS_H
+#define PAM_UTIL_OPTIONS_H 1
+
+#include <config.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/macros.h>
+#include <portable/stdbool.h>
+
+#include <stddef.h>
+
+/* Forward declarations to avoid additional includes. */
+struct vector;
+
+/*
+ * The types of configuration values possible.  STRLIST is a list data type
+ * that takes its default from a string value instead of a vector.  For
+ * STRLIST, the default string value will be turned into a vector by splitting
+ * on comma, space, and tab.  (This is the same as would be done with the
+ * value of a PAM setting when the target variable type is a list.)
+ */
+enum type
+{
+    TYPE_BOOLEAN,
+    TYPE_NUMBER,
+    TYPE_TIME,
+    TYPE_STRING,
+    TYPE_LIST,
+    TYPE_STRLIST
+};
+
+/*
+ * Each configuration option is defined by a struct option.  This specifies
+ * the name of the option, its offset into the configuration struct, whether
+ * it can be specified in a krb5.conf file, its type, and its default value if
+ * not set.  Note that PAM configuration options are specified as strings, so
+ * there's no native way of representing a list argument.  List values are
+ * always initialized by splitting a string on whitespace or commas.
+ *
+ * The default value should really be a union, but you can't initialize unions
+ * properly in C in a static initializer without C99 named initializer
+ * support, which we can't (yet) assume.  So use a struct instead, and
+ * initialize all the members, even though we'll only care about one of them.
+ *
+ * Note that numbers set in the configuration struct created by this interface
+ * must be longs, not ints.  There is currently no provision for unsigned
+ * numbers.
+ *
+ * Times take their default from defaults.number.  The difference between time
+ * and number is in the parsing of a user-supplied value and the type of the
+ * stored attribute.
+ */
+struct option {
+    const char *name;
+    size_t location;
+    bool krb5_config;
+    enum type type;
+    struct {
+        bool boolean;
+        long number;
+        const char *string;
+        const struct vector *list;
+    } defaults;
+};
+
+/*
+ * The following macros are helpers to make it easier to define the table that
+ * specifies how to convert the configuration into a struct.  They provide an
+ * initializer for the type and default fields.
+ */
+/* clang-format off */
+#define BOOL(def)    TYPE_BOOLEAN, { (def),     0,  NULL,  NULL }
+#define NUMBER(def)  TYPE_NUMBER,  {     0, (def),  NULL,  NULL }
+#define TIME(def)    TYPE_TIME,    {     0, (def),  NULL,  NULL }
+#define STRING(def)  TYPE_STRING,  {     0,     0, (def),  NULL }
+#define LIST(def)    TYPE_LIST,    {     0,     0,  NULL, (def) }
+#define STRLIST(def) TYPE_STRLIST, {     0,     0, (def),  NULL }
+/* clang-format on */
+
+/*
+ * The user of this file should also define a macro of the following form:
+ *
+ *     #define K(name) (#name), offsetof(struct pam_config, name)
+ *
+ * Then, the definition of the necessary table for building the configuration
+ * will look something like this:
+ *
+ *     const struct option options[] = {
+ *         { K(aklog_homedir), true,  BOOL   (false) },
+ *         { K(cells),         true,  LIST   (NULL)  },
+ *         { K(debug),         false, BOOL   (false) },
+ *         { K(minimum_uid),   true,  NUMBER (0)     },
+ *         { K(program),       true,  STRING (NULL)  },
+ *     };
+ *
+ * which provides a nice, succinct syntax for creating the table.  The options
+ * MUST be in sorted order, since the options parsing code does a binary
+ * search.
+ */
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all internal functions. */
+#pragma GCC visibility push(hidden)
+
+/*
+ * Set the defaults for the PAM configuration.  Takes the PAM arguments, an
+ * option table defined as above, and the number of entries in the table.  The
+ * config member of the args struct must already be allocated.  Returns true
+ * on success and false on error (generally out of memory).  Errors will
+ * already be reported using putil_crit().
+ *
+ * This function must be called before either putil_args_krb5() or
+ * putil_args_parse(), since neither of those functions set defaults.
+ */
+bool putil_args_defaults(struct pam_args *, const struct option options[],
+                         size_t optlen) __attribute__((__nonnull__));
+
+/*
+ * Fill out options from krb5.conf.  Takes the PAM args structure, the name of
+ * the section for the software being configured, an option table defined as
+ * above, and the number of entries in the table.  The config member of the
+ * args struct must already be allocated.  Only those options whose
+ * krb5_config attribute is true will be considered.
+ *
+ * This code automatically checks for configuration settings scoped to the
+ * local realm, so the default realm should be set before calling this
+ * function.  If that's done based on a configuration option, one may need to
+ * pre-parse the configuration options.
+ *
+ * Returns true on success and false on an error.  An error return should be
+ * considered fatal.  Errors will already be reported using putil_crit*() or
+ * putil_err*() as appropriate.  If Kerberos is not available, returns without
+ * doing anything.
+ *
+ * putil_args_defaults() should be called before this function.
+ */
+bool putil_args_krb5(struct pam_args *, const char *section,
+                     const struct option options[], size_t optlen)
+    __attribute__((__nonnull__));
+
+/*
+ * Parse the PAM arguments and fill out the provided struct.  Takes the PAM
+ * arguments, the argument count and vector, an option table defined as above,
+ * and the number of entries in the table.  The config member of the args
+ * struct must already be allocated.  Returns true on success and false on
+ * error.  An error return should be considered fatal.  Errors will already be
+ * reported using putil_crit().  Unknown options will also be diagnosed (to
+ * syslog at LOG_ERR using putil_err()), but are not considered fatal errors
+ * and will still return true.
+ *
+ * The krb5_config option of the option configuration is ignored by this
+ * function.  If options should be retrieved from krb5.conf, call
+ * putil_args_krb5() first, before calling this function.
+ *
+ * putil_args_defaults() should be called before this function.
+ */
+bool putil_args_parse(struct pam_args *, int argc, const char *argv[],
+                      const struct option options[], size_t optlen)
+    __attribute__((__nonnull__));
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+#endif /* !PAM_UTIL_OPTIONS_H */
diff --git a/pam-util/vector.c b/pam-util/vector.c
new file mode 100644
index 000000000000..012a9aef24a3
--- /dev/null
+++ b/pam-util/vector.c
@@ -0,0 +1,289 @@
+/*
+ * Vector handling (counted lists of char *'s).
+ *
+ * A vector is a table for handling a list of strings with less overhead than
+ * linked list.  The intention is for vectors, once allocated, to be reused;
+ * this saves on memory allocations once the array of char *'s reaches a
+ * stable size.
+ *
+ * This is based on the util/vector.c library, but that library uses xmalloc
+ * routines to exit the program if memory allocation fails.  This is a
+ * modified version of the vector library that instead returns false on
+ * failure to allocate memory, allowing the caller to do appropriate recovery.
+ *
+ * Vectors require list of strings, not arbitrary binary data, and cannot
+ * handle data elements containing nul characters.
+ *
+ * Only the portions of the vector library used by PAM modules are
+ * implemented.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017-2018 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <pam-util/vector.h>
+
+
+/*
+ * Allocate a new, empty vector.  Returns NULL if memory allocation fails.
+ */
+struct vector *
+vector_new(void)
+{
+    struct vector *vector;
+
+    vector = calloc(1, sizeof(struct vector));
+    vector->allocated = 1;
+    vector->strings = calloc(1, sizeof(char *));
+    return vector;
+}
+
+
+/*
+ * Allocate a new vector that's a copy of an existing vector.  Returns NULL if
+ * memory allocation fails.
+ */
+struct vector *
+vector_copy(const struct vector *old)
+{
+    struct vector *vector;
+    size_t i;
+
+    vector = vector_new();
+    if (!vector_resize(vector, old->count)) {
+        vector_free(vector);
+        return NULL;
+    }
+    vector->count = old->count;
+    for (i = 0; i < old->count; i++) {
+        vector->strings[i] = strdup(old->strings[i]);
+        if (vector->strings[i] == NULL) {
+            vector_free(vector);
+            return NULL;
+        }
+    }
+    return vector;
+}
+
+
+/*
+ * Resize a vector (using reallocarray to resize the table).  Return false if
+ * memory allocation fails.
+ */
+bool
+vector_resize(struct vector *vector, size_t size)
+{
+    size_t i;
+    char **strings;
+
+    if (vector->count > size) {
+        for (i = size; i < vector->count; i++)
+            free(vector->strings[i]);
+        vector->count = size;
+    }
+    if (size == 0)
+        size = 1;
+    strings = reallocarray(vector->strings, size, sizeof(char *));
+    if (strings == NULL)
+        return false;
+    vector->strings = strings;
+    vector->allocated = size;
+    return true;
+}
+
+
+/*
+ * Add a new string to the vector, resizing the vector as necessary.  The
+ * vector is resized an element at a time; if a lot of resizes are expected,
+ * vector_resize should be called explicitly with a more suitable size.
+ * Return false if memory allocation fails.
+ */
+bool
+vector_add(struct vector *vector, const char *string)
+{
+    size_t next = vector->count;
+
+    if (vector->count == vector->allocated)
+        if (!vector_resize(vector, vector->allocated + 1))
+            return false;
+    vector->strings[next] = strdup(string);
+    if (vector->strings[next] == NULL)
+        return false;
+    vector->count++;
+    return true;
+}
+
+
+/*
+ * Empty a vector but keep the allocated memory for the pointer table.
+ */
+void
+vector_clear(struct vector *vector)
+{
+    size_t i;
+
+    for (i = 0; i < vector->count; i++)
+        if (vector->strings[i] != NULL)
+            free(vector->strings[i]);
+    vector->count = 0;
+}
+
+
+/*
+ * Free a vector completely.
+ */
+void
+vector_free(struct vector *vector)
+{
+    if (vector == NULL)
+        return;
+    vector_clear(vector);
+    free(vector->strings);
+    free(vector);
+}
+
+
+/*
+ * Given a vector that we may be reusing, clear it out.  If the first argument
+ * is NULL, allocate a new vector.  Used by vector_split*.  Returns NULL if
+ * memory allocation fails.
+ */
+static struct vector *
+vector_reuse(struct vector *vector)
+{
+    if (vector == NULL)
+        return vector_new();
+    else {
+        vector_clear(vector);
+        return vector;
+    }
+}
+
+
+/*
+ * Given a string and a set of separators expressed as a string, count the
+ * number of strings that it will split into when splitting on those
+ * separators.
+ */
+static size_t
+split_multi_count(const char *string, const char *seps)
+{
+    const char *p;
+    size_t count;
+
+    if (*string == '\0')
+        return 0;
+    for (count = 1, p = string + 1; *p != '\0'; p++)
+        if (strchr(seps, *p) != NULL && strchr(seps, p[-1]) == NULL)
+            count++;
+
+    /*
+     * If the string ends in separators, we've overestimated the number of
+     * strings by one.
+     */
+    if (strchr(seps, p[-1]) != NULL)
+        count--;
+    return count;
+}
+
+
+/*
+ * Given a string, split it at any of the provided separators to form a
+ * vector, copying each string segment.  If the third argument isn't NULL,
+ * reuse that vector; otherwise, allocate a new one.  Any number of
+ * consecutive separators are considered a single separator.  Returns NULL on
+ * memory allocation failure, after which the provided vector may only have
+ * partial results.
+ */
+struct vector *
+vector_split_multi(const char *string, const char *seps, struct vector *vector)
+{
+    const char *p, *start;
+    size_t i, count;
+    bool created = false;
+
+    if (vector == NULL)
+        created = true;
+    vector = vector_reuse(vector);
+    if (vector == NULL)
+        return NULL;
+
+    count = split_multi_count(string, seps);
+    if (vector->allocated < count && !vector_resize(vector, count))
+        goto fail;
+
+    vector->count = 0;
+    for (start = string, p = string, i = 0; *p != '\0'; p++)
+        if (strchr(seps, *p) != NULL) {
+            if (start != p) {
+                vector->strings[i] = strndup(start, (size_t)(p - start));
+                if (vector->strings[i] == NULL)
+                    goto fail;
+                i++;
+                vector->count++;
+            }
+            start = p + 1;
+        }
+    if (start != p) {
+        vector->strings[i] = strndup(start, (size_t)(p - start));
+        if (vector->strings[i] == NULL)
+            goto fail;
+        vector->count++;
+    }
+    return vector;
+
+fail:
+    if (created)
+        vector_free(vector);
+    return NULL;
+}
+
+
+/*
+ * Given a vector and a path to a program, exec that program with the vector
+ * as its arguments.  This requires adding a NULL terminator to the vector and
+ * casting it appropriately.  Returns 0 on success and -1 on error, like exec
+ * does.
+ */
+int
+vector_exec(const char *path, struct vector *vector)
+{
+    if (vector->allocated == vector->count)
+        if (!vector_resize(vector, vector->count + 1))
+            return -1;
+    vector->strings[vector->count] = NULL;
+    return execv(path, (char *const *) vector->strings);
+}
+
+
+/*
+ * Given a vector, a path to a program, and the environment, exec that program
+ * with the vector as its arguments and the given environment.  This requires
+ * adding a NULL terminator to the vector and casting it appropriately.
+ * Returns 0 on success and -1 on error, like exec does.
+ */
+int
+vector_exec_env(const char *path, struct vector *vector,
+                const char *const env[])
+{
+    if (vector->allocated == vector->count)
+        if (!vector_resize(vector, vector->count + 1))
+            return -1;
+    vector->strings[vector->count] = NULL;
+    return execve(path, (char *const *) vector->strings, (char *const *) env);
+}
diff --git a/pam-util/vector.h b/pam-util/vector.h
new file mode 100644
index 000000000000..351c53f8d40b
--- /dev/null
+++ b/pam-util/vector.h
@@ -0,0 +1,120 @@
+/*
+ * Prototypes for vector handling.
+ *
+ * A vector is a list of strings, with dynamic resizing of the list as new
+ * strings are added and support for various operations on strings (such as
+ * splitting them on delimiters).
+ *
+ * Vectors require list of strings, not arbitrary binary data, and cannot
+ * handle data elements containing nul characters.
+ *
+ * This is based on the util/vector.c library, but that library uses xmalloc
+ * routines to exit the program if memory allocation fails.  This is a
+ * modified version of the vector library that instead returns false on
+ * failure to allocate memory, allowing the caller to do appropriate recovery.
+ *
+ * Only the portions of the vector library used by PAM modules are
+ * implemented.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PAM_UTIL_VECTOR_H
+#define PAM_UTIL_VECTOR_H 1
+
+#include <config.h>
+#include <portable/macros.h>
+#include <portable/stdbool.h>
+
+#include <stddef.h>
+
+struct vector {
+    size_t count;
+    size_t allocated;
+    char **strings;
+};
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all util functions. */
+#pragma GCC visibility push(hidden)
+
+/* Create a new, empty vector.  Returns NULL on memory allocation failure. */
+struct vector *vector_new(void) __attribute__((__malloc__));
+
+/*
+ * Create a new vector that's a copy of an existing vector.  Returns NULL on
+ * memory allocation failure.
+ */
+struct vector *vector_copy(const struct vector *)
+    __attribute__((__malloc__, __nonnull__));
+
+/*
+ * Add a string to a vector.  Resizes the vector if necessary.  Returns false
+ * on failure to allocate memory.
+ */
+bool vector_add(struct vector *, const char *string)
+    __attribute__((__nonnull__));
+
+/*
+ * Resize the array of strings to hold size entries.  Saves reallocation work
+ * in vector_add if it's known in advance how many entries there will be.
+ * Returns false on failure to allocate memory.
+ */
+bool vector_resize(struct vector *, size_t size) __attribute__((__nonnull__));
+
+/*
+ * Reset the number of elements to zero, freeing all of the strings for a
+ * regular vector, but not freeing the strings array (to cut down on memory
+ * allocations if the vector will be reused).
+ */
+void vector_clear(struct vector *) __attribute__((__nonnull__));
+
+/* Free the vector and all resources allocated for it. */
+void vector_free(struct vector *);
+
+/*
+ * Split functions build a vector from a string.  vector_split_multi splits on
+ * a set of characters.  If the vector argument is NULL, a new vector is
+ * allocated; otherwise, the provided one is reused.  Returns NULL on memory
+ * allocation failure, after which the provided vector may have been modified
+ * to only have partial results.
+ *
+ * Empty strings will yield zero-length vectors.  Adjacent delimiters are
+ * treated as a single delimiter by vector_split_multi.  Any leading or
+ * trailing delimiters are ignored, so this function will never create
+ * zero-length strings (similar to the behavior of strtok).
+ */
+struct vector *vector_split_multi(const char *string, const char *seps,
+                                  struct vector *)
+    __attribute__((__nonnull__(1, 2)));
+
+/*
+ * Exec the given program with the vector as its arguments.  Return behavior
+ * is the same as execv.  Note the argument order is different than the other
+ * vector functions (but the same as execv).  The vector_exec_env variant
+ * calls execve and passes in the environment for the program.
+ */
+int vector_exec(const char *path, struct vector *)
+    __attribute__((__nonnull__));
+int vector_exec_env(const char *path, struct vector *, const char *const env[])
+    __attribute__((__nonnull__));
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+#endif /* UTIL_VECTOR_H */
diff --git a/portable/asprintf.c b/portable/asprintf.c
new file mode 100644
index 000000000000..0451a03ed190
--- /dev/null
+++ b/portable/asprintf.c
@@ -0,0 +1,84 @@
+/*
+ * Replacement for a missing asprintf and vasprintf.
+ *
+ * Provides the same functionality as the standard GNU library routines
+ * asprintf and vasprintf for those platforms that don't have them.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006, 2015 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2008-2009, 2011, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/macros.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+/*
+ * If we're running the test suite, rename the functions to avoid conflicts
+ * with the system versions.
+ */
+#if TESTING
+#    undef asprintf
+#    undef vasprintf
+#    define asprintf  test_asprintf
+#    define vasprintf test_vasprintf
+int test_asprintf(char **, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+int test_vasprintf(char **, const char *, va_list)
+    __attribute__((__format__(printf, 2, 0)));
+#endif
+
+
+int
+asprintf(char **strp, const char *fmt, ...)
+{
+    va_list args;
+    int status;
+
+    va_start(args, fmt);
+    status = vasprintf(strp, fmt, args);
+    va_end(args);
+    return status;
+}
+
+
+int
+vasprintf(char **strp, const char *fmt, va_list args)
+{
+    va_list args_copy;
+    int status, needed, oerrno;
+
+    va_copy(args_copy, args);
+    needed = vsnprintf(NULL, 0, fmt, args_copy);
+    va_end(args_copy);
+    if (needed < 0) {
+        *strp = NULL;
+        return needed;
+    }
+    *strp = malloc(needed + 1);
+    if (*strp == NULL)
+        return -1;
+    status = vsnprintf(*strp, needed + 1, fmt, args);
+    if (status >= 0)
+        return status;
+    else {
+        oerrno = errno;
+        free(*strp);
+        *strp = NULL;
+        errno = oerrno;
+        return status;
+    }
+}
diff --git a/portable/dummy.c b/portable/dummy.c
new file mode 100644
index 000000000000..121a7343edd0
--- /dev/null
+++ b/portable/dummy.c
@@ -0,0 +1,33 @@
+/*
+ * Dummy symbol to prevent an empty library.
+ *
+ * On platforms that already have all of the functions that libportable would
+ * supply, Automake builds an empty library and then calls ar with nonsensical
+ * arguments.  Ensure that libportable always contains at least one symbol.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2008, 2011, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <portable/macros.h>
+
+/* Prototype to avoid gcc warnings and set visibility. */
+int portable_dummy(void) __attribute__((__const__, __visibility__("hidden")));
+
+int
+portable_dummy(void)
+{
+    return 42;
+}
diff --git a/portable/issetugid.c b/portable/issetugid.c
new file mode 100644
index 000000000000..2e37185df520
--- /dev/null
+++ b/portable/issetugid.c
@@ -0,0 +1,35 @@
+/*
+ * Replacement for a missing issetugid.
+ *
+ * Simulates the functionality as the Solaris function issetugid, which
+ * returns true if the running program was setuid or setgid.  The replacement
+ * test is not quite as comprehensive as what the Solaris function does, but
+ * it should be good enough.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+int
+issetugid(void)
+{
+    if (getuid() != geteuid())
+        return 1;
+    if (getgid() != getegid())
+        return 1;
+    return 0;
+}
diff --git a/portable/kadmin.h b/portable/kadmin.h
new file mode 100644
index 000000000000..875682d986b5
--- /dev/null
+++ b/portable/kadmin.h
@@ -0,0 +1,82 @@
+/*
+ * Portability wrapper around kadm5/admin.h.
+ *
+ * This header adjusts for differences between the MIT and Heimdal kadmin
+ * client libraries so that the code can be written to a consistent API
+ * (favoring the Heimdal API as the exposed one).
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2015 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PORTABLE_KADMIN_H
+#define PORTABLE_KADMIN_H 1
+
+#include <config.h>
+
+#include <kadm5/admin.h>
+#ifdef HAVE_KADM5_KADM5_ERR_H
+#    include <kadm5/kadm5_err.h>
+#else
+#    include <kadm5/kadm_err.h>
+#endif
+
+/*
+ * MIT as of 1.10 supports version 3.  Heimdal as of 1.5 has a maximum version
+ * of 2.  Define a KADM5_API_VERSION symbol that holds the maximum version.
+ * (Heimdal does this for us, so we only have to do that with MIT, but be
+ * general just in case.)
+ */
+#ifndef KADM5_API_VERSION
+#    ifdef KADM5_API_VERSION_3
+#        define KADM5_API_VERSION KADM5_API_VERSION_3
+#    else
+#        define KADM5_API_VERSION KADM5_API_VERSION_2
+#    endif
+#endif
+
+/* Heimdal doesn't define KADM5_PASS_Q_GENERIC. */
+#ifndef KADM5_PASS_Q_GENERIC
+#    define KADM5_PASS_Q_GENERIC KADM5_PASS_Q_DICT
+#endif
+
+/* Heimdal doesn't define KADM5_MISSING_KRB5_CONF_PARAMS. */
+#ifndef KADM5_MISSING_KRB5_CONF_PARAMS
+#    define KADM5_MISSING_KRB5_CONF_PARAMS KADM5_MISSING_CONF_PARAMS
+#endif
+
+/*
+ * MIT Kerberos provides this function for pure kadmin clients to get a
+ * Kerberos context.  With Heimdal, just use krb5_init_context.
+ */
+#ifndef HAVE_KADM5_INIT_KRB5_CONTEXT
+#    define kadm5_init_krb5_context(c) krb5_init_context(c)
+#endif
+
+/*
+ * Heimdal provides _ctx functions that take an existing context.  MIT always
+ * requires the context be passed in.  Code should use the _ctx variant, and
+ * the below will fix it up if built against MIT.
+ *
+ * MIT also doesn't have a const prototype for the server argument, so cast it
+ * so that we can use the KADM5_ADMIN_SERVICE define.
+ */
+#ifndef HAVE_KADM5_INIT_WITH_SKEY_CTX
+#    define kadm5_init_with_skey_ctx(c, u, k, s, p, sv, av, h)             \
+        kadm5_init_with_skey((c), (u), (k), (char *) (s), (p), (sv), (av), \
+                             NULL, (h))
+#endif
+
+#endif /* !PORTABLE_KADMIN_H */
diff --git a/portable/krb5-extra.c b/portable/krb5-extra.c
new file mode 100644
index 000000000000..d819e6635aef
--- /dev/null
+++ b/portable/krb5-extra.c
@@ -0,0 +1,186 @@
+/*
+ * Portability glue functions for Kerberos.
+ *
+ * This file provides definitions of the interfaces that portable/krb5.h
+ * ensures exist if the function wasn't available in the Kerberos libraries.
+ * Everything in this file will be protected by #ifndef.  If the native
+ * Kerberos libraries are fully capable, this file will be skipped.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2015-2016, 2018 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/macros.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+/* Figure out what header files to include for error reporting. */
+#if !defined(HAVE_KRB5_GET_ERROR_MESSAGE) && !defined(HAVE_KRB5_GET_ERR_TEXT)
+#    if !defined(HAVE_KRB5_GET_ERROR_STRING)
+#        if defined(HAVE_IBM_SVC_KRB5_SVC_H)
+#            include <ibm_svc/krb5_svc.h>
+#        elif defined(HAVE_ET_COM_ERR_H)
+#            include <et/com_err.h>
+#        elif defined(HAVE_KERBEROSV5_COM_ERR_H)
+#            include <kerberosv5/com_err.h>
+#        else
+#            include <com_err.h>
+#        endif
+#    endif
+#endif
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+/*
+ * This string is returned for unknown error messages.  We use a static
+ * variable so that we can be sure not to free it.
+ */
+#if !defined(HAVE_KRB5_GET_ERROR_MESSAGE) \
+    || !defined(HAVE_KRB5_FREE_ERROR_MESSAGE)
+static const char error_unknown[] = "unknown error";
+#endif
+
+
+#ifndef HAVE_KRB5_CC_GET_FULL_NAME
+/*
+ * Given a Kerberos ticket cache, return the full name (TYPE:name) in
+ * newly-allocated memory.  Returns an error code.  Avoid asprintf and
+ * snprintf here in case someone wants to use this code without the rest of
+ * the portability layer.
+ */
+krb5_error_code
+krb5_cc_get_full_name(krb5_context ctx, krb5_ccache ccache, char **out)
+{
+    const char *type, *name;
+    size_t length;
+
+    type = krb5_cc_get_type(ctx, ccache);
+    if (type == NULL)
+        type = "FILE";
+    name = krb5_cc_get_name(ctx, ccache);
+    if (name == NULL)
+        return EINVAL;
+    length = strlen(type) + 1 + strlen(name) + 1;
+    *out = malloc(length);
+    if (*out == NULL)
+        return errno;
+    sprintf(*out, "%s:%s", type, name);
+    return 0;
+}
+#endif /* !HAVE_KRB5_CC_GET_FULL_NAME */
+
+
+#ifndef HAVE_KRB5_GET_ERROR_MESSAGE
+/*
+ * Given a Kerberos error code, return the corresponding error.  Prefer the
+ * Kerberos interface if available since it will provide context-specific
+ * error information, whereas the error_message() call will only provide a
+ * fixed message.
+ */
+const char *
+krb5_get_error_message(krb5_context ctx UNUSED, krb5_error_code code UNUSED)
+{
+    const char *msg;
+
+#    if defined(HAVE_KRB5_GET_ERROR_STRING)
+    msg = krb5_get_error_string(ctx);
+#    elif defined(HAVE_KRB5_GET_ERR_TEXT)
+    msg = krb5_get_err_text(ctx, code);
+#    elif defined(HAVE_KRB5_SVC_GET_MSG)
+    krb5_svc_get_msg(code, (char **) &msg);
+#    else
+    msg = error_message(code);
+#    endif
+    if (msg == NULL)
+        return error_unknown;
+    else
+        return msg;
+}
+#endif /* !HAVE_KRB5_GET_ERROR_MESSAGE */
+
+
+#ifndef HAVE_KRB5_FREE_ERROR_MESSAGE
+/*
+ * Free an error string if necessary.  If we returned a static string, make
+ * sure we don't free it.
+ *
+ * This code assumes that the set of implementations that have
+ * krb5_free_error_message is a subset of those with krb5_get_error_message.
+ * If this assumption ever breaks, we may call the wrong free function.
+ */
+void
+krb5_free_error_message(krb5_context ctx UNUSED, const char *msg)
+{
+    if (msg == error_unknown)
+        return;
+#    if defined(HAVE_KRB5_GET_ERROR_STRING)
+    krb5_free_error_string(ctx, (char *) msg);
+#    elif defined(HAVE_KRB5_SVC_GET_MSG)
+    krb5_free_string(ctx, (char *) msg);
+#    endif
+}
+#endif /* !HAVE_KRB5_FREE_ERROR_MESSAGE */
+
+
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
+/*
+ * Allocate and initialize a krb5_get_init_creds_opt struct.  This code
+ * assumes that an all-zero bit pattern will create a NULL pointer.
+ */
+krb5_error_code
+krb5_get_init_creds_opt_alloc(krb5_context ctx UNUSED,
+                              krb5_get_init_creds_opt **opts)
+{
+    *opts = calloc(1, sizeof(krb5_get_init_creds_opt));
+    if (*opts == NULL)
+        return errno;
+    krb5_get_init_creds_opt_init(*opts);
+    return 0;
+}
+#endif /* !HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC */
+
+
+#ifndef HAVE_KRB5_PRINCIPAL_GET_REALM
+/*
+ * Return the realm of a principal as a const char *.
+ */
+const char *
+krb5_principal_get_realm(krb5_context ctx UNUSED, krb5_const_principal princ)
+{
+    const krb5_data *data;
+
+    data = krb5_princ_realm(ctx, princ);
+    if (data == NULL || data->data == NULL)
+        return NULL;
+    return data->data;
+}
+#endif /* !HAVE_KRB5_PRINCIPAL_GET_REALM */
+
+
+#ifndef HAVE_KRB5_VERIFY_INIT_CREDS_OPT_INIT
+/*
+ * Initialize the option struct for krb5_verify_init_creds.
+ */
+void
+krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt)
+{
+    opt->flags = 0;
+    opt->ap_req_nofail = 0;
+}
+#endif
diff --git a/portable/krb5-profile.c b/portable/krb5-profile.c
new file mode 100644
index 000000000000..582e7ac76672
--- /dev/null
+++ b/portable/krb5-profile.c
@@ -0,0 +1,237 @@
+/*
+ * Kerberos compatibility functions for AIX's NAS libraries.
+ *
+ * AIX for some reason doesn't provide the krb5_appdefault_* functions, but
+ * does provide the underlying profile library functions (as a separate
+ * libk5profile with a separate k5profile.h header file).
+ *
+ * This file is therefore (apart from the includes, opening and closing
+ * comments, and the spots marked with an rra-c-util comment) a verbatim copy
+ * of src/lib/krb5/krb/appdefault.c from MIT Kerberos 1.4.4.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Copyright 1985-2005 by the Massachusetts Institute of Technology.
+ * For license information, see the end of this file.
+ */
+
+#include <config.h>
+
+#include <krb5.h>
+#ifdef HAVE_K5PROFILE_H
+# include <k5profile.h>
+#endif
+#ifdef HAVE_PROFILE_H
+# include <profile.h>
+#endif
+#include <stdio.h>
+#include <string.h>
+
+ /*xxx Duplicating this is annoying; try to work on a better way.*/
+static const char *const conf_yes[] = {
+	"y", "yes", "true", "t", "1", "on",
+	0,
+};
+
+static const char *const conf_no[] = {
+	"n", "no", "false", "nil", "0", "off",
+	0,
+};
+
+static int conf_boolean(char *s)
+{
+	const char * const *p;
+	for(p=conf_yes; *p; p++) {
+		if (!strcasecmp(*p,s))
+			return 1;
+	}
+	for(p=conf_no; *p; p++) {
+		if (!strcasecmp(*p,s))
+		return 0;
+	}
+	/* Default to "no" */
+	return 0;
+}
+
+static krb5_error_code appdefault_get(krb5_context context, const char *appname, const krb5_data *realm, const char *option, char **ret_value)
+{
+        profile_t profile;
+        const char *names[5];
+	char **nameval = NULL;
+	krb5_error_code retval;
+	const char * realmstr =  realm?realm->data:NULL;
+
+        /*
+         * rra-c-util: The magic values are internal, so a magic check for the
+         * context struct was removed here.  Call krb5_get_profile if it's
+         * available since the krb5_context struct may be opaque.
+         */
+	    if (!context) 
+	    return KV5M_CONTEXT;
+
+#ifdef HAVE_KRB5_GET_PROFILE
+            krb5_get_profile(context, &profile);
+#else
+	    profile = context->profile;
+#endif
+	    
+	/*
+	 * Try number one:
+	 *
+	 * [appdefaults]
+	 *	app = {
+	 *		SOME.REALM = {
+	 *			option = <boolean>
+	 *		}
+	 *	}
+	 */
+
+	names[0] = "appdefaults";
+	names[1] = appname;
+
+	if (realmstr) {
+		names[2] = realmstr;
+		names[3] = option;
+		names[4] = 0;
+		retval = profile_get_values(profile, names, &nameval);
+		if (retval == 0 && nameval && nameval[0]) {
+			*ret_value = strdup(nameval[0]);
+			goto goodbye;
+		}
+	}
+
+	/*
+	 * Try number two:
+	 *
+	 * [appdefaults]
+	 *	app = {
+	 *		option = <boolean>
+	 *      }
+	 */
+
+	names[2] = option;
+	names[3] = 0;
+	retval = profile_get_values(profile, names, &nameval);
+	if (retval == 0 && nameval && nameval[0]) {
+		*ret_value = strdup(nameval[0]);
+		goto goodbye;
+	}
+
+	/*
+	 * Try number three:
+	 *
+	 * [appdefaults]
+	 *	realm = {
+	 *		option = <boolean>
+	 */
+	
+	if (realmstr) {
+		names[1] = realmstr;
+		names[2] = option;
+		names[3] = 0;
+		retval = profile_get_values(profile, names, &nameval);
+		if (retval == 0 && nameval && nameval[0]) {
+			*ret_value = strdup(nameval[0]);
+			goto goodbye;
+		}
+	}
+
+	/*
+	 * Try number four:
+	 *
+	 * [appdefaults]
+	 *	option = <boolean>
+	 */
+
+	names[1] = option;
+	names[2] = 0;
+	retval = profile_get_values(profile, names, &nameval);
+	if (retval == 0 && nameval && nameval[0]) {
+		*ret_value = strdup(nameval[0]);
+	} else {
+		return retval;
+	}
+
+goodbye:
+	if (nameval) {
+		char **cpp;
+		for (cpp = nameval; *cpp; cpp++)
+			free(*cpp);
+		free(nameval);
+	}
+	return 0;
+}
+
+void KRB5_CALLCONV 
+krb5_appdefault_boolean(krb5_context context, const char *appname, const krb5_data *realm, const char *option, int default_value, int *ret_value)
+{
+	char *string = NULL;
+	krb5_error_code retval;
+
+	retval = appdefault_get(context, appname, realm, option, &string);
+
+	if (! retval && string) {
+		*ret_value = conf_boolean(string);
+		free(string);
+	} else
+		*ret_value = default_value;
+}
+
+void KRB5_CALLCONV 
+krb5_appdefault_string(krb5_context context, const char *appname, const krb5_data *realm, const char *option, const char *default_value, char **ret_value)
+{
+	krb5_error_code retval;
+	char *string;
+
+	retval = appdefault_get(context, appname, realm, option, &string);
+
+	if (! retval && string) {
+		*ret_value = string;
+	} else {
+		*ret_value = strdup(default_value);
+	}
+}
+
+/*
+ * Copyright (C) 1985-2005 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ * 
+ * Export of this software from the United States of America may require
+ * a specific license from the United States Government.  It is the
+ * responsibility of any person or organization contemplating export to
+ * obtain such a license before exporting.
+ * 
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original MIT software.
+ * M.I.T. makes no representations about the suitability of this software
+ * for any purpose.  It is provided "as is" without express or implied
+ * warranty.
+ * 
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ * 
+ * Individual source code files are copyright MIT, Cygnus Support,
+ * OpenVision, Oracle, Sun Soft, FundsXpress, and others.
+ * 
+ * Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira,
+ * and Zephyr are trademarks of the Massachusetts Institute of Technology
+ * (MIT).  No commercial use of these trademarks may be made without
+ * prior written permission of MIT.
+ * 
+ * "Commercial use" means use of a name in a product or other for-profit
+ * manner.  It does NOT prevent a commercial firm from referring to the
+ * MIT trademarks in order to convey information (although in doing so,
+ * recognition of their trademark status should be given).
+ *
+ * There is no SPDX-License-Identifier registered for this license.
+ */
diff --git a/portable/krb5.h b/portable/krb5.h
new file mode 100644
index 000000000000..8c2726987b33
--- /dev/null
+++ b/portable/krb5.h
@@ -0,0 +1,248 @@
+/*
+ * Portability wrapper around krb5.h.
+ *
+ * This header includes krb5.h and then adjusts for various portability
+ * issues, primarily between MIT Kerberos and Heimdal, so that code can be
+ * written to a consistent API.
+ *
+ * Unfortunately, due to the nature of the differences between MIT Kerberos
+ * and Heimdal, it's not possible to write code to either one of the APIs and
+ * adjust for the other one.  In general, this header tries to make available
+ * the Heimdal API and fix it for MIT Kerberos, but there are places where MIT
+ * Kerberos requires a more specific call.  For those cases, it provides the
+ * most specific interface.
+ *
+ * For example, MIT Kerberos has krb5_free_unparsed_name() whereas Heimdal
+ * prefers the generic krb5_xfree().  In this case, this header provides
+ * krb5_free_unparsed_name() for both APIs since it's the most specific call.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2015, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PORTABLE_KRB5_H
+#define PORTABLE_KRB5_H 1
+
+/*
+ * Allow inclusion of config.h to be skipped, since sometimes we have to use a
+ * stripped-down version of config.h with a different name.
+ */
+#ifndef CONFIG_H_INCLUDED
+#    include <config.h>
+#endif
+#include <portable/macros.h>
+
+#if defined(HAVE_KRB5_H)
+#    include <krb5.h>
+#elif defined(HAVE_KERBEROSV5_KRB5_H)
+#    include <kerberosv5/krb5.h>
+#else
+#    include <krb5/krb5.h>
+#endif
+#include <stdlib.h>
+
+/* Heimdal: KRB5_WELLKNOWN_NAME, MIT: KRB5_WELLKNOWN_NAMESTR. */
+#ifndef KRB5_WELLKNOWN_NAME
+#    ifdef KRB5_WELLKNOWN_NAMESTR
+#        define KRB5_WELLKNOWN_NAME KRB5_WELLKNOWN_NAMESTR
+#    else
+#        define KRB5_WELLKNOWN_NAME "WELLKNOWN"
+#    endif
+#endif
+
+/* Heimdal: KRB5_ANON_NAME, MIT: KRB5_ANONYMOUS_PRINCSTR. */
+#ifndef KRB5_ANON_NAME
+#    ifdef KRB5_ANONYMOUS_PRINCSTR
+#        define KRB5_ANON_NAME KRB5_ANONYMOUS_PRINCSTR
+#    else
+#        define KRB5_ANON_NAME "ANONYMOUS"
+#    endif
+#endif
+
+/* Heimdal: KRB5_ANON_REALM, MIT: KRB5_ANONYMOUS_REALMSTR. */
+#ifndef KRB5_ANON_REALM
+#    ifdef KRB5_ANONYMOUS_REALMSTR
+#        define KRB5_ANON_REALM KRB5_ANONYMOUS_REALMSTR
+#    else
+#        define KRB5_ANON_REALM "WELLKNOWN:ANONYMOUS"
+#    endif
+#endif
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all portability functions. */
+#pragma GCC visibility push(hidden)
+
+/*
+ * AIX included Kerberos includes the profile library but not the
+ * krb5_appdefault functions, so we provide replacements that we have to
+ * prototype.
+ */
+#ifndef HAVE_KRB5_APPDEFAULT_STRING
+void krb5_appdefault_boolean(krb5_context, const char *, const krb5_data *,
+                             const char *, int, int *);
+void krb5_appdefault_string(krb5_context, const char *, const krb5_data *,
+                            const char *, const char *, char **);
+#endif
+
+/*
+ * Now present in both Heimdal and MIT, but very new in MIT and not present in
+ * older Heimdal.
+ */
+#ifndef HAVE_KRB5_CC_GET_FULL_NAME
+krb5_error_code krb5_cc_get_full_name(krb5_context, krb5_ccache, char **);
+#endif
+
+/* Heimdal: krb5_data_free, MIT: krb5_free_data_contents. */
+#ifdef HAVE_KRB5_DATA_FREE
+#    define krb5_free_data_contents(c, d) krb5_data_free(d)
+#endif
+
+/*
+ * MIT-specific.  The Heimdal documentation says to use free(), but that
+ * doesn't actually make sense since the memory is allocated inside the
+ * Kerberos library.  Use krb5_xfree instead.
+ */
+#ifndef HAVE_KRB5_FREE_DEFAULT_REALM
+#    define krb5_free_default_realm(c, r) krb5_xfree(r)
+#endif
+
+/*
+ * Heimdal: krb5_xfree, MIT: krb5_free_string, older MIT uses free().  Note
+ * that we can incorrectly allocate in the library and call free() if
+ * krb5_free_string is not available but something we use that API for is
+ * available, such as krb5_appdefaults_*, but there isn't anything we can
+ * really do about it.
+ */
+#ifndef HAVE_KRB5_FREE_STRING
+#    ifdef HAVE_KRB5_XFREE
+#        define krb5_free_string(c, s) krb5_xfree(s)
+#    else
+#        define krb5_free_string(c, s) free(s)
+#    endif
+#endif
+
+/* Heimdal: krb5_xfree, MIT: krb5_free_unparsed_name. */
+#ifdef HAVE_KRB5_XFREE
+#    define krb5_free_unparsed_name(c, p) krb5_xfree(p)
+#endif
+
+/*
+ * krb5_{get,free}_error_message are the preferred APIs for both current MIT
+ * and current Heimdal, but there are tons of older APIs we may have to fall
+ * back on for earlier versions.
+ *
+ * This function should be called immediately after the corresponding error
+ * without any intervening Kerberos calls.  Otherwise, the correct error
+ * message and supporting information may not be returned.
+ */
+#ifndef HAVE_KRB5_GET_ERROR_MESSAGE
+const char *krb5_get_error_message(krb5_context, krb5_error_code);
+#endif
+#ifndef HAVE_KRB5_FREE_ERROR_MESSAGE
+void krb5_free_error_message(krb5_context, const char *);
+#endif
+
+/*
+ * Both current MIT and current Heimdal prefer _opt_alloc and _opt_free, but
+ * older versions of both require allocating your own struct and calling
+ * _opt_init.
+ */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
+krb5_error_code krb5_get_init_creds_opt_alloc(krb5_context,
+                                              krb5_get_init_creds_opt **);
+#endif
+#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
+#    ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS
+#        define krb5_get_init_creds_opt_free(c, o) \
+            krb5_get_init_creds_opt_free(o)
+#    endif
+#else
+#    define krb5_get_init_creds_opt_free(c, o) free(o)
+#endif
+
+/* Not available in versions of Heimdal prior to 7.0.1. */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CHANGE_PASSWORD_PROMPT
+#    define krb5_get_init_creds_opt_set_change_password_prompt(o, f) /* */
+#endif
+
+/* Heimdal-specific. */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_DEFAULT_FLAGS
+#    define krb5_get_init_creds_opt_set_default_flags(c, p, r, o) /* empty */
+#endif
+
+/*
+ * Old versions of Heimdal (0.7 and earlier) take only nine arguments to the
+ * krb5_get_init_creds_opt_set_pkinit instead of the 11 arguments that current
+ * versions take.  Adjust if needed.  This function is Heimdal-specific.
+ */
+#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT
+#    ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_9_ARGS
+#        define krb5_get_init_creds_opt_set_pkinit(c, o, p, u, a, l, r, f, m, \
+                                                   d, s)                      \
+            krb5_get_init_creds_opt_set_pkinit((c), (o), (p), (u), (a), (f),  \
+                                               (m), (d), (s));
+#    endif
+#endif
+
+/*
+ * MIT-specific.  Heimdal automatically ignores environment variables if
+ * called in a setuid context.
+ */
+#ifndef HAVE_KRB5_INIT_SECURE_CONTEXT
+#    define krb5_init_secure_context(c) krb5_init_context(c)
+#endif
+
+/*
+ * Heimdal: krb5_kt_free_entry, MIT: krb5_free_keytab_entry_contents.  We
+ * check for the declaration rather than the function since the function is
+ * present in older MIT Kerberos libraries but not prototyped.
+ */
+#if !HAVE_DECL_KRB5_KT_FREE_ENTRY
+#    define krb5_kt_free_entry(c, e) krb5_free_keytab_entry_contents((c), (e))
+#endif
+
+/*
+ * Heimdal provides a nice function that just returns a const char *.  On MIT,
+ * there's an accessor macro that returns the krb5_data pointer, which
+ * requires more work to get at the underlying char *.
+ */
+#ifndef HAVE_KRB5_PRINCIPAL_GET_REALM
+const char *krb5_principal_get_realm(krb5_context, krb5_const_principal);
+#endif
+
+/*
+ * krb5_change_password is deprecated in favor of krb5_set_password in current
+ * Heimdal.  Current MIT provides both.
+ */
+#ifndef HAVE_KRB5_SET_PASSWORD
+#    define krb5_set_password(c, cr, pw, p, rc, rcs, rs) \
+        krb5_change_password((c), (cr), (pw), (rc), (rcs), (rs))
+#endif
+
+/*
+ * AIX's NAS Kerberos implementation mysteriously provides the struct and the
+ * krb5_verify_init_creds function but not this function.
+ */
+#ifndef HAVE_KRB5_VERIFY_INIT_CREDS_OPT_INIT
+void krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt);
+#endif
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+#endif /* !PORTABLE_KRB5_H */
diff --git a/portable/macros.h b/portable/macros.h
new file mode 100644
index 000000000000..5d77fb75af7b
--- /dev/null
+++ b/portable/macros.h
@@ -0,0 +1,72 @@
+/*
+ * Portability macros used in include files.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2015 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2008, 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PORTABLE_MACROS_H
+#define PORTABLE_MACROS_H 1
+
+/*
+ * __attribute__ is available in gcc 2.5 and later, but only with gcc 2.7
+ * could you use the __format__ form of the attributes, which is what we use
+ * (to avoid confusion with other macros).
+ */
+#ifndef __attribute__
+#    if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 7)
+#        define __attribute__(spec) /* empty */
+#    endif
+#endif
+
+/*
+ * We use __alloc_size__, but it was only available in fairly recent versions
+ * of GCC.  Suppress warnings about the unknown attribute if GCC is too old.
+ * We know that we're GCC at this point, so we can use the GCC variadic macro
+ * extension, which will still work with versions of GCC too old to have C99
+ * variadic macro support.
+ */
+#if !defined(__attribute__) && !defined(__alloc_size__)
+#    if (__GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 3)) \
+        && !defined(__clang__)
+#        define __alloc_size__(spec, args...) /* empty */
+#    endif
+#endif
+
+/*
+ * LLVM and Clang pretend to be GCC but don't support all of the __attribute__
+ * settings that GCC does.  For them, suppress warnings about unknown
+ * attributes on declarations.  This unfortunately will affect the entire
+ * compilation context, but there's no push and pop available.
+ */
+#if !defined(__attribute__) && (defined(__llvm__) || defined(__clang__))
+#    pragma GCC diagnostic ignored "-Wattributes"
+#endif
+
+/*
+ * BEGIN_DECLS is used at the beginning of declarations so that C++
+ * compilers don't mangle their names.  END_DECLS is used at the end.
+ */
+#undef BEGIN_DECLS
+#undef END_DECLS
+#ifdef __cplusplus
+#    define BEGIN_DECLS extern "C" {
+#    define END_DECLS   }
+#else
+#    define BEGIN_DECLS /* empty */
+#    define END_DECLS   /* empty */
+#endif
+
+#endif /* !PORTABLE_MACROS_H */
diff --git a/portable/mkstemp.c b/portable/mkstemp.c
new file mode 100644
index 000000000000..ebaefc1b5ee6
--- /dev/null
+++ b/portable/mkstemp.c
@@ -0,0 +1,101 @@
+/*
+ * Replacement for a missing mkstemp.
+ *
+ * Provides the same functionality as the library function mkstemp for those
+ * systems that don't have it.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2009, 2011, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#ifdef HAVE_SYS_TIME_H
+#    include <sys/time.h>
+#endif
+#include <time.h>
+
+/*
+ * If we're running the test suite, rename mkstemp to avoid conflicts with the
+ * system version.  #undef it first because some systems may define it to
+ * another name.
+ */
+#if TESTING
+#    undef mkstemp
+#    define mkstemp test_mkstemp
+int test_mkstemp(char *);
+#endif
+
+/* Pick the longest available integer type. */
+#if HAVE_LONG_LONG_INT
+typedef unsigned long long long_int_type;
+#else
+typedef unsigned long long_int_type;
+#endif
+
+int
+mkstemp(char *template)
+{
+    static const char letters[] =
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    size_t length;
+    char *XXXXXX;
+    struct timeval tv;
+    long_int_type randnum, working;
+    int i, tries, fd;
+
+    /*
+     * Make sure we have a valid template and initialize p to point at the
+     * beginning of the template portion of the string.
+     */
+    length = strlen(template);
+    if (length < 6) {
+        errno = EINVAL;
+        return -1;
+    }
+    XXXXXX = template + length - 6;
+    if (strcmp(XXXXXX, "XXXXXX") != 0) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    /* Get some more-or-less random information. */
+    gettimeofday(&tv, NULL);
+    randnum = ((long_int_type) tv.tv_usec << 16) ^ tv.tv_sec ^ getpid();
+
+    /*
+     * Now, try to find a working file name.  We try no more than TMP_MAX file
+     * names.
+     */
+    for (tries = 0; tries < TMP_MAX; tries++) {
+        for (working = randnum, i = 0; i < 6; i++) {
+            XXXXXX[i] = letters[working % 62];
+            working /= 62;
+        }
+        fd = open(template, O_RDWR | O_CREAT | O_EXCL, 0600);
+        if (fd >= 0 || (errno != EEXIST && errno != EISDIR))
+            return fd;
+
+        /*
+         * This is a relatively random increment.  Cut off the tail end of
+         * tv_usec since it's often predictable.
+         */
+        randnum += (tv.tv_usec >> 10) & 0xfff;
+    }
+    errno = EEXIST;
+    return -1;
+}
diff --git a/portable/pam.h b/portable/pam.h
new file mode 100644
index 000000000000..b193fbb688ab
--- /dev/null
+++ b/portable/pam.h
@@ -0,0 +1,129 @@
+/*
+ * Portability wrapper around PAM header files.
+ *
+ * This header file includes the various PAM headers, wherever they may be
+ * found on the system, and defines replacements for PAM functions that may
+ * not be available on the local system.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2015, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PORTABLE_PAM_H
+#define PORTABLE_PAM_H 1
+
+#include <config.h>
+#include <portable/macros.h>
+
+/* Linux PAM 1.1.0 requires sys/types.h before security/pam_modutil.h. */
+#include <sys/types.h>
+
+#ifndef HAVE_PAM_MODUTIL_GETPWNAM
+#    include <pwd.h>
+#endif
+#if defined(HAVE_SECURITY_PAM_APPL_H)
+#    include <security/pam_appl.h>
+#    include <security/pam_modules.h>
+#elif defined(HAVE_PAM_PAM_APPL_H)
+#    include <pam/pam_appl.h>
+#    include <pam/pam_modules.h>
+#endif
+#if defined(HAVE_SECURITY_PAM_EXT_H)
+#    include <security/pam_ext.h>
+#elif defined(HAVE_PAM_PAM_EXT_H)
+#    include <pam/pam_ext.h>
+#endif
+#if defined(HAVE_SECURITY_PAM_MODUTIL_H)
+#    include <security/pam_modutil.h>
+#elif defined(HAVE_PAM_PAM_MODUTIL_H)
+#    include <pam/pam_modutil.h>
+#endif
+#include <stdarg.h>
+
+/* Solaris doesn't have these. */
+#ifndef PAM_CONV_AGAIN
+#    define PAM_CONV_AGAIN 0
+#    define PAM_INCOMPLETE PAM_SERVICE_ERR
+#endif
+
+/* Solaris 8 has deficient PAM. */
+#ifndef PAM_AUTHTOK_RECOVER_ERR
+#    define PAM_AUTHTOK_RECOVER_ERR PAM_AUTHTOK_ERR
+#endif
+
+/*
+ * Mac OS X 10 doesn't define these.  They're meant to be logically or'd with
+ * an exit status in pam_set_data, so define them to 0 if not defined to
+ * deactivate them.
+ */
+#ifndef PAM_DATA_REPLACE
+#    define PAM_DATA_REPLACE 0
+#endif
+#ifndef PAM_DATA_SILENT
+#    define PAM_DATA_SILENT 0
+#endif
+
+/*
+ * Mac OS X 10 apparently doesn't use PAM_BAD_ITEM and returns PAM_SYMBOL_ERR
+ * instead.
+ */
+#ifndef PAM_BAD_ITEM
+#    define PAM_BAD_ITEM PAM_SYMBOL_ERR
+#endif
+
+/* We use this as a limit on password length, so make sure it's defined. */
+#ifndef PAM_MAX_RESP_SIZE
+#    define PAM_MAX_RESP_SIZE 512
+#endif
+
+/*
+ * Some PAM implementations support building the module static and exporting
+ * the call points via a struct instead.  (This is the default in OpenPAM, for
+ * example.)  To support this, the pam_sm_* functions are declared PAM_EXTERN.
+ * Ensure that's defined for implementations that don't have this.
+ */
+#ifndef PAM_EXTERN
+#    define PAM_EXTERN
+#endif
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all portability functions. */
+#pragma GCC visibility push(hidden)
+
+/*
+ * If pam_modutil_getpwnam is missing, ideally we should roll our own using
+ * getpwnam_r.  However, this is a fair bit of work, since we have to stash
+ * the allocated memory in the PAM data so that it will be freed properly.
+ * Bail for right now.
+ */
+#if !HAVE_PAM_MODUTIL_GETPWNAM
+#    define pam_modutil_getpwnam(h, u) getpwnam(u)
+#endif
+
+/* Prototype missing optional PAM functions. */
+#if !HAVE_PAM_SYSLOG
+void pam_syslog(const pam_handle_t *, int, const char *, ...);
+#endif
+#if !HAVE_PAM_VSYSLOG
+void pam_vsyslog(const pam_handle_t *, int, const char *, va_list);
+#endif
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+#endif /* !PORTABLE_PAM_H */
diff --git a/portable/pam_syslog.c b/portable/pam_syslog.c
new file mode 100644
index 000000000000..13d21c8428ac
--- /dev/null
+++ b/portable/pam_syslog.c
@@ -0,0 +1,36 @@
+/*
+ * Replacement for a missing pam_syslog.
+ *
+ * Implements pam_syslog in terms of pam_vsyslog (which itself may be a
+ * replacement) if the PAM implementation does not provide it.  This is a
+ * Linux PAM extension.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+
+#include <stdarg.h>
+
+void
+pam_syslog(const pam_handle_t *pamh, int priority, const char *fmt, ...)
+{
+    va_list args;
+
+    va_start(args, fmt);
+    pam_vsyslog(pamh, priority, fmt, args);
+    va_end(args);
+}
diff --git a/portable/pam_vsyslog.c b/portable/pam_vsyslog.c
new file mode 100644
index 000000000000..07e143b5dd7c
--- /dev/null
+++ b/portable/pam_vsyslog.c
@@ -0,0 +1,63 @@
+/*
+ * Replacement for a missing pam_vsyslog.
+ *
+ * Provides close to the same functionality as the Linux PAM function
+ * pam_vsyslog for other PAM implementations.  The logging prefix will not be
+ * quite as good, since we don't have access to the PAM group name.
+ *
+ * To use this replacement, the Autoconf script for the package must define
+ * MODULE_NAME to the name of the PAM module.  (PACKAGE isn't used since it
+ * may use dashes where the module uses underscores.)
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <syslog.h>
+
+#ifndef LOG_AUTHPRIV
+#    define LOG_AUTHPRIV LOG_AUTH
+#endif
+
+void
+pam_vsyslog(const pam_handle_t *pamh, int priority, const char *fmt,
+            va_list args)
+{
+    char *msg = NULL;
+    const char *service = NULL;
+    int retval;
+
+    retval = pam_get_item(pamh, PAM_SERVICE, (PAM_CONST void **) &service);
+    if (retval != PAM_SUCCESS)
+        service = NULL;
+    if (vasprintf(&msg, fmt, args) < 0) {
+        syslog(LOG_CRIT | LOG_AUTHPRIV,
+               "cannot allocate memory in vasprintf: %m");
+        return;
+    }
+    /* clang-format off */
+    syslog(priority | LOG_AUTHPRIV, MODULE_NAME "%s%s%s: %s",
+           (service == NULL) ? "" : "(",
+           (service == NULL) ? "" : service,
+           (service == NULL) ? "" : ")", msg);
+    /* clang-format on */
+    free(msg);
+}
diff --git a/portable/reallocarray.c b/portable/reallocarray.c
new file mode 100644
index 000000000000..635041ebe22b
--- /dev/null
+++ b/portable/reallocarray.c
@@ -0,0 +1,64 @@
+/*
+ * Replacement for a missing reallocarray.
+ *
+ * Provides the same functionality as the OpenBSD library function
+ * reallocarray for those systems that don't have it.  This function is the
+ * same as realloc, but takes the size arguments in the same form as calloc
+ * and checks for overflow so that the caller doesn't need to.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+/*
+ * If we're running the test suite, rename reallocarray to avoid conflicts
+ * with the system version.  #undef it first because some systems may define
+ * it to another name.
+ */
+#if TESTING
+#    undef reallocarray
+#    define reallocarray test_reallocarray
+void *test_reallocarray(void *, size_t, size_t);
+#endif
+
+/*
+ * nmemb * size cannot overflow if both are smaller than sqrt(SIZE_MAX).  We
+ * can calculate that value statically by using 2^(sizeof(size_t) * 8) as the
+ * value of SIZE_MAX and then taking the square root, which gives
+ * 2^(sizeof(size_t) * 4).  Compute the exponentiation with shift.
+ */
+#define CHECK_THRESHOLD (1UL << (sizeof(size_t) * 4))
+
+void *
+reallocarray(void *ptr, size_t nmemb, size_t size)
+{
+    if (nmemb >= CHECK_THRESHOLD || size >= CHECK_THRESHOLD)
+        if (nmemb > 0 && SIZE_MAX / nmemb <= size) {
+            errno = ENOMEM;
+            return NULL;
+        }
+
+    /* Avoid a zero-size allocation. */
+    if (nmemb == 0 || size == 0) {
+        nmemb = 1;
+        size = 1;
+    }
+    return realloc(ptr, nmemb * size);
+}
diff --git a/portable/stdbool.h b/portable/stdbool.h
new file mode 100644
index 000000000000..749052a61aa9
--- /dev/null
+++ b/portable/stdbool.h
@@ -0,0 +1,63 @@
+/*
+ * Portability wrapper around <stdbool.h>.
+ *
+ * Provides the bool and _Bool types and the true and false constants,
+ * following the C99 specification, on hosts that don't have stdbool.h.  This
+ * logic is based heavily on the example in the Autoconf manual.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2008, 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PORTABLE_STDBOOL_H
+#define PORTABLE_STDBOOL_H 1
+
+/*
+ * Allow inclusion of config.h to be skipped, since sometimes we have to use a
+ * stripped-down version of config.h with a different name.
+ */
+#ifndef CONFIG_H_INCLUDED
+#    include <config.h>
+#endif
+
+#if HAVE_STDBOOL_H
+#    include <stdbool.h>
+#else
+#    if HAVE__BOOL
+#        define bool _Bool
+#    else
+#        ifdef __cplusplus
+typedef bool _Bool;
+#        elif _WIN32
+#            include <windef.h>
+#            define bool BOOL
+#        else
+typedef unsigned char _Bool;
+#            define bool _Bool
+#        endif
+#    endif
+#    define false 0
+#    define true 1
+#    define __bool_true_false_are_defined 1
+#endif
+
+/*
+ * If we define bool and don't tell Perl, it will try to define its own and
+ * fail.  Only of interest for programs that also include Perl headers.
+ */
+#ifndef HAS_BOOL
+#    define HAS_BOOL 1
+#endif
+
+#endif /* !PORTABLE_STDBOOL_H */
diff --git a/portable/strndup.c b/portable/strndup.c
new file mode 100644
index 000000000000..9ddcbc130c33
--- /dev/null
+++ b/portable/strndup.c
@@ -0,0 +1,56 @@
+/*
+ * Replacement for a missing strndup.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+/*
+ * If we're running the test suite, rename the functions to avoid conflicts
+ * with the system versions.
+ */
+#if TESTING
+#    undef strndup
+#    define strndup test_strndup
+char *test_strndup(const char *, size_t);
+#endif
+
+char *
+strndup(const char *s, size_t n)
+{
+    const char *p;
+    size_t length;
+    char *copy;
+
+    if (s == NULL) {
+        errno = EINVAL;
+        return NULL;
+    }
+
+    /* Don't assume that the source string is nul-terminated. */
+    for (p = s; (size_t)(p - s) < n && *p != '\0'; p++)
+        ;
+    length = p - s;
+    copy = malloc(length + 1);
+    if (copy == NULL)
+        return NULL;
+    memcpy(copy, s, length);
+    copy[length] = '\0';
+    return copy;
+}
diff --git a/portable/system.h b/portable/system.h
new file mode 100644
index 000000000000..d5cb693d9eb4
--- /dev/null
+++ b/portable/system.h
@@ -0,0 +1,154 @@
+/*
+ * Standard system includes and portability adjustments.
+ *
+ * Declarations of routines and variables in the C library.  Including this
+ * file is the equivalent of including all of the following headers,
+ * portably:
+ *
+ *     #include <inttypes.h>
+ *     #include <limits.h>
+ *     #include <stdarg.h>
+ *     #include <stdbool.h>
+ *     #include <stddef.h>
+ *     #include <stdio.h>
+ *     #include <stdlib.h>
+ *     #include <stdint.h>
+ *     #include <string.h>
+ *     #include <strings.h>
+ *     #include <sys/types.h>
+ *     #include <unistd.h>
+ *
+ * Missing functions are provided via #define or prototyped if available from
+ * the portable helper library.  Also provides some standard #defines.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2014, 2016, 2018, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2011, 2013-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#ifndef PORTABLE_SYSTEM_H
+#define PORTABLE_SYSTEM_H 1
+
+/* Make sure we have our configuration information. */
+#include <config.h>
+
+/* BEGIN_DECL and __attribute__. */
+#include <portable/macros.h>
+
+/* A set of standard ANSI C headers.  We don't care about pre-ANSI systems. */
+#if HAVE_INTTYPES_H
+#    include <inttypes.h>
+#endif
+#include <limits.h>
+#include <stdarg.h>
+#include <stddef.h>
+#if HAVE_STDINT_H
+#    include <stdint.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#if HAVE_STRINGS_H
+#    include <strings.h>
+#endif
+#include <sys/types.h>
+#if HAVE_UNISTD_H
+#    include <unistd.h>
+#endif
+
+/* SCO OpenServer gets int32_t from here. */
+#if HAVE_SYS_BITYPES_H
+#    include <sys/bitypes.h>
+#endif
+
+/* Get the bool type. */
+#include <portable/stdbool.h>
+
+/* Windows provides snprintf under a different name. */
+#ifdef _WIN32
+#    define snprintf _snprintf
+#endif
+
+/* Windows does not define ssize_t. */
+#ifndef HAVE_SSIZE_T
+typedef ptrdiff_t ssize_t;
+#endif
+
+/*
+ * POSIX requires that these be defined in <unistd.h>.  If one of them has
+ * been defined, all the rest almost certainly have.
+ */
+#ifndef STDIN_FILENO
+#    define STDIN_FILENO  0
+#    define STDOUT_FILENO 1
+#    define STDERR_FILENO 2
+#endif
+
+/*
+ * C99 requires va_copy.  Older versions of GCC provide __va_copy.  Per the
+ * Autoconf manual, memcpy is a generally portable fallback.
+ */
+#ifndef va_copy
+#    ifdef __va_copy
+#        define va_copy(d, s) __va_copy((d), (s))
+#    else
+#        define va_copy(d, s) memcpy(&(d), &(s), sizeof(va_list))
+#    endif
+#endif
+
+/*
+ * If explicit_bzero is not available, fall back on memset.  This does NOT
+ * provide any of the security guarantees of explicit_bzero and will probably
+ * be optimized away by the compiler.  It just ensures that code will compile
+ * and function on systems without explicit_bzero.
+ */
+#if !HAVE_EXPLICIT_BZERO
+#    define explicit_bzero(s, n) memset((s), 0, (n))
+#endif
+
+BEGIN_DECLS
+
+/* Default to a hidden visibility for all portability functions. */
+#pragma GCC visibility push(hidden)
+
+/*
+ * Provide prototypes for functions not declared in system headers.  Use the
+ * HAVE_DECL macros for those functions that may be prototyped but implemented
+ * incorrectly or implemented without a prototype.
+ */
+#if !HAVE_ASPRINTF
+extern int asprintf(char **, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+extern int vasprintf(char **, const char *, va_list)
+    __attribute__((__format__(printf, 2, 0)));
+#endif
+#if !HAVE_ISSETUGID
+extern int issetugid(void);
+#endif
+#if !HAVE_MKSTEMP
+extern int mkstemp(char *);
+#endif
+#if !HAVE_DECL_REALLOCARRAY
+extern void *reallocarray(void *, size_t, size_t);
+#endif
+#if !HAVE_STRNDUP
+extern char *strndup(const char *, size_t);
+#endif
+
+/* Undo default visibility change. */
+#pragma GCC visibility pop
+
+END_DECLS
+
+#endif /* !PORTABLE_SYSTEM_H */
diff --git a/tests/README b/tests/README
new file mode 100644
index 000000000000..186d2d5699b1
--- /dev/null
+++ b/tests/README
@@ -0,0 +1,252 @@
+                            Writing TAP Tests
+
+Introduction
+
+    This is a guide for users of the C TAP Harness package or similar
+    TAP-based test harnesses explaining how to write tests.  If your
+    package uses C TAP Harness as the test suite driver, you may want to
+    copy this document to an appropriate file name in your test suite as
+    documentation for contributors.
+
+About TAP
+
+    TAP is the Test Anything Protocol, a protocol for communication
+    between test cases and a test harness.  This is the protocol used by
+    Perl for its internal test suite and for nearly all Perl modules,
+    since it's the format used by the build tools for Perl modules to run
+    tests and report their results.
+
+    A TAP-based test suite works with a somewhat different set of
+    assumptions than an xUnit test suite.  In TAP, each test case is a
+    separate program.  That program, when run, must produce output in the
+    following format:
+
+        1..4
+        ok 1 - the first test
+        ok 2
+        # a diagnostic, ignored by the harness
+        not ok 3 - a failing test
+        ok 4 # skip a skipped test
+
+    The output should all go to standard output.  The first line specifies
+    the number of tests to be run, and then each test produces output that
+    looks like either "ok <n>" or "not ok <n>" depending on whether the
+    test succeeded or failed.  Additional information about the test can
+    be provided after the "ok <n>" or "not ok <n>", but is optional.
+    Additional diagnostics and information can be provided in lines
+    beginning with a "#".
+
+    Processing directives are supported after the "ok <n>" or "not ok <n>"
+    and start with a "#".  The main one of interest is "# skip" which says
+    that the test was skipped rather than successful and optionally gives
+    the reason.  Also supported is "# todo", which normally annotates a
+    failing test and indicates that test is expected to fail, optionally
+    providing a reason for why.
+
+    There are three more special cases.  First, the initial line stating
+    the number of tests to run, called the plan, may appear at the end of
+    the output instead of the beginning.  This can be useful if the number
+    of tests to run is not known in advance.  Second, a plan in the form:
+
+        1..0 # skip entire test case skipped
+
+    can be given instead, which indicates that this entire test case has
+    been skipped (generally because it depends on facilities or optional
+    configuration which is not present).  Finally, if the test case
+    encounters a fatal error, it should print the text:
+
+        Bail out!
+
+    on standard output, optionally followed by an error message, and then
+    exit.  This tells the harness that the test aborted unexpectedly.
+
+    The exit status of a successful test case should always be 0.  The
+    harness will report the test as "dubious" if all the tests appeared to
+    succeed but it exited with a non-zero status.
+
+Writing TAP Tests
+
+  Environment
+
+    One of the special features of C TAP Harness is the environment that
+    it sets up for your test cases.  If your test program is called under
+    the runtests driver, the environment variables C_TAP_SOURCE and
+    C_TAP_BUILD will be set to the top of the test directory in the source
+    tree and the top of the build tree, respectively.  You can use those
+    environment variables to locate additional test data, programs and
+    libraries built as part of your software build, and other supporting
+    information needed by tests.
+
+    The C and shell TAP libraries support a test_file_path() function,
+    which looks for a file under the build tree and then under the source
+    tree, using the C_TAP_BUILD and C_TAP_SOURCE environment variables,
+    and return the full path to the file.  This can be used to locate
+    supporting data files.  They also support a test_tmpdir() function
+    that returns a directory that can be used for temporary files during
+    tests.
+
+  Perl
+
+    Since TAP is the native test framework for Perl, writing TAP tests in
+    Perl is very easy and extremely well-supported.  If you've never
+    written tests in Perl before, start by reading the documentation for
+    Test::Tutorial and Test::Simple, which walks you through the basics,
+    including the TAP output syntax.  Then, the best Perl module to use
+    for serious testing is Test::More, which provides a lot of additional
+    functions over Test::Simple including support for skipping tests,
+    bailing out, and not planning tests in advance.  See the documentation
+    of Test::More for all the details and lots of examples.
+
+    C TAP Harness can run Perl test scripts directly and interpret the
+    results correctly, and similarly the Perl Test::Harness module and
+    prove command can run TAP tests written in other languages using, for
+    example, the TAP library that comes with C TAP Harness.  You can, if
+    you wish, use the library that comes with C TAP Harness but use prove
+    instead of runtests for running the test suite.
+
+  C
+
+    C TAP Harness provides a basic TAP library that takes away most of the
+    pain of writing TAP test cases in C.  A C test case should start with
+    a call to plan(), passing in the number of tests to run.  Then, each
+    test should use is_int(), is_string(), is_double(), or is_hex() as
+    appropriate to compare expected and seen values, or ok() to do a
+    simpler boolean test.  The is_*() functions take expected and seen
+    values and then a printf-style format string explaining the test
+    (which may be NULL).  ok() takes a boolean and then the printf-style
+    string.
+
+    Here's a complete example test program that uses the C TAP library:
+
+        #include <stddef.h>
+        #include <tap/basic.h>
+
+        int
+        main(void)
+        {
+            plan(4);
+
+            ok(1, "the first test");
+            is_int(42, 42, NULL);
+            diag("a diagnostic, ignored by the harness");
+            ok(0, "a failing test");
+            skip("a skipped test");
+
+            return 0;
+        }
+
+    This test program produces the output shown above in the section on
+    TAP and demonstrates most of the functions.  The other functions of
+    interest are sysdiag() (like diag() but adds strerror() results),
+    bail() and sysbail() for fatal errors, skip_block() to skip a whole
+    block of tests, and skip_all() which is called instead of plan() to
+    skip an entire test case.
+
+    The C TAP library also provides plan_lazy(), which can be called
+    instead of plan().  If plan_lazy() is called, the library will keep
+    track of how many test results are reported and will print out the
+    plan at the end of execution of the program.  This should normally be
+    avoided since the test may appear to be successful even if it exits
+    prematurely, but it can make writing tests easier in some
+    circumstances.
+
+    Complete API documentation for the basic C TAP library that comes with
+    C TAP Harness is available at:
+
+        <https://www.eyrie.org/~eagle/software/c-tap-harness/>
+
+    It's common to need additional test functions and utility functions
+    for your C tests, particularly if you have to set up and tear down a
+    test environment for your test programs, and it's useful to have them
+    all in the libtap library so that you only have to link your test
+    programs with one library.  Rather than editing tap/basic.c and
+    tap/basic.h to add those additional functions, add additional *.c and
+    *.h files into the tap directory with the function implementations and
+    prototypes, and then add those additional objects to the library.
+    That way, you can update tap/basic.c and tap/basic.h from subsequent
+    releases of C TAP Harness without having to merge changes with your
+    own code.
+
+    Libraries of additional useful TAP test functions are available in
+    rra-c-util at:
+
+        <https://www.eyrie.org/~eagle/software/rra-c-util/>
+
+    Some of the code there is particularly useful when testing programs
+    that require Kerberos keys.
+
+    If you implement new test functions that compare an expected and seen
+    value, it's best to name them is_<something> and take the expected
+    value, the seen value, and then a printf-style format string and
+    possible arguments to match the calling convention of the functions
+    provided by C TAP Harness.
+
+  Shell
+
+    C TAP Harness provides a library of shell functions to make it easier
+    to write TAP tests in shell.  That library includes much of the same
+    functionality as the C TAP library, but takes its parameters in a
+    somewhat different order to make better use of shell features.
+
+    The libtap.sh file should be installed in a directory named tap in
+    your test suite area.  It can then be loaded by tests written in shell
+    using the environment set up by runtests with:
+
+        . "$C_TAP_SOURCE"/tap/libtap.sh
+
+    Here is a complete test case written in shell which produces the same
+    output as the TAP sample above:
+
+        #!/bin/sh
+
+        . "$C_TAP_SOURCE"/tap/libtap.sh
+        cd "$C_TAP_BUILD"
+
+        plan 4
+        ok 'the first test' true
+        ok '' [ 42 -eq 42 ]
+        diag a diagnostic, ignored by the harness
+        ok '' false
+        skip 'a skipped test'
+
+    The shell framework doesn't provide the is_* functions, so you'll use
+    the ok function more.  It takes a string describing the text and then
+    treats all of its remaining arguments as a condition, evaluated the
+    same way as the arguments to the "if" statement.  If that condition
+    evaluates to true, the test passes; otherwise, the test fails.
+
+    The plan, plan_lazy, diag, and bail functions work the same as with
+    the C library.  skip takes a string and skips the next test with that
+    explanation.  skip_block takes a count and a string and skips that
+    many tests with that explanation.  skip_all takes an optional reason
+    and skips the entire test case.
+
+    Since it's common for shell programs to want to test the output of
+    commands, there's an additional function ok_program provided by the
+    shell test library.  It takes the test description string, the
+    expected exit status, the expected program output, and then treats the
+    rest of its arguments as the program to run.  That program is run with
+    standard error and standard output combined, and then its exit status
+    and output are tested against the provided values.
+
+    A utility function, strip_colon_error, is provided that runs the
+    command given as its arguments and strips text following a colon and a
+    space from the output (unless there is no whitespace on the line
+    before the colon and the space, normally indicating a prefix of the
+    program name).  This function can be used to wrap commands that are
+    expected to fail with output that has a system- or locale-specific
+    error message appended, such as the output of strerror().
+
+License
+
+    This file is part of the documentation of C TAP Harness, which can be
+    found at <https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+
+    Copyright 2010, 2016 Russ Allbery <eagle@eyrie.org>
+
+    Copying and distribution of this file, with or without modification,
+    are permitted in any medium without royalty provided the copyright
+    notice and this notice are preserved.  This file is offered as-is,
+    without any warranty.
+
+    SPDX-License-Identifier: FSFAP
diff --git a/tests/TESTS b/tests/TESTS
new file mode 100644
index 000000000000..f9036b1569c4
--- /dev/null
+++ b/tests/TESTS
@@ -0,0 +1,46 @@
+# Test list for pam-krb5.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2011-2012
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice and
+# this notice are preserved.  This file is offered as-is, without any
+# warranty.
+#
+# SPDX-License-Identifier: FSFAP
+
+# Exclude the tests that use the pkinit.so MIT Kerberos module from valgrind
+# testing (module/fast-anon and module/pkinit) because they cause valgrind to
+# go into an infinite loop.
+
+docs/pod
+docs/pod-spelling
+docs/spdx-license
+module/alt-auth         valgrind
+module/bad-authtok      valgrind
+module/basic            valgrind
+module/cache            valgrind
+module/cache-cleanup    valgrind
+module/expired          valgrind
+module/fast             valgrind
+module/fast-anon
+module/long             valgrind
+module/no-cache         valgrind
+module/pam-user         valgrind
+module/password         valgrind
+module/pkinit
+module/realm            valgrind
+module/stacked          valgrind
+pam-util/args           valgrind
+pam-util/fakepam        valgrind
+pam-util/logging        valgrind
+pam-util/options        valgrind
+pam-util/vector         valgrind
+portable/asprintf       valgrind
+portable/mkstemp        valgrind
+portable/strndup        valgrind
+style/obsolete-strings
+valgrind/logs
diff --git a/tests/config/README b/tests/config/README
new file mode 100644
index 000000000000..a034b35b6b0d
--- /dev/null
+++ b/tests/config/README
@@ -0,0 +1,70 @@
+This directory contains configuration required to run the complete
+pam-krb5 test suite.  If there is no configuration in this directory, many
+of the tests will be skipped.  To enable the full test suite, create the
+following files:
+
+admin-keytab
+
+    A keytab for a principal (in the same realm as the test principal
+    configured in password) that has admin access to inspect and modify
+    that test principal.  For an MIT Kerberos KDC, it needs "mci"
+    permissions in kadm5.acl for that principal.  For a Heimdal KDC, it
+    needs "cpw,list,modify" permissions (obviously, "all" will do).  This
+    file is optional; if not present, the tests requiring admin
+    modification of a principal will be skipped.
+
+krb5.conf
+
+    This is optional and not required if the Kerberos realm used for
+    testing is configured in DNS or your system krb5.conf file and that
+    file is in either /etc/krb5.conf or /usr/local/etc/krb5.conf.
+    Otherwise, create a krb5.conf file that contains the realm information
+    (KDC, kpasswd server, and admin server) for the realm you're using for
+    testing.  You don't need to worry about setting the default realm;
+    this will be done automatically in the generated file used by the test
+    suite.
+
+keytab
+
+    An optional keytab for a principal, which generally should be in the
+    same realm as the user configured in the password file.  This is used
+    to test FAST support with a ticket cache.
+
+password
+
+    This file should contain two lines.  The first line is the
+    fully-qualified principal (including the realm) of a Kerberos
+    principal to use for testing authentication.  The second line is the
+    password for that principal.
+
+    If the realm of the principal is not configured in either DNS or in
+    your system krb5.conf file (/usr/local/etc/krb5.conf or
+    /etc/krb5.conf) with the KDC, kpasswd server, and admin server, you
+    will need to also provide a krb5.conf file in this directory.  See
+    below.
+
+pkinit-cert
+
+    Certificate and private key (concatenated together) for PKINIT
+    authentication for the user listed in the pkinit-principal file.
+    Optional; PKINIT checks will be skipped if this file isn't present.
+
+pkinit-principal
+
+    Principal to use to test PKINIT authentication.  Must be the Kerberos
+    identity corresponding to the certificate and private key given in
+    pkinit-cert.  Optional; PKINIT checks will be skipped if this file
+    isn't present.
+
+-----
+
+Copyright 2017, 2020 Russ Allbery <eagle@eyrie.org>
+Copyright 2011-2012
+    The Board of Trustees of the Leland Stanford Junior University
+
+Copying and distribution of this file, with or without modification, are
+permitted in any medium without royalty provided the copyright notice and
+this notice are preserved.  This file is offered as-is, without any
+warranty.
+
+SPDX-License-Identifier: FSFAP
diff --git a/tests/data/cppcheck.supp b/tests/data/cppcheck.supp
new file mode 100644
index 000000000000..00734778b256
--- /dev/null
+++ b/tests/data/cppcheck.supp
@@ -0,0 +1,72 @@
+// Suppressions file for cppcheck.  -*- conf -*-
+//
+// This includes suppressions for all of my projects, including files that
+// aren't in rra-c-util, for ease of sharing between projects.  The ones that
+// don't apply to a particular project should hopefully be harmless.
+//
+// To determine the correct suppression to add for a new error, run cppcheck
+// with the --xml flag and then add a suppression for the error id, file
+// location, and line.
+//
+// Copyright 2018-2021 Russ Allbery <eagle@eyrie.org>
+//
+// Copying and distribution of this file, with or without modification, are
+// permitted in any medium without royalty provided the copyright notice and
+// this notice are preserved.  This file is offered as-is, without any
+// warranty.
+//
+// SPDX-License-Identifier: FSFAP
+
+// I like declaring variables at the top of a function rather than cluttering
+// every if and loop body with declarations.
+variableScope
+
+// strlen of a constant string is more maintainable code than hard-coding the
+// string length.
+constArgument:tests/runtests.c:804
+
+// False positive due to recursive function.
+knownConditionTrueFalse:portable/getopt.c:146
+
+// Bug in cppcheck 2.3.  cppcheck can't see the assignment because of the
+// void * cast.
+knownConditionTrueFalse:portable/k_haspag.c:61
+
+// False positive since the string comes from a command-line define.
+knownConditionTrueFalse:tests/tap/process.c:415
+knownConditionTrueFalse:tests/tap/remctl.c:79
+
+// Stored in the returned ai struct, but cppcheck can't see the assignment
+// because of the struct sockaddr * cast.
+memleak:portable/getaddrinfo.c:236
+
+// Bug in cppcheck 1.89 (fixed in 2.3).  The address of this variable is
+// passed to a Windows function (albeit through a cast).
+nullPointer:portable/winsock.c:61
+
+// Bug in cppcheck 2.3.
+nullPointerRedundantCheck:portable/krb5-profile.c:61
+
+// Bug in cppcheck 2.3.
+nullPointerRedundantCheck:portable/krb5-renew.c:82
+nullPointerRedundantCheck:portable/krb5-renew.c:83
+
+// Setting the variable to NULL explicitly after deallocation.
+redundantAssignment:tests/pam-util/options-t.c
+
+// (remctl) Bug in cppcheck 1.89 (fixed in 2.3).  The address of these
+// variables are passed to a PHP function.
+uninitvar:php/php_remctl.c:119
+uninitvar:php/php_remctl.c:123
+uninitvar:php/php_remctl.c:315
+uninitvar:php/php5_remctl.c:125
+uninitvar:php/php5_remctl.c:129
+uninitvar:php/php5_remctl.c:321
+
+// (remctl) Bug in cppcheck 1.82.  A pointer to this array is stored in a
+// struct that's passed to another function.
+redundantAssignment:tests/server/acl-t.c
+
+// (pam-krb5) cppcheck doesn't recognize the unused attribute on labels.
+unusedLabel:module/auth.c:895
+unusedLabelConfiguration:module/auth.c:895
diff --git a/tests/data/generate-krb5-conf b/tests/data/generate-krb5-conf
new file mode 100755
index 000000000000..712a933d40ba
--- /dev/null
+++ b/tests/data/generate-krb5-conf
@@ -0,0 +1,86 @@
+#!/bin/sh
+
+# Generate a krb5.conf file in the current directory for testing purposes.
+# Takes one command-line argument: the default realm to use.  Strips out the
+# entire [appdefaults] section to avoid picking up any local configuration and
+# sets the default realm as indicated.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2016, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2006-2008, 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+# IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+set -e
+
+# Load the test library.
+. "$C_TAP_SOURCE/tap/libtap.sh"
+cd "$C_TAP_BUILD"
+
+# If there is no default realm specified on the command line, we leave the
+# realm information alone.
+realm="$1"
+
+# Locate the krb5.conf file to use as a base.  Prefer the one in the test
+# configuration area, if it exists.
+krb5conf=`test_file_path config/krb5.conf`
+if [ -z "$krb5conf" ] ; then
+    for p in /etc/krb5.conf /usr/local/etc/krb5.conf ; do
+        if [ -r "$p" ] ; then
+            krb5conf="$p"
+            break
+        fi
+    done
+fi
+if [ -z "$krb5conf" ] ; then
+    echo 'no krb5.conf found, see test instructions' >&2
+    exit 1
+fi
+
+# We found a krb5.conf file.  Generate our munged one.
+mkdir -p tmp
+awk '
+    BEGIN                             { skip = 0 }
+    /^ *\[appdefaults\]/              { skip = 1 }
+    !/^ *\[appdefaults\]/ && / *\[/   { skip = 0 }
+
+    { if (skip == 0) print }
+' "$krb5conf" > tmp/krb5.conf.tmp
+if [ -n "$realm" ] ; then
+    pattern='^[ 	]*default_realm.*='
+    if grep "$pattern" tmp/krb5.conf.tmp >/dev/null 2>/dev/null; then
+        sed -e "s/\\(default_realm.*=\\) .*/\\1 $realm/" \
+            tmp/krb5.conf.tmp >tmp/krb5.conf
+    else
+        (
+            cat tmp/krb5.conf.tmp
+            echo "[libdefaults]"
+            echo "    default_realm = $realm"
+        ) >tmp/krb5.conf
+    fi
+    rm tmp/krb5.conf.tmp
+else
+    mv tmp/krb5.conf.tmp tmp/krb5.conf
+fi
diff --git a/tests/data/krb5-pam.conf b/tests/data/krb5-pam.conf
new file mode 100644
index 000000000000..57887882c954
--- /dev/null
+++ b/tests/data/krb5-pam.conf
@@ -0,0 +1,30 @@
+# Test krb5.conf file for PAM option parsing.
+
+[appdefaults]
+    FOO.COM = {
+        program = /bin/false
+    }
+    BAR.COM = {
+        program = echo /bin/true
+    }
+    testing = {
+        minimum_uid = 1000
+        ignore_root = false
+        expires = 30m
+        FOO.COM = {
+            cells = foo.com,bar.com
+        }
+        BAR.COM = {
+            cells = bar.com foo.com
+        }
+    }
+    other-test = {
+        minimum_uid = -1000
+    }
+    bad-number = {
+        minimum_uid = 1000foo
+    }
+    bad-time = {
+        expires = ft87
+    }
+    debug = true
diff --git a/tests/data/krb5.conf b/tests/data/krb5.conf
new file mode 100644
index 000000000000..57887882c954
--- /dev/null
+++ b/tests/data/krb5.conf
@@ -0,0 +1,30 @@
+# Test krb5.conf file for PAM option parsing.
+
+[appdefaults]
+    FOO.COM = {
+        program = /bin/false
+    }
+    BAR.COM = {
+        program = echo /bin/true
+    }
+    testing = {
+        minimum_uid = 1000
+        ignore_root = false
+        expires = 30m
+        FOO.COM = {
+            cells = foo.com,bar.com
+        }
+        BAR.COM = {
+            cells = bar.com foo.com
+        }
+    }
+    other-test = {
+        minimum_uid = -1000
+    }
+    bad-number = {
+        minimum_uid = 1000foo
+    }
+    bad-time = {
+        expires = ft87
+    }
+    debug = true
diff --git a/tests/data/perl.conf b/tests/data/perl.conf
new file mode 100644
index 000000000000..699ef3a9123a
--- /dev/null
+++ b/tests/data/perl.conf
@@ -0,0 +1,19 @@
+# Configuration for Perl tests.  -*- perl -*-
+
+# Ignore these top-level directories for perlcritic testing.
+@CRITIC_IGNORE = qw();
+
+# Add this directory (or a .libs subdirectory) relative to the top of the
+# source tree to LD_LIBRARY_PATH when checking the syntax of Perl modules.
+# This may be required to pick up libraries that are used by in-tree Perl
+# modules.
+#$LIBRARY_PATH = 'lib';
+
+# Default minimum version requirement for included Perl scripts.
+$MINIMUM_VERSION = '5.006';
+
+# Minimum version exceptions for specific top-level directories.
+%MINIMUM_VERSION = ();
+
+# File must end with this line.
+1;
diff --git a/tests/data/scripts/alt-auth/basic b/tests/data/scripts/alt-auth/basic
new file mode 100644
index 000000000000..92628e98cd8f
--- /dev/null
+++ b/tests/data/scripts/alt-auth/basic
@@ -0,0 +1,19 @@
+# Test simplest case of alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%1 force_first_pass no_ccache
+    account = alt_auth_map=%1 no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %1
diff --git a/tests/data/scripts/alt-auth/basic-debug b/tests/data/scripts/alt-auth/basic-debug
new file mode 100644
index 000000000000..325a8117284c
--- /dev/null
+++ b/tests/data/scripts/alt-auth/basic-debug
@@ -0,0 +1,25 @@
+# Test simplest case of alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%1 force_first_pass no_ccache debug
+    account = alt_auth_map=%1 no_ccache debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) mapping bogus-nonexistent-account to %1
+    DEBUG (user %u) alternate authentication successful
+    INFO user %u authenticated as %1
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG pam_sm_acct_mgmt: exit (success)
diff --git a/tests/data/scripts/alt-auth/fail b/tests/data/scripts/alt-auth/fail
new file mode 100644
index 000000000000..ec2145f3098f
--- /dev/null
+++ b/tests/data/scripts/alt-auth/fail
@@ -0,0 +1,19 @@
+# Test failure of alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=bogus force_first_pass no_ccache
+    account = alt_auth_map=bogus no_ccache
+
+[run]
+    authenticate  = PAM_AUTHINFO_UNAVAIL
+    acct_mgmt     = PAM_IGNORE
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/alt-auth/fail-debug b/tests/data/scripts/alt-auth/fail-debug
new file mode 100644
index 000000000000..ae96bb148e6a
--- /dev/null
+++ b/tests/data/scripts/alt-auth/fail-debug
@@ -0,0 +1,28 @@
+# Test failure of alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=bogus force_first_pass no_ccache debug
+    account = alt_auth_map=bogus no_ccache debug
+
+[run]
+    authenticate  = PAM_AUTHINFO_UNAVAIL
+    acct_mgmt     = PAM_IGNORE
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) mapping bogus-nonexistent-account to bogus@%2
+    DEBUG /^\(user %u\) alternate authentication failed: /
+    DEBUG (user %u) attempting authentication as %u@%2
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
diff --git a/tests/data/scripts/alt-auth/fallback b/tests/data/scripts/alt-auth/fallback
new file mode 100644
index 000000000000..a0ee7a3d4292
--- /dev/null
+++ b/tests/data/scripts/alt-auth/fallback
@@ -0,0 +1,25 @@
+# Test alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%%s/unknown-user no_ccache
+    account = alt_auth_map=%%s/unknown-user no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/alt-auth/fallback-debug b/tests/data/scripts/alt-auth/fallback-debug
new file mode 100644
index 000000000000..f63741a60a16
--- /dev/null
+++ b/tests/data/scripts/alt-auth/fallback-debug
@@ -0,0 +1,38 @@
+# Test alternative authentication principal with debug logging.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%%s/unknown-user no_ccache debug
+    account = alt_auth_map=%%s/unknown-user no_ccache debug
+    session = no_ccache debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) mapping %u to %0/unknown-user@%2
+    DEBUG /^\(user %u\) alternate authentication failed: /
+    DEBUG (user %u) attempting authentication as %u
+    DEBUG (user %u) mapped user %0/unknown-user@%2 does not match principal %u
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) mapped user %0/unknown-user@%2 does not match principal %u
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/alt-auth/fallback-realm b/tests/data/scripts/alt-auth/fallback-realm
new file mode 100644
index 000000000000..0eef10fd5056
--- /dev/null
+++ b/tests/data/scripts/alt-auth/fallback-realm
@@ -0,0 +1,25 @@
+# Test alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%%s@BOGUS.EXAMPLE.COM no_ccache
+    account = alt_auth_map=%%s@BOGUS.EXAMPLE.COM no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/alt-auth/force b/tests/data/scripts/alt-auth/force
new file mode 100644
index 000000000000..4ad34f6f1fe4
--- /dev/null
+++ b/tests/data/scripts/alt-auth/force
@@ -0,0 +1,19 @@
+# Test forced alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%1 force_alt_auth force_first_pass no_ccache
+    account = alt_auth_map=%1 no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %1
diff --git a/tests/data/scripts/alt-auth/force-fail-debug b/tests/data/scripts/alt-auth/force-fail-debug
new file mode 100644
index 000000000000..cc077b1a4743
--- /dev/null
+++ b/tests/data/scripts/alt-auth/force-fail-debug
@@ -0,0 +1,26 @@
+# Test failure of forced authentication principal (no fallback).  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%1 force_alt_auth force_first_pass no_ccache debug
+    account = alt_auth_map=%1 no_ccache debug
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) mapping bogus-nonexistent-account to %1
+    DEBUG /^\(user %u\) alternate authentication failed: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
diff --git a/tests/data/scripts/alt-auth/force-fallback b/tests/data/scripts/alt-auth/force-fallback
new file mode 100644
index 000000000000..b93b04175ed5
--- /dev/null
+++ b/tests/data/scripts/alt-auth/force-fallback
@@ -0,0 +1,25 @@
+# Test forced alternative authentication with fallback.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%%s/unknown-user force_alt_auth no_ccache
+    account = alt_auth_map=%%s/unknown-user no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/alt-auth/only b/tests/data/scripts/alt-auth/only
new file mode 100644
index 000000000000..7761fc7fd0ce
--- /dev/null
+++ b/tests/data/scripts/alt-auth/only
@@ -0,0 +1,19 @@
+# Test required alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%1 only_alt_auth force_first_pass no_ccache
+    account = alt_auth_map=%1 no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %1
diff --git a/tests/data/scripts/alt-auth/only-fail b/tests/data/scripts/alt-auth/only-fail
new file mode 100644
index 000000000000..5c2831614928
--- /dev/null
+++ b/tests/data/scripts/alt-auth/only-fail
@@ -0,0 +1,22 @@
+# Test failure of required alternative authentication.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=bogus only_alt_auth no_ccache
+    account = alt_auth_map=bogus no_ccache
+
+[run]
+    authenticate  = PAM_USER_UNKNOWN
+    acct_mgmt     = PAM_IGNORE
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/alt-auth/username-map b/tests/data/scripts/alt-auth/username-map
new file mode 100644
index 000000000000..7f28a670344b
--- /dev/null
+++ b/tests/data/scripts/alt-auth/username-map
@@ -0,0 +1,19 @@
+# Test username mapping of alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%%s@%2 force_first_pass no_ccache
+    account = alt_auth_map=%%s@%2 no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %1
diff --git a/tests/data/scripts/alt-auth/username-map-prefix b/tests/data/scripts/alt-auth/username-map-prefix
new file mode 100644
index 000000000000..5e83fc888d77
--- /dev/null
+++ b/tests/data/scripts/alt-auth/username-map-prefix
@@ -0,0 +1,19 @@
+# Test username mapping of alternative authentication principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = alt_auth_map=%3%%s@%2 force_first_pass no_ccache
+    account = alt_auth_map=%3%%s@%2 no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %1
diff --git a/tests/data/scripts/bad-authtok/no-prompt b/tests/data/scripts/bad-authtok/no-prompt
new file mode 100644
index 000000000000..e0c10cc69804
--- /dev/null
+++ b/tests/data/scripts/bad-authtok/no-prompt
@@ -0,0 +1,25 @@
+# Defer prompting to the Kerberos library after bad authtok.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache no_prompt try_first_pass
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = /^(%u's Password|Password for %u): $/|%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/bad-authtok/try-first b/tests/data/scripts/bad-authtok/try-first
new file mode 100644
index 000000000000..cde6153efaeb
--- /dev/null
+++ b/tests/data/scripts/bad-authtok/try-first
@@ -0,0 +1,25 @@
+# Test try_first_pass with a bad initial AUTHTOK.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = try_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/bad-authtok/try-first-debug b/tests/data/scripts/bad-authtok/try-first-debug
new file mode 100644
index 000000000000..c76ce7ac89dd
--- /dev/null
+++ b/tests/data/scripts/bad-authtok/try-first-debug
@@ -0,0 +1,36 @@
+# Test try_first_pass with a bad initial AUTHTOK and debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = try_first_pass no_ccache debug
+    account = no_ccache debug
+    session = no_ccache debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %u
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    DEBUG (user %u) attempting authentication as %u
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/bad-authtok/use-first b/tests/data/scripts/bad-authtok/use-first
new file mode 100644
index 000000000000..62d55ca2146f
--- /dev/null
+++ b/tests/data/scripts/bad-authtok/use-first
@@ -0,0 +1,22 @@
+# Test use_first_pass with a bad initial AUTHTOK.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = use_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/bad-authtok/use-first-debug b/tests/data/scripts/bad-authtok/use-first-debug
new file mode 100644
index 000000000000..4346d2395cb0
--- /dev/null
+++ b/tests/data/scripts/bad-authtok/use-first-debug
@@ -0,0 +1,33 @@
+# Test use_first_pass with a bad initial AUTHTOK and debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = use_first_pass no_ccache debug
+    account = no_ccache debug
+    session = no_ccache debug
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %u
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/basic/force-first b/tests/data/scripts/basic/force-first
new file mode 100644
index 000000000000..792d737ba7c3
--- /dev/null
+++ b/tests/data/scripts/basic/force-first
@@ -0,0 +1,22 @@
+# Test force_first_pass without an authtok.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/basic/force-first-debug b/tests/data/scripts/basic/force-first-debug
new file mode 100644
index 000000000000..539345316183
--- /dev/null
+++ b/tests/data/scripts/basic/force-first-debug
@@ -0,0 +1,32 @@
+# Test force_first_pass without an authtok.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass no_ccache debug
+    account = no_ccache debug
+    session = no_ccache debug
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) no stored password
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/basic/ignore-root b/tests/data/scripts/basic/ignore-root
new file mode 100644
index 000000000000..bfbfee5c86df
--- /dev/null
+++ b/tests/data/scripts/basic/ignore-root
@@ -0,0 +1,16 @@
+# Test account and session behavior for ignored root user.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_root
+    password = ignore_root
+
+[run]
+    authenticate            = PAM_USER_UNKNOWN
+    chauthtok(PRELIM_CHECK) = PAM_IGNORE
diff --git a/tests/data/scripts/basic/ignore-root-debug b/tests/data/scripts/basic/ignore-root-debug
new file mode 100644
index 000000000000..2ffd33c16229
--- /dev/null
+++ b/tests/data/scripts/basic/ignore-root-debug
@@ -0,0 +1,24 @@
+# Test account and session behavior for ignored root user.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_root debug
+    password = ignore_root debug
+
+[run]
+    authenticate            = PAM_USER_UNKNOWN
+    chauthtok(PRELIM_CHECK) = PAM_IGNORE
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user root) ignoring root user
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_chauthtok: entry (prelim)
+    DEBUG ignoring root user
+    DEBUG pam_sm_chauthtok: exit (ignore)
diff --git a/tests/data/scripts/basic/minimum-uid b/tests/data/scripts/basic/minimum-uid
new file mode 100644
index 000000000000..e56161041306
--- /dev/null
+++ b/tests/data/scripts/basic/minimum-uid
@@ -0,0 +1,13 @@
+# Test account and session behavior for minimum UID.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = minimum_uid=%1
+    password = minimum_uid=%1
+
+[run]
+    authenticate            = PAM_USER_UNKNOWN
+    chauthtok(PRELIM_CHECK) = PAM_IGNORE
diff --git a/tests/data/scripts/basic/minimum-uid-debug b/tests/data/scripts/basic/minimum-uid-debug
new file mode 100644
index 000000000000..c20e43d55ac8
--- /dev/null
+++ b/tests/data/scripts/basic/minimum-uid-debug
@@ -0,0 +1,21 @@
+# Test account and session behavior for minimum UID (debug).  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = minimum_uid=%1 debug
+    password = minimum_uid=%1 debug
+
+[run]
+    authenticate            = PAM_USER_UNKNOWN
+    chauthtok(PRELIM_CHECK) = PAM_IGNORE
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) ignoring low-UID user (%0 < %1)
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_chauthtok: entry (prelim)
+    DEBUG ignoring low-UID user (%0 < %1)
+    DEBUG pam_sm_chauthtok: exit (ignore)
diff --git a/tests/data/scripts/basic/no-context b/tests/data/scripts/basic/no-context
new file mode 100644
index 000000000000..5629422e23d9
--- /dev/null
+++ b/tests/data/scripts/basic/no-context
@@ -0,0 +1,17 @@
+# Test account and session behavior with no context.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[run]
+    acct_mgmt                  = PAM_IGNORE
+    setcred(DELETE_CRED)       = PAM_SUCCESS
+    setcred(ESTABLISH_CRED)    = PAM_SUCCESS
+    setcred(REFRESH_CRED)      = PAM_SUCCESS
+    setcred(REINITIALIZE_CRED) = PAM_SUCCESS
+    open_session               = PAM_IGNORE
+    close_session              = PAM_SUCCESS
diff --git a/tests/data/scripts/basic/no-context-debug b/tests/data/scripts/basic/no-context-debug
new file mode 100644
index 000000000000..4bdeee727ed7
--- /dev/null
+++ b/tests/data/scripts/basic/no-context-debug
@@ -0,0 +1,47 @@
+# Test account and session behavior with no context.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = debug
+    account = debug
+    session = debug
+
+[run]
+    acct_mgmt                  = PAM_IGNORE
+    setcred(DELETE_CRED)       = PAM_SUCCESS
+    setcred(ESTABLISH_CRED)    = PAM_SUCCESS
+    setcred(REFRESH_CRED)      = PAM_SUCCESS
+    setcred(REINITIALIZE_CRED) = PAM_SUCCESS
+    open_session               = PAM_IGNORE
+    close_session              = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
+    DEBUG pam_sm_setcred: entry (delete)
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG pam_sm_setcred: entry (establish)
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG pam_sm_setcred: entry (refresh)
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG pam_sm_setcred: entry (reinit)
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_open_session: exit (ignore)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/cache-cleanup/auth-only b/tests/data/scripts/cache-cleanup/auth-only
new file mode 100644
index 000000000000..c29608f3c8da
--- /dev/null
+++ b/tests/data/scripts/cache-cleanup/auth-only
@@ -0,0 +1,17 @@
+# Test authentication only with ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass ignore_k5login ccache_dir=FILE:%1
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/cache/basic b/tests/data/scripts/cache/basic
new file mode 100644
index 000000000000..6b1042f3084b
--- /dev/null
+++ b/tests/data/scripts/cache/basic
@@ -0,0 +1,21 @@
+# Test basic authentication with ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass ignore_k5login
+    account = ignore_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/cache/end-data-silent b/tests/data/scripts/cache/end-data-silent
new file mode 100644
index 000000000000..f172008bc574
--- /dev/null
+++ b/tests/data/scripts/cache/end-data-silent
@@ -0,0 +1,27 @@
+# Test pam_end with PAM_DATA_SILENT.  -*- conf -*-
+#
+# Passing PAM_DATA_SILENT to pam_end should cause the credential cache to not
+# be deleted (under the assumption that pam_end is being called in a forked
+# process and will be called again in the parent to clean up resources).
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020-2021 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass ignore_k5login
+    account = ignore_k5login
+
+[run]
+    authenticate = PAM_SUCCESS
+    acct_mgmt    = PAM_SUCCESS
+    open_session = PAM_SUCCESS
+
+[end]
+    flags = PAM_DATA_SILENT
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/cache/open-session b/tests/data/scripts/cache/open-session
new file mode 100644
index 000000000000..83e48c36511e
--- /dev/null
+++ b/tests/data/scripts/cache/open-session
@@ -0,0 +1,20 @@
+# Test authentication with ticket cache, open session.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass ignore_k5login
+    account = ignore_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/cache/search-k5login b/tests/data/scripts/cache/search-k5login
new file mode 100644
index 000000000000..b87c28147edb
--- /dev/null
+++ b/tests/data/scripts/cache/search-k5login
@@ -0,0 +1,20 @@
+# Test authentication with search_k5login, open session.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass search_k5login
+    account = search_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/cache/search-k5login-debug b/tests/data/scripts/cache/search-k5login-debug
new file mode 100644
index 000000000000..eb50b9e47eaf
--- /dev/null
+++ b/tests/data/scripts/cache/search-k5login-debug
@@ -0,0 +1,34 @@
+# Test authentication with search_k5login and debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass search_k5login debug
+    account = search_k5login debug
+    session = debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG /^\(user %u\) temporarily storing credentials in /tmp/krb5cc_pam_/
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) retrieving principal from cache
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG /^\(user %u\) initializing ticket cache FILE:/tmp/krb5cc_/
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/expired/basic-heimdal b/tests/data/scripts/expired/basic-heimdal
new file mode 100644
index 000000000000..2b4f471cf247
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal
@@ -0,0 +1,31 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login
+    account  = ignore_k5login
+    password = ignore_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Password has expired
+    info     = Your password will expire at %1
+    info     = Changing password
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+    info     = Success: Password changed
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/basic-heimdal-debug b/tests/data/scripts/expired/basic-heimdal-debug
new file mode 100644
index 000000000000..a18cc00c71a9
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-debug
@@ -0,0 +1,44 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2017, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login debug
+    account  = ignore_k5login debug
+    password = ignore_k5login debug
+    session  = debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Password has expired
+    info     = Your password will expire at %1
+    info     = Changing password
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+    info     = Success: Password changed
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG /^\(user %u\) temporarily storing credentials in /tmp/krb5cc_pam_/
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) retrieving principal from cache
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG /^\(user %u\) initializing ticket cache FILE:/tmp/krb5cc_/
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/expired/basic-heimdal-flag-silent b/tests/data/scripts/expired/basic-heimdal-flag-silent
new file mode 100644
index 000000000000..58e065b485bb
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-flag-silent
@@ -0,0 +1,27 @@
+# Test default handling of expired passwords with PAM_SILENT.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login
+    account  = ignore_k5login
+    password = ignore_k5login
+
+[run]
+    authenticate(SILENT)  = PAM_SUCCESS
+    acct_mgmt(SILENT)     = PAM_SUCCESS
+    open_session(SILENT)  = PAM_SUCCESS
+    close_session(SILENT) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/basic-heimdal-old b/tests/data/scripts/expired/basic-heimdal-old
new file mode 100644
index 000000000000..dd67ec44df7c
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-old
@@ -0,0 +1,30 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login
+    account  = ignore_k5login
+    password = ignore_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Your password will expire at %1
+    info     = Changing password
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+    info     = Success: Password changed
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/basic-heimdal-old-debug b/tests/data/scripts/expired/basic-heimdal-old-debug
new file mode 100644
index 000000000000..53267f5fac62
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-old-debug
@@ -0,0 +1,43 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login debug
+    account  = ignore_k5login debug
+    password = ignore_k5login debug
+    session  = debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Your password will expire at %1
+    info     = Changing password
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+    info     = Success: Password changed
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG /^\(user %u\) temporarily storing credentials in /tmp/krb5cc_pam_/
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) retrieving principal from cache
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG /^\(user %u\) initializing ticket cache FILE:/tmp/krb5cc_/
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/expired/basic-heimdal-silent b/tests/data/scripts/expired/basic-heimdal-silent
new file mode 100644
index 000000000000..028d5fe382f6
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-silent
@@ -0,0 +1,27 @@
+# Test default handling of expired passwords with silent.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login silent
+    account  = ignore_k5login silent
+    password = ignore_k5login silent
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/basic-mit b/tests/data/scripts/expired/basic-mit
new file mode 100644
index 000000000000..9611381b4ce9
--- /dev/null
+++ b/tests/data/scripts/expired/basic-mit
@@ -0,0 +1,28 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login
+    account  = ignore_k5login
+    password = ignore_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Password expired.  You must change it now.
+    echo_off = Enter new password: |%n
+    echo_off = Enter it again: |%n
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/basic-mit-debug b/tests/data/scripts/expired/basic-mit-debug
new file mode 100644
index 000000000000..5b58b25b8ec2
--- /dev/null
+++ b/tests/data/scripts/expired/basic-mit-debug
@@ -0,0 +1,41 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login debug
+    account  = ignore_k5login debug
+    password = ignore_k5login debug
+    session  = debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Password expired.  You must change it now.
+    echo_off = Enter new password: |%n
+    echo_off = Enter it again: |%n
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG /^\(user %u\) temporarily storing credentials in /tmp/krb5cc_pam_/
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) retrieving principal from cache
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG /^\(user %u\) initializing ticket cache FILE:/tmp/krb5cc_/
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/expired/basic-mit-flag-silent b/tests/data/scripts/expired/basic-mit-flag-silent
new file mode 100644
index 000000000000..a13bffdeea44
--- /dev/null
+++ b/tests/data/scripts/expired/basic-mit-flag-silent
@@ -0,0 +1,27 @@
+# Test default handling of expired passwords with PAM_SILENT.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login
+    account  = ignore_k5login
+    password = ignore_k5login
+
+[run]
+    authenticate(SILENT)  = PAM_SUCCESS
+    acct_mgmt(SILENT)     = PAM_SUCCESS
+    open_session(SILENT)  = PAM_SUCCESS
+    close_session(SILENT) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    echo_off = Enter new password: |%n
+    echo_off = Enter it again: |%n
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/basic-mit-silent b/tests/data/scripts/expired/basic-mit-silent
new file mode 100644
index 000000000000..7dea2b7bdd4e
--- /dev/null
+++ b/tests/data/scripts/expired/basic-mit-silent
@@ -0,0 +1,27 @@
+# Test default handling of expired passwords with silent.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = ignore_k5login silent
+    account  = ignore_k5login silent
+    password = ignore_k5login silent
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    echo_off = Enter new password: |%n
+    echo_off = Enter it again: |%n
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/defer-mit b/tests/data/scripts/expired/defer-mit
new file mode 100644
index 000000000000..7403edbfdbbf
--- /dev/null
+++ b/tests/data/scripts/expired/defer-mit
@@ -0,0 +1,33 @@
+# Test deferring handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = defer_pwchange use_first_pass
+    account  = ignore_k5login
+    password = ignore_k5login use_first_pass
+
+[run]
+    authenticate              = PAM_SUCCESS
+    acct_mgmt                 = PAM_NEW_AUTHTOK_REQD
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+    acct_mgmt                 = PAM_SUCCESS
+    open_session              = PAM_SUCCESS
+    close_session             = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+    echo_off = Retype new Kerberos password: |%n
+
+[output]
+    INFO user %u authenticated as %0 (expired)
+    INFO user %u account password is expired
+    INFO user %u changed Kerberos password
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/expired/defer-mit-debug b/tests/data/scripts/expired/defer-mit-debug
new file mode 100644
index 000000000000..c637f39402f7
--- /dev/null
+++ b/tests/data/scripts/expired/defer-mit-debug
@@ -0,0 +1,57 @@
+# Test deferring handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth     = defer_pwchange use_first_pass debug
+    account  = ignore_k5login debug
+    password = ignore_k5login use_first_pass debug
+    session  = debug
+
+[run]
+    authenticate              = PAM_SUCCESS
+    acct_mgmt                 = PAM_NEW_AUTHTOK_REQD
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+    acct_mgmt                 = PAM_SUCCESS
+    open_session              = PAM_SUCCESS
+    close_session             = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+    echo_off = Retype new Kerberos password: |%n
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    DEBUG (user %u) krb5_get_init_creds_password: Password has expired
+    DEBUG (user %u) expired account, deferring failure
+    INFO user %u authenticated as %0 (expired)
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    INFO user %u account password is expired
+    DEBUG pam_sm_acct_mgmt: exit (failure)
+    DEBUG pam_sm_chauthtok: entry (prelim)
+    DEBUG (user %u) attempting authentication as %0 for kadmin/changepw
+    DEBUG pam_sm_chauthtok: exit (success)
+    DEBUG pam_sm_chauthtok: entry (update)
+    INFO user %u changed Kerberos password
+    DEBUG (user %u) obtaining credentials with new password
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG /^\(user %u\) temporarily storing credentials in /tmp/krb5cc_pam_/
+    DEBUG pam_sm_chauthtok: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) retrieving principal from cache
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG /^\(user %u\) initializing ticket cache FILE:/tmp/krb5cc_/
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/expired/fail b/tests/data/scripts/expired/fail
new file mode 100644
index 000000000000..566b4b9c73dc
--- /dev/null
+++ b/tests/data/scripts/expired/fail
@@ -0,0 +1,20 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = ignore_k5login fail_pwchange
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/expired/fail-debug b/tests/data/scripts/expired/fail-debug
new file mode 100644
index 000000000000..7f464b4ed89f
--- /dev/null
+++ b/tests/data/scripts/expired/fail-debug
@@ -0,0 +1,24 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = ignore_k5login fail_pwchange debug
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
diff --git a/tests/data/scripts/fast/anonymous b/tests/data/scripts/fast/anonymous
new file mode 100644
index 000000000000..5f725ae63dcf
--- /dev/null
+++ b/tests/data/scripts/fast/anonymous
@@ -0,0 +1,17 @@
+# Test anonymous FAST.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache anon_fast
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %0
diff --git a/tests/data/scripts/fast/anonymous-debug b/tests/data/scripts/fast/anonymous-debug
new file mode 100644
index 000000000000..48fd1eadd581
--- /dev/null
+++ b/tests/data/scripts/fast/anonymous-debug
@@ -0,0 +1,22 @@
+# Test FAST with an existing ticket cache, with debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache anon_fast debug
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) anonymous authentication for FAST succeeded
+    DEBUG /^\(user %u\) setting FAST credential cache to MEMORY:/
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG pam_sm_authenticate: exit (success)
diff --git a/tests/data/scripts/fast/ccache b/tests/data/scripts/fast/ccache
new file mode 100644
index 000000000000..32e5eaa92465
--- /dev/null
+++ b/tests/data/scripts/fast/ccache
@@ -0,0 +1,17 @@
+# Test FAST with an existing ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache fast_ccache=%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/fast/ccache-debug b/tests/data/scripts/fast/ccache-debug
new file mode 100644
index 000000000000..f3788f2fc1c7
--- /dev/null
+++ b/tests/data/scripts/fast/ccache-debug
@@ -0,0 +1,21 @@
+# Test FAST with an existing ticket cache, with debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache fast_ccache=%0 debug
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) setting FAST credential cache to %0
+    DEBUG (user %u) attempting authentication as %u
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
diff --git a/tests/data/scripts/fast/no-ccache b/tests/data/scripts/fast/no-ccache
new file mode 100644
index 000000000000..71d4e2d494cf
--- /dev/null
+++ b/tests/data/scripts/fast/no-ccache
@@ -0,0 +1,17 @@
+# Test FAST with an existing ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache fast_ccache=%0BAD
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/fast/no-ccache-debug b/tests/data/scripts/fast/no-ccache-debug
new file mode 100644
index 000000000000..743ad5559538
--- /dev/null
+++ b/tests/data/scripts/fast/no-ccache-debug
@@ -0,0 +1,21 @@
+# Test FAST with an existing ticket cache, with debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache fast_ccache=%0BAD debug
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG /^\(user %u\) failed to get principal from FAST ccache %0BAD: /
+    DEBUG (user %u) attempting authentication as %u
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
diff --git a/tests/data/scripts/long/password b/tests/data/scripts/long/password
new file mode 100644
index 000000000000..e8183976c004
--- /dev/null
+++ b/tests/data/scripts/long/password
@@ -0,0 +1,14 @@
+# Test authentication with an excessively long password.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/long/password-debug b/tests/data/scripts/long/password-debug
new file mode 100644
index 000000000000..832c19340485
--- /dev/null
+++ b/tests/data/scripts/long/password-debug
@@ -0,0 +1,20 @@
+# Test excessively long password handling with debug logging.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = debug
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG /^\(user %u\) rejecting password longer than [0-9]+$/
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
diff --git a/tests/data/scripts/long/use-first b/tests/data/scripts/long/use-first
new file mode 100644
index 000000000000..b68800485d04
--- /dev/null
+++ b/tests/data/scripts/long/use-first
@@ -0,0 +1,14 @@
+# Test use_first_pass with an excessively long password.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = use_first_pass
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/long/use-first-debug b/tests/data/scripts/long/use-first-debug
new file mode 100644
index 000000000000..72747e81f40c
--- /dev/null
+++ b/tests/data/scripts/long/use-first-debug
@@ -0,0 +1,17 @@
+# Test use_first_pass with a long password and debug.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = use_first_pass debug
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG /^\(user %u\) rejecting password longer than [0-9]+$/
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
diff --git a/tests/data/scripts/no-cache/no-prompt b/tests/data/scripts/no-cache/no-prompt
new file mode 100644
index 000000000000..1eef2f26b4ee
--- /dev/null
+++ b/tests/data/scripts/no-cache/no-prompt
@@ -0,0 +1,25 @@
+# Defer prompting to the Kerberos library.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache no_prompt
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = /^(%u's Password|Password for %u): $/|%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/no-prompt-try b/tests/data/scripts/no-cache/no-prompt-try
new file mode 100644
index 000000000000..1d632a96f9e6
--- /dev/null
+++ b/tests/data/scripts/no-cache/no-prompt-try
@@ -0,0 +1,25 @@
+# Defer prompting to the Kerberos library w/try_first_pass.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache no_prompt try_first_pass
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = /^(%u's Password|Password for %u): $/|%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/no-prompt-use b/tests/data/scripts/no-cache/no-prompt-use
new file mode 100644
index 000000000000..76ef388465d2
--- /dev/null
+++ b/tests/data/scripts/no-cache/no-prompt-use
@@ -0,0 +1,25 @@
+# Defer prompting to the Kerberos library w/use_first_pass.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache no_prompt
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = /^(%u's Password|Password for %u): $/|%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/prompt b/tests/data/scripts/no-cache/prompt
new file mode 100644
index 000000000000..b0eb0d9ca57b
--- /dev/null
+++ b/tests/data/scripts/no-cache/prompt
@@ -0,0 +1,25 @@
+# Test basic auth w/prompting without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/prompt-expose b/tests/data/scripts/no-cache/prompt-expose
new file mode 100644
index 000000000000..a3365cc69754
--- /dev/null
+++ b/tests/data/scripts/no-cache/prompt-expose
@@ -0,0 +1,25 @@
+# Test basic auth w/prompting without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = expose_account no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password for %u: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/prompt-fail b/tests/data/scripts/no-cache/prompt-fail
new file mode 100644
index 000000000000..376b0f911997
--- /dev/null
+++ b/tests/data/scripts/no-cache/prompt-fail
@@ -0,0 +1,25 @@
+# Test failed password authentication.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |BAD%p
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/no-cache/prompt-fail-debug b/tests/data/scripts/no-cache/prompt-fail-debug
new file mode 100644
index 000000000000..9c9a7a406b4b
--- /dev/null
+++ b/tests/data/scripts/no-cache/prompt-fail-debug
@@ -0,0 +1,36 @@
+# Test failed password authentication with debug logging.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache debug
+    account = no_ccache debug
+    session = no_ccache debug
+
+[run]
+    authenticate  = PAM_AUTH_ERR
+    acct_mgmt     = PAM_IGNORE
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |BAD%p
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %u
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/no-cache/prompt-principal b/tests/data/scripts/no-cache/prompt-principal
new file mode 100644
index 000000000000..5e7278f1e92d
--- /dev/null
+++ b/tests/data/scripts/no-cache/prompt-principal
@@ -0,0 +1,26 @@
+# Test prompting for principal without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = prompt_principal no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_on = Principal: |%u
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/try-first b/tests/data/scripts/no-cache/try-first
new file mode 100644
index 000000000000..366801e9a078
--- /dev/null
+++ b/tests/data/scripts/no-cache/try-first
@@ -0,0 +1,25 @@
+# Test basic auth w/no AUTHTOK and try_first_pass.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = try_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/no-cache/use-first b/tests/data/scripts/no-cache/use-first
new file mode 100644
index 000000000000..028009fd7ba7
--- /dev/null
+++ b/tests/data/scripts/no-cache/use-first
@@ -0,0 +1,25 @@
+# Test basic auth w/no AUTHTOK and use_first_pass.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = use_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pam-user/no-update b/tests/data/scripts/pam-user/no-update
new file mode 100644
index 000000000000..36520bb4f332
--- /dev/null
+++ b/tests/data/scripts/pam-user/no-update
@@ -0,0 +1,20 @@
+# PAM_USER updates disabled.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache no_update_user
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pam-user/update b/tests/data/scripts/pam-user/update
new file mode 100644
index 000000000000..11d404a02144
--- /dev/null
+++ b/tests/data/scripts/pam-user/update
@@ -0,0 +1,20 @@
+# PAM_USER updates.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %0 authenticated as %1
diff --git a/tests/data/scripts/password/authtok b/tests/data/scripts/password/authtok
new file mode 100644
index 000000000000..9f6a39935b2d
--- /dev/null
+++ b/tests/data/scripts/password/authtok
@@ -0,0 +1,21 @@
+# Test password change with new authtok set but not old.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = use_authtok
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/authtok-force b/tests/data/scripts/password/authtok-force
new file mode 100644
index 000000000000..3bc0b598521b
--- /dev/null
+++ b/tests/data/scripts/password/authtok-force
@@ -0,0 +1,18 @@
+# Test password change with new authtok set but not old.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = use_authtok force_first_pass
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/authtok-too-long b/tests/data/scripts/password/authtok-too-long
new file mode 100644
index 000000000000..df81e24977b3
--- /dev/null
+++ b/tests/data/scripts/password/authtok-too-long
@@ -0,0 +1,17 @@
+# Test use_authtok with an excessively long password.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = use_authtok
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_AUTHTOK_ERR
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+
+[output]
diff --git a/tests/data/scripts/password/authtok-too-long-debug b/tests/data/scripts/password/authtok-too-long-debug
new file mode 100644
index 000000000000..cb38e8861102
--- /dev/null
+++ b/tests/data/scripts/password/authtok-too-long-debug
@@ -0,0 +1,23 @@
+# Test use_authtok with an excessively long password.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = use_authtok debug
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_AUTHTOK_ERR
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+
+[output]
+    DEBUG pam_sm_chauthtok: entry (prelim)
+    DEBUG (user %u) attempting authentication as %0 for kadmin/changepw
+    DEBUG pam_sm_chauthtok: exit (success)
+    DEBUG pam_sm_chauthtok: entry (update)
+    DEBUG /^\(user %u\) rejecting password longer than [0-9]+$/
+    DEBUG pam_sm_chauthtok: exit (failure)
diff --git a/tests/data/scripts/password/banner b/tests/data/scripts/password/banner
new file mode 100644
index 000000000000..98c899c26af5
--- /dev/null
+++ b/tests/data/scripts/password/banner
@@ -0,0 +1,23 @@
+# Test password change with a modified banner.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = banner=realm
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current realm password: |%p
+    echo_off = Enter new realm password: |%n
+    echo_off = Retype new realm password: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/banner-expose b/tests/data/scripts/password/banner-expose
new file mode 100644
index 000000000000..595fa0380b22
--- /dev/null
+++ b/tests/data/scripts/password/banner-expose
@@ -0,0 +1,23 @@
+# Test password change with banner and expose_account.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = expose_account banner=realm
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current realm password for %0: |%p
+    echo_off = Enter new realm password for %0: |%n
+    echo_off = Retype new realm password for %0: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/basic b/tests/data/scripts/password/basic
new file mode 100644
index 000000000000..5cb68267ce26
--- /dev/null
+++ b/tests/data/scripts/password/basic
@@ -0,0 +1,20 @@
+# Test password change with prompting.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+    echo_off = Retype new Kerberos password: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/basic-debug b/tests/data/scripts/password/basic-debug
new file mode 100644
index 000000000000..ca1c86b9c2c9
--- /dev/null
+++ b/tests/data/scripts/password/basic-debug
@@ -0,0 +1,28 @@
+# Test password change with prompting and debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = debug
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+    echo_off = Retype new Kerberos password: |%n
+
+[output]
+    DEBUG pam_sm_chauthtok: entry (prelim)
+    DEBUG (user %u) attempting authentication as %0 for kadmin/changepw
+    DEBUG pam_sm_chauthtok: exit (success)
+    DEBUG pam_sm_chauthtok: entry (update)
+    INFO user %u changed Kerberos password
+    DEBUG pam_sm_chauthtok: exit (success)
diff --git a/tests/data/scripts/password/expose b/tests/data/scripts/password/expose
new file mode 100644
index 000000000000..a82c1bd0b78d
--- /dev/null
+++ b/tests/data/scripts/password/expose
@@ -0,0 +1,23 @@
+# Test password change with prompting and expose_account.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = expose_account
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current Kerberos password for %0: |%p
+    echo_off = Enter new Kerberos password for %0: |%n
+    echo_off = Retype new Kerberos password for %0: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/ignore b/tests/data/scripts/password/ignore
new file mode 100644
index 000000000000..023cf5656f67
--- /dev/null
+++ b/tests/data/scripts/password/ignore
@@ -0,0 +1,18 @@
+# Test password prompt saving for ignored users.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = ignore_root
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_IGNORE
+    chauthtok(UPDATE_AUTHTOK) = PAM_IGNORE
+
+[prompts]
+    echo_off = Enter new password: |%n
+    echo_off = Retype new password: |%n
+
+[output]
diff --git a/tests/data/scripts/password/no-banner b/tests/data/scripts/password/no-banner
new file mode 100644
index 000000000000..9cabbd8ec5f9
--- /dev/null
+++ b/tests/data/scripts/password/no-banner
@@ -0,0 +1,23 @@
+# Test password change with no identifying banner.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = banner=
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current password: |%p
+    echo_off = Enter new password: |%n
+    echo_off = Retype new password: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/no-banner-expose b/tests/data/scripts/password/no-banner-expose
new file mode 100644
index 000000000000..3a5b944887bd
--- /dev/null
+++ b/tests/data/scripts/password/no-banner-expose
@@ -0,0 +1,23 @@
+# Test password change with no banner and expose_account.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = expose_account banner=
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_off = Current password for %0: |%p
+    echo_off = Enter new password for %0: |%n
+    echo_off = Retype new password for %0: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/prompt-principal b/tests/data/scripts/password/prompt-principal
new file mode 100644
index 000000000000..1e7274eb058e
--- /dev/null
+++ b/tests/data/scripts/password/prompt-principal
@@ -0,0 +1,24 @@
+# Test password change with prompting and prompt_principal.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = prompt_principal
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_SUCCESS
+
+[prompts]
+    echo_on = Principal: |%u
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+    echo_off = Retype new Kerberos password: |%n
+
+[output]
+    INFO user %u changed Kerberos password
diff --git a/tests/data/scripts/password/too-long b/tests/data/scripts/password/too-long
new file mode 100644
index 000000000000..4dbabd5db11e
--- /dev/null
+++ b/tests/data/scripts/password/too-long
@@ -0,0 +1,15 @@
+# Test password change to an excessively long password.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_AUTHTOK_ERR
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+
+[output]
diff --git a/tests/data/scripts/password/too-long-debug b/tests/data/scripts/password/too-long-debug
new file mode 100644
index 000000000000..18b4ed608612
--- /dev/null
+++ b/tests/data/scripts/password/too-long-debug
@@ -0,0 +1,24 @@
+# Test password change to an excessively long password.  -*- conf -*-
+#
+# Copyright 2020 Russ Allbery <eagle@eyrie.org>
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    password = debug
+
+[run]
+    chauthtok(PRELIM_CHECK)   = PAM_SUCCESS
+    chauthtok(UPDATE_AUTHTOK) = PAM_AUTHTOK_ERR
+
+[prompts]
+    echo_off = Current Kerberos password: |%p
+    echo_off = Enter new Kerberos password: |%n
+
+[output]
+    DEBUG pam_sm_chauthtok: entry (prelim)
+    DEBUG (user %u) attempting authentication as %0 for kadmin/changepw
+    DEBUG pam_sm_chauthtok: exit (success)
+    DEBUG pam_sm_chauthtok: entry (update)
+    DEBUG /^\(user %u\) rejecting password longer than [0-9]+$/
+    DEBUG pam_sm_chauthtok: exit (failure)
diff --git a/tests/data/scripts/pkinit/basic b/tests/data/scripts/pkinit/basic
new file mode 100644
index 000000000000..713bf0af1ce1
--- /dev/null
+++ b/tests/data/scripts/pkinit/basic
@@ -0,0 +1,22 @@
+# Test PKINIT auth without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache use_pkinit pkinit_user=FILE:%0
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pkinit/basic-debug b/tests/data/scripts/pkinit/basic-debug
new file mode 100644
index 000000000000..92a3fcf934d6
--- /dev/null
+++ b/tests/data/scripts/pkinit/basic-debug
@@ -0,0 +1,30 @@
+# Test PKINIT auth without saving a ticket cache w/debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = debug no_ccache use_pkinit pkinit_user=FILE:%0
+    account = debug no_ccache
+    session = debug no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/pkinit/no-use-pkinit b/tests/data/scripts/pkinit/no-use-pkinit
new file mode 100644
index 000000000000..ead640bcc4a0
--- /dev/null
+++ b/tests/data/scripts/pkinit/no-use-pkinit
@@ -0,0 +1,18 @@
+# Test for unsupported use_pkinit.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache use_pkinit
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    ERR use_pkinit requested but PKINIT not available or cannot be enforced
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/pkinit/pin-mit b/tests/data/scripts/pkinit/pin-mit
new file mode 100644
index 000000000000..9791ebc2ace6
--- /dev/null
+++ b/tests/data/scripts/pkinit/pin-mit
@@ -0,0 +1,20 @@
+# Test PKINIT auth with a PIN prompt.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache use_pkinit pkinit_user=PKCS12:%0
+
+[run]
+    authenticate  = PAM_SUCCESS
+
+[prompts]
+    echo_off = Pass phrase for %0: |%1
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pkinit/preauth-opt-mit b/tests/data/scripts/pkinit/preauth-opt-mit
new file mode 100644
index 000000000000..4602d18c7556
--- /dev/null
+++ b/tests/data/scripts/pkinit/preauth-opt-mit
@@ -0,0 +1,17 @@
+# Test PKINIT auth with MIT preauth options.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache try_pkinit preauth_opt=X509_user_identity=FILE:%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pkinit/prompt-try b/tests/data/scripts/pkinit/prompt-try
new file mode 100644
index 000000000000..723a228847e3
--- /dev/null
+++ b/tests/data/scripts/pkinit/prompt-try
@@ -0,0 +1,20 @@
+# Test try_pkinit with an initial prompt.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache try_pkinit pkinit_user=FILE:%0 pkinit_prompt
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[prompts]
+    echo_off = Insert smart card if desired, then press Enter: |
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pkinit/prompt-use b/tests/data/scripts/pkinit/prompt-use
new file mode 100644
index 000000000000..0b341d5d73ce
--- /dev/null
+++ b/tests/data/scripts/pkinit/prompt-use
@@ -0,0 +1,20 @@
+# Test use_pkinit with an initial prompt.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache use_pkinit pkinit_user=FILE:%0 pkinit_prompt
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[prompts]
+    echo_off = Insert smart card and press Enter: |
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pkinit/try-pkinit b/tests/data/scripts/pkinit/try-pkinit
new file mode 100644
index 000000000000..13b7bcf76653
--- /dev/null
+++ b/tests/data/scripts/pkinit/try-pkinit
@@ -0,0 +1,17 @@
+# Test optional PKINIT auth without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = no_ccache try_pkinit pkinit_user=FILE:%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/pkinit/try-pkinit-debug b/tests/data/scripts/pkinit/try-pkinit-debug
new file mode 100644
index 000000000000..c721395abd07
--- /dev/null
+++ b/tests/data/scripts/pkinit/try-pkinit-debug
@@ -0,0 +1,19 @@
+# Test optional PKINIT auth w/debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = debug no_ccache try_pkinit pkinit_user=FILE:%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
diff --git a/tests/data/scripts/pkinit/try-pkinit-debug-mit b/tests/data/scripts/pkinit/try-pkinit-debug-mit
new file mode 100644
index 000000000000..2c8c966bdc03
--- /dev/null
+++ b/tests/data/scripts/pkinit/try-pkinit-debug-mit
@@ -0,0 +1,20 @@
+# Test optional PKINIT auth w/debug.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = debug no_ccache try_pkinit pkinit_user=FILE:%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %u
+    INFO user %u authenticated as %u
+    DEBUG pam_sm_authenticate: exit (success)
diff --git a/tests/data/scripts/realm/fail-bad-user-realm b/tests/data/scripts/realm/fail-bad-user-realm
new file mode 100644
index 000000000000..d30bec6f1f33
--- /dev/null
+++ b/tests/data/scripts/realm/fail-bad-user-realm
@@ -0,0 +1,17 @@
+# Test authentication failure with different user_realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache user_realm=%0
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/fail-no-realm b/tests/data/scripts/realm/fail-no-realm
new file mode 100644
index 000000000000..87b59aab49f2
--- /dev/null
+++ b/tests/data/scripts/realm/fail-no-realm
@@ -0,0 +1,17 @@
+# Test authentication failure due to wrong realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/fail-no-realm-debug b/tests/data/scripts/realm/fail-no-realm-debug
new file mode 100644
index 000000000000..5ef2ce588177
--- /dev/null
+++ b/tests/data/scripts/realm/fail-no-realm-debug
@@ -0,0 +1,21 @@
+# Test authentication failure due to wrong realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache debug
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %u@%0
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
diff --git a/tests/data/scripts/realm/fail-realm b/tests/data/scripts/realm/fail-realm
new file mode 100644
index 000000000000..6dfe6a044354
--- /dev/null
+++ b/tests/data/scripts/realm/fail-realm
@@ -0,0 +1,17 @@
+# Test authentication failure with different realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache realm=%0
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/fail-user-realm b/tests/data/scripts/realm/fail-user-realm
new file mode 100644
index 000000000000..c97324c2d028
--- /dev/null
+++ b/tests/data/scripts/realm/fail-user-realm
@@ -0,0 +1,18 @@
+# Test authentication failure with different user_realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache user_realm=%0
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[output]
+    ERR /^\(user %u\) cannot convert principal to user: /
+    NOTICE failed authorization check; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/pass-realm b/tests/data/scripts/realm/pass-realm
new file mode 100644
index 000000000000..91136c9bfc1c
--- /dev/null
+++ b/tests/data/scripts/realm/pass-realm
@@ -0,0 +1,17 @@
+# Test authentication success with different realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache realm=%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u@%0
diff --git a/tests/data/scripts/realm/pass-user-realm b/tests/data/scripts/realm/pass-user-realm
new file mode 100644
index 000000000000..86007c2d4d26
--- /dev/null
+++ b/tests/data/scripts/realm/pass-user-realm
@@ -0,0 +1,17 @@
+# Test authentication success with different user_realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache user_realm=%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u@%0
diff --git a/tests/data/scripts/stacked/auth-only b/tests/data/scripts/stacked/auth-only
new file mode 100644
index 000000000000..46d3308ac0e4
--- /dev/null
+++ b/tests/data/scripts/stacked/auth-only
@@ -0,0 +1,18 @@
+# Test basic authentication without setcred.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/stacked/basic b/tests/data/scripts/stacked/basic
new file mode 100644
index 000000000000..a05640d278bf
--- /dev/null
+++ b/tests/data/scripts/stacked/basic
@@ -0,0 +1,22 @@
+# Test basic authentication without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/stacked/prompt b/tests/data/scripts/stacked/prompt
new file mode 100644
index 000000000000..b0eb0d9ca57b
--- /dev/null
+++ b/tests/data/scripts/stacked/prompt
@@ -0,0 +1,25 @@
+# Test basic auth w/prompting without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/stacked/prompt-principal b/tests/data/scripts/stacked/prompt-principal
new file mode 100644
index 000000000000..b416671875c7
--- /dev/null
+++ b/tests/data/scripts/stacked/prompt-principal
@@ -0,0 +1,25 @@
+# Test prompting for principal without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = prompt_principal force_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_on = Principal: |%u
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/stacked/try-first b/tests/data/scripts/stacked/try-first
new file mode 100644
index 000000000000..3a14b7584bc1
--- /dev/null
+++ b/tests/data/scripts/stacked/try-first
@@ -0,0 +1,22 @@
+# Test try_first_pass without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = try_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/stacked/use-first b/tests/data/scripts/stacked/use-first
new file mode 100644
index 000000000000..29c5c5c4188d
--- /dev/null
+++ b/tests/data/scripts/stacked/use-first
@@ -0,0 +1,22 @@
+# Test use_first_pass without saving a ticket cache.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = use_first_pass no_ccache
+    account = no_ccache
+    session = no_ccache
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u
diff --git a/tests/data/scripts/trace/supported b/tests/data/scripts/trace/supported
new file mode 100644
index 000000000000..f67c389735ff
--- /dev/null
+++ b/tests/data/scripts/trace/supported
@@ -0,0 +1,58 @@
+# Basic test of enabling trace logging.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass no_ccache trace=%0 debug
+    account = no_ccache trace=%0 debug
+    session = no_ccache trace=%0 debug
+
+[run]
+    authenticate               = PAM_AUTH_ERR
+    acct_mgmt                  = PAM_IGNORE
+    setcred(DELETE_CRED)       = PAM_SUCCESS
+    setcred(ESTABLISH_CRED)    = PAM_SUCCESS
+    setcred(REFRESH_CRED)      = PAM_SUCCESS
+    setcred(REINITIALIZE_CRED) = PAM_SUCCESS
+    open_session               = PAM_SUCCESS
+    close_session              = PAM_SUCCESS
+
+[output]
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) no stored password
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_setcred: entry (delete)
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_setcred: entry (establish)
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_setcred: entry (refresh)
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_setcred: entry (reinit)
+    DEBUG no context found, creating one
+    DEBUG (user root) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
+    DEBUG pam_sm_setcred: exit (success)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG enabled trace logging to %0
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/scripts/trace/unsupported b/tests/data/scripts/trace/unsupported
new file mode 100644
index 000000000000..2100c34fc2f5
--- /dev/null
+++ b/tests/data/scripts/trace/unsupported
@@ -0,0 +1,52 @@
+# Basic test of attempting trace logging when not supported.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth    = force_first_pass no_ccache trace=%0 debug
+    account = no_ccache trace=%0 debug
+    session = no_ccache trace=%0 debug
+
+[run]
+    authenticate               = PAM_AUTH_ERR
+    acct_mgmt                  = PAM_IGNORE
+    setcred(DELETE_CRED)       = PAM_SUCCESS
+    setcred(ESTABLISH_CRED)    = PAM_SUCCESS
+    setcred(REFRESH_CRED)      = PAM_SUCCESS
+    setcred(REINITIALIZE_CRED) = PAM_SUCCESS
+    open_session               = PAM_SUCCESS
+    close_session              = PAM_SUCCESS
+
+[output]
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) no stored password
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG skipping non-Kerberos login
+    DEBUG pam_sm_acct_mgmt: exit (ignore)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_setcred: entry (delete)
+    DEBUG pam_sm_setcred: exit (success)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_setcred: entry (establish)
+    DEBUG pam_sm_setcred: exit (success)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_setcred: entry (refresh)
+    DEBUG pam_sm_setcred: exit (success)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_setcred: entry (reinit)
+    DEBUG pam_sm_setcred: exit (success)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_open_session: entry
+    DEBUG pam_sm_open_session: exit (success)
+    ERR trace logging requested but not supported
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)
diff --git a/tests/data/valgrind.supp b/tests/data/valgrind.supp
new file mode 100644
index 000000000000..6e987803f5e2
--- /dev/null
+++ b/tests/data/valgrind.supp
@@ -0,0 +1,242 @@
+# -*- conf -*-
+#
+# This is a valgrind suppression file for analysis of test suite results.
+#
+# Suppress a variety of apparent memory leaks in various Kerberos
+# implementations due to one-time instantiation of data, and a few other
+# artifacts of the test suite for rra-c-util portability and utility code
+# and related software.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2017-2018, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2011-2014
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+{
+   dlopen-dlerror
+   Memcheck:Leak
+   fun:calloc
+   fun:_dlerror_run
+}
+{
+   fakeroot-msgsnd
+   Memcheck:Param
+   msgsnd(msgp->mtext)
+   fun:msgsnd
+   fun:send_fakem
+   fun:send_get_fakem
+   obj:*/libfakeroot-sysv.so
+}
+{
+   heimdal-base-once
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:heim_base_once_f
+}
+{
+   heimdal-gss-config
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:krb5_config_parse_debug
+}
+{
+   heimdal-gss-config-2
+   Memcheck:Leak
+   fun:*alloc
+   fun:_krb5_config_get_entry
+}
+{
+   heimdal-gss-cred
+   Memcheck:Leak
+   fun:calloc
+   obj:*libgssapi.so.*
+   obj:*libgssapi.so.*
+   fun:gss_acquire_cred
+}
+{
+   heimdal-gss-krb5-init
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:_gsskrb5_init
+}
+{
+   heimdal-gss-load-mech
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:_gss_load_mech
+}
+{
+   heimdal-krb5-init-context-once
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:init_context_once
+}
+{
+   heimdal-krb5-reg-plugins-once
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:krb5_plugin_register
+   fun:reg_def_plugins_once
+}
+{
+   heimdal-krb5-openssl-init
+   Memcheck:Leak
+   fun:*alloc
+   obj:*
+   fun:CRYPTO_*alloc
+}
+{
+   mit-gss-ccache
+   Memcheck:Leak
+   fun:*alloc
+   fun:krb5int_setspecific
+   fun:kg_set_ccache_name
+   fun:gss_krb5int_ccache_name
+}
+{
+   mit-gss-ccache-2
+   Memcheck:Leak
+   fun:*alloc
+   fun:strdup
+   fun:kg_set_ccache_name
+   fun:gss_krb5int_ccache_name
+}
+{
+   mit-gss-error
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:krb5_gss_save_error_string
+}
+{
+   mit-gss-mechs
+   Memcheck:Leak
+   fun:glob
+   fun:loadConfigFiles
+   fun:updateMechList
+   fun:build_mechSet
+   fun:gss_indicate_mechs
+}
+{
+   mit-kadmin-ovku-error
+   Memcheck:Leak
+   fun:*alloc*
+   fun:initialize_ovku_error_table_r
+}
+{
+   mit-krb5-changepw
+   Memcheck:Leak
+   fun:*alloc
+   fun:change_set_password
+   fun:krb5_change_password
+   fun:krb5_get_init_creds_password
+}
+{
+   mit-krb5-pkinit-openssl-init
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:krb5_init_preauth_context
+}
+{
+   mit-krb5-pkinit-openssl-request
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:krb5_preauth_request_context_init
+}
+{
+   mit-krb5-pkinit-openssl-request-2
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:k5_preauth_request_context_init
+}
+{
+   mit-krb5-plugin-dirs
+   Memcheck:Leak
+   fun:calloc
+   fun:krb5int_open_plugin_dirs
+}
+{
+   mit-krb5-plugin-dlerror
+   Memcheck:Leak
+   fun:calloc
+   fun:_dlerror_run
+   ...
+   fun:krb5int_open_plugin
+}
+{
+   mit-krb5-plugin-register
+   Memcheck:Leak
+   fun:malloc
+   fun:strdup
+   fun:register_module.isra.1
+}
+{
+   mit-krb5-preauth-init
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:k5_init_preauth_context
+}
+{
+   mit-krb5-preauth-init
+   Memcheck:Leak
+   fun:strdup
+   fun:add_to_list
+   fun:profile_get_values
+   ...
+   fun:clpreauth_prep_questions
+}
+{
+   mit-krb5-preauth-init-2
+   Memcheck:Leak
+   fun:*alloc
+   fun:init_list
+   fun:profile_get_values
+   ...
+   fun:clpreauth_prep_questions
+}
+{
+   mit-krb5-profile
+   Memcheck:Leak
+   fun:*alloc
+   ...
+   fun:profile_open_file
+}
+{
+   portable-setenv
+   Memcheck:Leak
+   fun:malloc
+   fun:test_setenv
+}
diff --git a/tests/docs/pod-spelling-t b/tests/docs/pod-spelling-t
new file mode 100755
index 000000000000..2ea5bf3ba6ee
--- /dev/null
+++ b/tests/docs/pod-spelling-t
@@ -0,0 +1,55 @@
+#!/usr/bin/perl
+#
+# Checks all POD files in the tree for spelling errors using Test::Spelling.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2016, 2019, 2021 Russ Allbery <eagle@eyrie.org>
+# Copyright 2012-2014
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+use 5.010;
+use strict;
+use warnings;
+
+use lib "$ENV{C_TAP_SOURCE}/tap/perl";
+
+use Test::RRA qw(skip_unless_author use_prereq);
+use Test::RRA::Automake qw(automake_setup perl_dirs);
+
+use Test::More;
+
+# Only run this test for the module author since the required stopwords are
+# too sensitive to the exact spell-checking program and dictionary.
+skip_unless_author('Spelling tests');
+
+# Load prerequisite modules.
+use_prereq('Test::Spelling');
+
+# Set up Automake testing.
+automake_setup();
+
+# Run the tests.
+all_pod_files_spelling_ok(perl_dirs());
diff --git a/tests/docs/pod-t b/tests/docs/pod-t
new file mode 100755
index 000000000000..be21ddf01cea
--- /dev/null
+++ b/tests/docs/pod-t
@@ -0,0 +1,56 @@
+#!/usr/bin/perl
+#
+# Check all POD documents in the tree, except for any embedded Perl module
+# distribution, for POD formatting errors.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2016, 2019, 2021 Russ Allbery <eagle@eyrie.org>
+# Copyright 2012-2014
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+use 5.010;
+use strict;
+use warnings;
+
+use lib "$ENV{C_TAP_SOURCE}/tap/perl";
+
+use Test::RRA qw(skip_unless_automated use_prereq);
+use Test::RRA::Automake qw(automake_setup perl_dirs);
+
+use Test::More;
+
+# Skip this test for normal user installs, since we normally pre-generate all
+# of the documentation and the end user doesn't care.
+skip_unless_automated('POD syntax tests');
+
+# Load prerequisite modules.
+use_prereq('Test::Pod');
+
+# Set up Automake testing.
+automake_setup();
+
+# Run the tests.
+all_pod_files_ok(perl_dirs());
diff --git a/tests/docs/spdx-license-t b/tests/docs/spdx-license-t
new file mode 100755
index 000000000000..2841835fb69a
--- /dev/null
+++ b/tests/docs/spdx-license-t
@@ -0,0 +1,149 @@
+#!/usr/bin/perl
+#
+# Check source files for SPDX-License-Identifier fields.
+#
+# Examine all source files in a distribution to check that they contain an
+# SPDX-License-Identifier field.  This does not check the syntax or whether
+# the identifiers are valid.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Copyright 2018-2021 Russ Allbery <eagle@eyrie.org>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+use 5.010;
+use strict;
+use warnings;
+
+use lib "$ENV{C_TAP_SOURCE}/tap/perl";
+
+use Test::RRA qw(skip_unless_automated);
+use Test::RRA::Automake qw(all_files automake_setup);
+
+use File::Basename qw(basename);
+use Test::More;
+
+# File name (the file without any directory component) and path patterns to
+# skip for this check.
+## no critic (RegularExpressions::ProhibitFixedStringMatches)
+my @IGNORE = (
+    qr{ \A LICENSE \z }xms,             # Generated file with no license itself
+    qr{ \A (NEWS|THANKS|TODO) \z }xms,  # Package license should be fine
+    qr{ \A README ( [.] .* )? \z }xms,  # Package license should be fine
+    qr{ \A (Makefile|libtool) \z }xms,  # Generated file
+    qr{ ~ \z }xms,                      # Backup files
+    qr{ [.] l?a \z }xms,                # Created by libtool
+    qr{ [.] o \z }xms,                  # Compiler objects
+    qr{ [.] output \z }xms,             # Test data
+);
+my @IGNORE_PATHS = (
+    qr{ \A debian/ }xms,                       # Found in debian/* branches
+    qr{ \A docs/metadata/ }xms,                # Package license should be fine
+    qr{ \A docs/protocol[.](html|txt) \z }xms, # Generated by xml2rfc
+    qr{ \A m4/ (libtool|lt.*) [.] m4 \z }xms,  # Files from Libtool
+    qr{ \A perl/Build \z }xms,                 # Perl build files
+    qr{ \A perl/MANIFEST \z }xms,              # Perl build files
+    qr{ \A perl/MYMETA [.] }xms,               # Perl build files
+    qr{ \A perl/blib/ }xms,                    # Perl build files
+    qr{ \A perl/cover_db/ }xms,                # Perl test files
+    qr{ \A perl/_build }xms,                   # Perl build files
+    qr{ \A php/Makefile [.] global \z }xms,    # Created by phpize
+    qr{ \A php/autom4te [.] cache/ }xms,       # Created by phpize
+    qr{ \A php/acinclude [.] m4 \z }xms,       # Created by phpize
+    qr{ \A php/build/ }xms,                    # Created by phpize
+    qr{ \A php/config [.] (guess|sub) \z }xms, # Created by phpize
+    qr{ \A php/configure [.] (ac|in) \z }xms,  # Created by phpize
+    qr{ \A php/ltmain [.] sh \z }xms,          # Created by phpize
+    qr{ \A php/run-tests [.] php \z }xms,      # Created by phpize
+    qr{ \A python/ .* [.] egg-info/ }xms,      # Python build files
+    qr{ \A tests/config/ (?!README) }xms,      # Test configuration
+    qr{ \A tests/tmp/ }xms,                    # Temporary test files
+);
+## use critic
+
+# Only run this test during automated testing, since failure doesn't indicate
+# any user-noticable flaw in the package itself.
+skip_unless_automated('SPDX identifier tests');
+
+# Set up Automake testing.
+automake_setup();
+
+# Check a single file for an occurrence of the string.
+#
+# $path - Path to the file
+#
+# Returns: undef
+sub check_file {
+    my ($path) = @_;
+    my $filename = basename($path);
+
+    # Ignore files in the whitelist and binary files.
+    for my $pattern (@IGNORE) {
+        return if $filename =~ $pattern;
+    }
+    for my $pattern (@IGNORE_PATHS) {
+        return if $path =~ $pattern;
+    }
+    return if !-T $path;
+
+    # Scan the file.
+    my ($saw_legacy_notice, $saw_spdx, $skip_spdx);
+    open(my $file, '<', $path) or BAIL_OUT("Cannot open $path: $!");
+    while (defined(my $line = <$file>)) {
+        if ($line =~ m{ Generated [ ] by [ ] libtool [ ] }xms) {
+            close($file) or BAIL_OUT("Cannot close $path: $!");
+            return;
+        }
+        if ($line =~ m{ \b See \s+ LICENSE \s+ for \s+ licensing }xms) {
+            $saw_legacy_notice = 1;
+        }
+        if ($line =~ m{ \b SPDX-License-Identifier: \s+ \S+ }xms) {
+            $saw_spdx = 1;
+            last;
+        }
+        if ($line =~ m{ no \s SPDX-License-Identifier \s registered }xms) {
+            $skip_spdx = 1;
+            last;
+        }
+    }
+    close($file) or BAIL_OUT("Cannot close $path: $!");
+
+    # If there is a legacy license notice, report a failure regardless of file
+    # size.  Otherwise, skip files under 1KB.  They can be rolled up into the
+    # overall project license and the license notice may be a substantial
+    # portion of the file size.
+    if ($saw_legacy_notice) {
+        ok(!$saw_legacy_notice, "$path has legacy license notice");
+    } else {
+        ok($saw_spdx || $skip_spdx || -s $path < 1024, $path);
+    }
+    return;
+}
+
+# Scan every file.  We don't declare a plan since we skip a lot of files and
+# don't want to precalculate the file list.
+my @paths = all_files();
+for my $path (@paths) {
+    check_file($path);
+}
+done_testing();
diff --git a/tests/fakepam/README b/tests/fakepam/README
new file mode 100644
index 000000000000..f7522cc1d66e
--- /dev/null
+++ b/tests/fakepam/README
@@ -0,0 +1,276 @@
+                          PAM Testing Framework
+
+Overview
+
+    The files in this directory provide a shim PAM library that's used for
+    testing and a test framework used to exercise a PAM module.
+
+    This library and its include files define the minimum amount
+    of the PAM module interface so that PAM modules can be tested without
+    such problems as needing configuration files in /etc/pam.d or needing
+    changes to the system configuration to run a testing PAM module
+    instead of the normal system PAM modules.
+
+    The goal of this library is that all PAM code should be able to be
+    left unchanged and the code just linked with the fakepam library
+    rather than the regular PAM library.  The testing code can then call
+    pam_start and pam_end as defined in the fakepam/pam.h header file and
+    inspect internal PAM state as needed.
+
+    The library also provides an interface to exercise a PAM module via an
+    interaction script, so that as much of the testing process as possible
+    is moved into simple text files instead of C code.  That test script
+    format supports specifying the PAM configuration, the PAM interfaces
+    to run, the expected prompts and replies, and the expected log
+    messages.  That interface is defined in fakepam/script.h.
+
+Fake PAM Library
+
+    Unfortunately, the standard PAM library for most operating systems
+    does not provide a reasonable testing framework.  The primary problem
+    is configuration: the PAM library usually hard-codes a configuration
+    location such as /etc/pam.conf or /etc/pam.d/<application>.  But there
+    are other problems as well, such as capturing logging rather than
+    having it go to syslog and inspecting PAM internal state to make sure
+    that it's updated properly by the module.
+
+    This library implements some of the same API as the system PAM library
+    and uses the system PAM library headers, but the underlying
+    implementation does not call the system PAM library or dynamically
+    load modules.  Instead, it's meant to be linked into a single
+    executable along with the implementation of a PAM module.  It does not
+    provide most of the application-level PAM interfaces (so one cannot
+    link a PAM-using application against it), just the interfaces called
+    by a module.  The caller of the library can then call the module API
+    (such as pam_sm_authenticate) directly.
+
+    All of the internal state maintained by the PAM library is made
+    available to the test program linked with this library.  See
+    fakepam/pam.h for the data structures.  This allows verification that
+    the PAM module is setting the internal PAM state properly.
+
+  User Handling
+
+    In order to write good test suites, one often has to be able to
+    authenticate as a variety of users, but PAM modules may expect the
+    authenticating user to exist on the system.  The fakepam library
+    provides a pam_modutil_getpwnam (if available) or a getpwnam
+    implementation that returns information for a single user (and user
+    unknown for everyone else).  To set the information for the one valid
+    user, call the pam_set_pwd function and provide a struct passwd that
+    will be returned by pam_modutil_getpwnam.
+
+    The fakepam library also provides a replacement krb5_kuserok function
+    for testing PAM modules that use Kerberos.  This source file should
+    only be included in packages that are building with Kerberos.  It
+    implements the same functionality as the default krb5_kuserok
+    function, but looks for .k5login in the home directory configured by
+    the test framework instead of using getpwnam.
+
+    Only those two functions are intercepted, so if the module looks up
+    users in other ways, it may still bypass the fakepam library and look
+    at system users.
+
+  Output Handling
+
+    The fakepam library intercepts the PAM functions that would normally
+    log to syslog and instead accumulates the output in a static string
+    variable.  To retrieve the logging output so far, call pam_output,
+    which returns a struct of all the output strings up to that point and
+    resets the accumulated output.
+
+Scripted PAM Testing
+
+    Also provided as part of the fakepam library is a test framework for
+    testing PAM modules.  This test framework allows most of the testing
+    process to be encapsulated in a text configuration file per test,
+    rather than in a tedious set of checks and calls written in C.
+
+  Test API
+
+    The basic test API is to call either run_script (to run a single test
+    script) or run_script_dir (to run all scripts in a particular
+    directory).  Both take a configuration struct that controls how the
+    PAM library is set up and called.
+
+    That configuration struct takes the following elements:
+
+    user
+        The user as which to authenticate, passed into pam_start and also
+        substituted for the %u escape.  This should match the user whose
+        home directory information is configured using pam_set_pwd if that
+        function is in use.
+
+    password
+        Only used for the %p escape.  This is not used to set the
+        authentication token in the PAM library (see authtok below).
+
+    newpass
+        Only used for the %n escape.
+
+    extra
+        An array of up to 10 additional strings used by the %0 through %9
+        escapes when parsing the configuration file, as discussed below.
+
+    authtok
+        Sets the default value of the PAM_AUTHTOK data item.  This will be
+        set immediately after initializing the PAM library and before
+        calling any PAM module functions.
+
+    authtok
+        Like authtok, but for the PAM_OLDAUTHTOK data item.
+
+    callback
+        This, and the associated data element, specifies a callback that's
+        called at the end of processing of the script before calling
+        pam_end.  This can be used to inspect and verify the internal
+        state of PAM.  The data element is an opaque pointer passed into
+        the callback.
+
+  Test Script Basic Format
+
+    Test scripts are composed of one or more sections.  Each section
+    begins with:
+
+        [<section>]
+
+    starting in column 1, where <section> is the name of the section.  The
+    valid section types and the format of their contents are described
+    below.
+
+    Blank lines and lines starting with # are ignored.
+
+    Several strings undergo %-escape expansion as mentioned below.  For
+    any such string, the following escapes are supported:
+
+        %i      Current UID (not the UID of the target user)
+        %n      New password
+        %p      Password
+        %u      Username
+        %0      extra[0]
+        ...
+        %9      extra[9]
+
+    All of these are set in the script_config struct.
+
+    Regular expression matching is supported for output lines and for
+    prompts.  To mark an expected prompt or output line as a regular
+    expression, it must begin and end with a slash (/).  Slashes inside
+    the regular expression do not need to be escaped.  If regular
+    expression support is not available in the C library, those matching
+    tests will be skipped.
+
+  The [options] Section
+
+    The [options] section contains the PAM configuration that will be
+    passed to the module.  These are the options that are normally listed
+    in the PAM configuration file after the name of the module.  The
+    syntax of this section is one or more lines of the form:
+
+        <group> = <options>
+
+    where <group> is one of "account", "auth", "password", or "session".
+    The options are space-delimited and may be either option names or
+    option=value pairs.
+
+  The [run] Section
+
+    The [run] section specifies what PAM interfaces to call.  It consists
+    of one or more lines in the format:
+
+        <call> = <status>
+
+    where <call> is the PAM call to make and <status> is the status code
+    that it should return.  <call> is one of the PAM module interface
+    functions without the leading "pam_sm_", so one of "acct_mgmt",
+    "authenticate", "setcred", "chauthtok", "open_session", or
+    "close_session".  The return status is one of the PAM constants
+    defined for return status, such as PAM_IGNORE or PAM_SUCCESS.  The
+    test framework will ensure that the PAM call returns the appropriate
+    status.
+
+    The <call> may be optionally followed by an open parentheses and then
+    a list of flags separated by |, or syntactically:
+
+        <call>(<flag>|<flag>|...) = <status>
+
+    In this form, rather than passing a flags value of 0 to the PAM call,
+    the test framework will pass the combination of the provided flags.
+    The flags are PAM constants without the leading PAM_, so (for example)
+    DELETE_CRED, ESTABLISH_CRED, REFRESH_CRED, or REINITIALIZE_CRED for
+    the "setcred" call.
+
+    As a special case, <call> may be "end" to specify flags to pass to the
+    pam_end call (such as PAM_DATA_SILENT).
+
+  The [end] Section
+
+    The [end] section defines how to call pam_end.  It currently takes
+    only one setting, flags, the syntax of which is:
+
+        flags = <flag>|<flag>
+
+    This allows PAM_DATA_SILENT or other flags to be passed to pam_end
+    when running the test script.
+
+  The [output] Section
+
+    The [output] section defines the logging output expected from the
+    module.  It consists of zero or more lines in the format:
+
+        <priority> <output>
+        <priority> /<regex>/
+
+    where <priority> is a syslog priority and <output> is the remaining
+    output or a regular expression to match against the output.  Valid
+    values for <priority> are DEBUG, INFO, NOTICE, ERR, and CRIT.
+    <output> and <regex> may contain spaces and undergoes %-escape
+    expansion.
+
+    The replacement values are taken from the script_config struct passed
+    as a parameter to run_script or run_script_dir.
+
+    If the [output] section is missing entirely, the test framework will
+    expect there to be no logging output from the PAM module.
+
+    This defines the logging output, not the prompts returned through the
+    conversation function.  For that, see the next section.
+
+  The [prompts] Section
+
+    The [prompts] section defines the prompts that the PAM module is
+    expected to send via the conversation function, and the responses that
+    the test harness will send back (if any).  This consists of zero or
+    more lines in one of the following formats:
+
+        <type> = <prompt>
+        <type> = /<prompt>/
+        <type> = <prompt>|<response>
+        <type> = /<prompt>/|<response>
+
+    The <type> is the style of prompt, chosen from "echo_off", "echo_on",
+    "error_msg", and "info".  The <prompt> is the actual prompt sent and
+    undergoes %-escape expansion.  It may be enclosed in slashes (/) to
+    indicate that it's a regular expression instead of literal text.  The
+    <response> if present (and its presence is signaled by the |
+    character) contains the response sent back by the test framework and
+    also undergoes %-escape expansion.  The response starts with the final
+    | character on the line, so <prompt> regular expressions may freely
+    use | inside the regular expression.
+
+    If the [prompts] section is present and empty, the test harness will
+    check that the PAM module does not send any prompts.  If the [prompts]
+    section is absent entirely, the conversation function passed to the
+    PAM module will be NULL.
+
+License
+
+    This file is part of the documentation of rra-c-util, which can be
+    found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+
+    Copyright 2011-2012, 2020-2021 Russ Allbery <eagle@eyrie.org>
+
+    Copying and distribution of this file, with or without modification,
+    are permitted in any medium without royalty provided the copyright
+    notice and this notice are preserved.  This file is offered as-is,
+    without any warranty.
diff --git a/tests/fakepam/config.c b/tests/fakepam/config.c
new file mode 100644
index 000000000000..8e0685604d55
--- /dev/null
+++ b/tests/fakepam/config.c
@@ -0,0 +1,766 @@
+/*
+ * Run a PAM interaction script for testing.
+ *
+ * Provides an interface that loads a PAM interaction script from a file and
+ * runs through that script, calling the internal PAM module functions and
+ * checking their results.  This allows automation of PAM testing through
+ * external data files instead of coding everything in C.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017-2018, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <dirent.h>
+#include <errno.h>
+#include <syslog.h>
+
+#include <tests/fakepam/internal.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+/* Used for enumerating arrays. */
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
+
+/* Mapping of strings to PAM function pointers and group numbers. */
+static const struct {
+    const char *name;
+    pam_call call;
+    enum group_type group;
+} CALLS[] = {
+    /* clang-format off */
+    {"acct_mgmt",     pam_sm_acct_mgmt,     GROUP_ACCOUNT },
+    {"authenticate",  pam_sm_authenticate,  GROUP_AUTH    },
+    {"setcred",       pam_sm_setcred,       GROUP_AUTH    },
+    {"chauthtok",     pam_sm_chauthtok,     GROUP_PASSWORD},
+    {"open_session",  pam_sm_open_session,  GROUP_SESSION },
+    {"close_session", pam_sm_close_session, GROUP_SESSION },
+    /* clang-format on */
+};
+
+/* Mapping of PAM flag names without the leading PAM_ to values. */
+static const struct {
+    const char *name;
+    int value;
+} FLAGS[] = {
+    /* clang-format off */
+    {"CHANGE_EXPIRED_AUTHTOK", PAM_CHANGE_EXPIRED_AUTHTOK},
+    {"DELETE_CRED",            PAM_DELETE_CRED           },
+    {"DISALLOW_NULL_AUTHTOK",  PAM_DISALLOW_NULL_AUTHTOK },
+    {"ESTABLISH_CRED",         PAM_ESTABLISH_CRED        },
+    {"PRELIM_CHECK",           PAM_PRELIM_CHECK          },
+    {"REFRESH_CRED",           PAM_REFRESH_CRED          },
+    {"REINITIALIZE_CRED",      PAM_REINITIALIZE_CRED     },
+    {"SILENT",                 PAM_SILENT                },
+    {"UPDATE_AUTHTOK",         PAM_UPDATE_AUTHTOK        },
+    /* clang-format on */
+};
+
+/* Mapping of strings to PAM groups. */
+static const struct {
+    const char *name;
+    enum group_type group;
+} GROUPS[] = {
+    /* clang-format off */
+    {"account",  GROUP_ACCOUNT },
+    {"auth",     GROUP_AUTH    },
+    {"password", GROUP_PASSWORD},
+    {"session",  GROUP_SESSION },
+    /* clang-format on */
+};
+
+/* Mapping of strings to PAM return values. */
+static const struct {
+    const char *name;
+    int status;
+} RETURNS[] = {
+    /* clang-format off */
+    {"PAM_AUTH_ERR",         PAM_AUTH_ERR        },
+    {"PAM_AUTHINFO_UNAVAIL", PAM_AUTHINFO_UNAVAIL},
+    {"PAM_AUTHTOK_ERR",      PAM_AUTHTOK_ERR     },
+    {"PAM_DATA_SILENT",      PAM_DATA_SILENT     },
+    {"PAM_IGNORE",           PAM_IGNORE          },
+    {"PAM_NEW_AUTHTOK_REQD", PAM_NEW_AUTHTOK_REQD},
+    {"PAM_SESSION_ERR",      PAM_SESSION_ERR     },
+    {"PAM_SUCCESS",          PAM_SUCCESS         },
+    {"PAM_USER_UNKNOWN",     PAM_USER_UNKNOWN    },
+    /* clang-format on */
+};
+
+/* Mapping of PAM prompt styles to their values. */
+static const struct {
+    const char *name;
+    int style;
+} STYLES[] = {
+    /* clang-format off */
+    {"echo_off",  PAM_PROMPT_ECHO_OFF},
+    {"echo_on",   PAM_PROMPT_ECHO_ON },
+    {"error_msg", PAM_ERROR_MSG      },
+    {"info",      PAM_TEXT_INFO      },
+    /* clang-format on */
+};
+
+/* Mappings of strings to syslog priorities. */
+static const struct {
+    const char *name;
+    int priority;
+} PRIORITIES[] = {
+    /* clang-format off */
+    {"DEBUG",  LOG_DEBUG },
+    {"INFO",   LOG_INFO  },
+    {"NOTICE", LOG_NOTICE},
+    {"ERR",    LOG_ERR   },
+    {"CRIT",   LOG_CRIT  },
+    /* clang-format on */
+};
+
+
+/*
+ * Given a pointer to a string, skip any leading whitespace and return a
+ * pointer to the first non-whitespace character.
+ */
+static char *
+skip_whitespace(char *p)
+{
+    while (isspace((unsigned char) (*p)))
+        p++;
+    return p;
+}
+
+
+/*
+ * Read a line from a file into a BUFSIZ buffer, failing if the line was too
+ * long to fit into the buffer, and returns a copy of that line in newly
+ * allocated memory.  Ignores blank lines and comments.  Caller is responsible
+ * for freeing.  Returns NULL on end of file and fails on read errors.
+ */
+static char *
+readline(FILE *file)
+{
+    char buffer[BUFSIZ];
+    char *line, *first;
+
+    do {
+        line = fgets(buffer, sizeof(buffer), file);
+        if (line == NULL) {
+            if (feof(file))
+                return NULL;
+            sysbail("cannot read line from script");
+        }
+        if (buffer[strlen(buffer) - 1] != '\n')
+            bail("script line too long");
+        buffer[strlen(buffer) - 1] = '\0';
+        first = skip_whitespace(buffer);
+    } while (first[0] == '#' || first[0] == '\0');
+    line = bstrdup(buffer);
+    return line;
+}
+
+
+/*
+ * Given the name of a PAM call, map it to a call enum.  This is used later in
+ * switch statements to determine which function to call.  Fails on any
+ * unrecognized string.  If the optional second argument is not NULL, also
+ * store the group number in that argument.
+ */
+static pam_call
+string_to_call(const char *name, enum group_type *group)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(CALLS); i++)
+        if (strcmp(name, CALLS[i].name) == 0) {
+            if (group != NULL)
+                *group = CALLS[i].group;
+            return CALLS[i].call;
+        }
+    bail("unrecognized PAM call %s", name);
+}
+
+
+/*
+ * Given a PAM flag value without the leading PAM_, map it to the numeric
+ * value of that flag.  Fails on any unrecognized string.
+ */
+static int
+string_to_flag(const char *name)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(FLAGS); i++)
+        if (strcmp(name, FLAGS[i].name) == 0)
+            return FLAGS[i].value;
+    bail("unrecognized PAM flag %s", name);
+}
+
+
+/*
+ * Given a PAM group name, map it to the array index for the options array for
+ * that group.  Fails on any unrecognized string.
+ */
+static enum group_type
+string_to_group(const char *name)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(GROUPS); i++)
+        if (strcmp(name, GROUPS[i].name) == 0)
+            return GROUPS[i].group;
+    bail("unrecognized PAM group %s", name);
+}
+
+
+/*
+ * Given a syslog priority name, map it to the numeric value of that priority.
+ * Fails on any unrecognized string.
+ */
+static int
+string_to_priority(const char *name)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(PRIORITIES); i++)
+        if (strcmp(name, PRIORITIES[i].name) == 0)
+            return PRIORITIES[i].priority;
+    bail("unrecognized syslog priority %s", name);
+}
+
+
+/*
+ * Given a PAM return status, map it to the actual expected value.  Fails on
+ * any unrecognized string.
+ */
+static int
+string_to_status(const char *name)
+{
+    size_t i;
+
+    if (name == NULL)
+        bail("no PAM status on line");
+    for (i = 0; i < ARRAY_SIZE(RETURNS); i++)
+        if (strcmp(name, RETURNS[i].name) == 0)
+            return RETURNS[i].status;
+    bail("unrecognized PAM status %s", name);
+}
+
+
+/*
+ * Given a PAM prompt style value without the leading PAM_PROMPT_, map it to
+ * the numeric value of that flag.  Fails on any unrecognized string.
+ */
+static int
+string_to_style(const char *name)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(STYLES); i++)
+        if (strcmp(name, STYLES[i].name) == 0)
+            return STYLES[i].style;
+    bail("unrecognized PAM prompt style %s", name);
+}
+
+
+/*
+ * We found a section delimiter while parsing another section.  Rewind our
+ * input file back before the section delimiter so that we'll read it again.
+ * Takes the length of the line we read, which is used to determine how far to
+ * rewind.
+ */
+static void
+rewind_section(FILE *script, size_t length)
+{
+    if (fseek(script, -length - 1, SEEK_CUR) != 0)
+        sysbail("cannot rewind file");
+}
+
+
+/*
+ * Given a string that may contain %-escapes, expand it into the resulting
+ * value.  The following escapes are supported:
+ *
+ *     %i   current UID (not target user UID)
+ *     %n   new password
+ *     %p   password
+ *     %u   username
+ *     %0   user-supplied string
+ *     ...
+ *     %9   user-supplied string
+ *
+ * The %* escape is preserved as-is, as it has to be interpreted at the time
+ * of checking output.  Returns the expanded string in newly-allocated memory.
+ */
+static char *
+expand_string(const char *template, const struct script_config *config)
+{
+    size_t length = 0;
+    const char *p, *extra;
+    char *output, *out;
+    char *uid = NULL;
+
+    length = 0;
+    for (p = template; *p != '\0'; p++) {
+        if (*p != '%')
+            length++;
+        else {
+            p++;
+            switch (*p) {
+            case 'i':
+                if (uid == NULL)
+                    basprintf(&uid, "%lu", (unsigned long) getuid());
+                length += strlen(uid);
+                break;
+            case 'n':
+                if (config->newpass == NULL)
+                    bail("new password not set");
+                length += strlen(config->newpass);
+                break;
+            case 'p':
+                if (config->password == NULL)
+                    bail("password not set");
+                length += strlen(config->password);
+                break;
+            case 'u':
+                length += strlen(config->user);
+                break;
+            case '0':
+            case '1':
+            case '2':
+            case '3':
+            case '4':
+            case '5':
+            case '6':
+            case '7':
+            case '8':
+            case '9':
+                if (config->extra[*p - '0'] == NULL)
+                    bail("extra script parameter %%%c not set", *p);
+                length += strlen(config->extra[*p - '0']);
+                break;
+            case '*':
+                length += 2;
+                break;
+            default:
+                length++;
+                break;
+            }
+        }
+    }
+    output = bmalloc(length + 1);
+    for (p = template, out = output; *p != '\0'; p++) {
+        if (*p != '%')
+            *out++ = *p;
+        else {
+            p++;
+            switch (*p) {
+            case 'i':
+                assert(uid != NULL);
+                memcpy(out, uid, strlen(uid));
+                out += strlen(uid);
+                break;
+            case 'n':
+                memcpy(out, config->newpass, strlen(config->newpass));
+                out += strlen(config->newpass);
+                break;
+            case 'p':
+                memcpy(out, config->password, strlen(config->password));
+                out += strlen(config->password);
+                break;
+            case 'u':
+                memcpy(out, config->user, strlen(config->user));
+                out += strlen(config->user);
+                break;
+            case '0':
+            case '1':
+            case '2':
+            case '3':
+            case '4':
+            case '5':
+            case '6':
+            case '7':
+            case '8':
+            case '9':
+                extra = config->extra[*p - '0'];
+                memcpy(out, extra, strlen(extra));
+                out += strlen(extra);
+                break;
+            case '*':
+                *out++ = '%';
+                *out++ = '*';
+                break;
+            default:
+                *out++ = *p;
+                break;
+            }
+        }
+    }
+    *out = '\0';
+    free(uid);
+    return output;
+}
+
+
+/*
+ * Given a whitespace-delimited string of PAM options, split it into an argv
+ * array and argc count and store it in the provided option struct.
+ */
+static void
+split_options(char *string, struct options *options,
+              const struct script_config *config)
+{
+    char *opt;
+    size_t size, count;
+
+    for (opt = strtok(string, " "); opt != NULL; opt = strtok(NULL, " ")) {
+        if (options->argv == NULL) {
+            options->argv = bcalloc(2, sizeof(const char *));
+            options->argv[0] = expand_string(opt, config);
+            options->argc = 1;
+        } else {
+            count = (options->argc + 2);
+            size = sizeof(const char *);
+            options->argv = breallocarray(options->argv, count, size);
+            options->argv[options->argc] = expand_string(opt, config);
+            options->argv[options->argc + 1] = NULL;
+            options->argc++;
+        }
+    }
+}
+
+
+/*
+ * Parse the options section of a PAM script.  This consists of one or more
+ * lines in the format:
+ *
+ *     <group> = <options>
+ *
+ * where options are either option names or option=value pairs, where the
+ * value may not contain whitespace.  Returns an options struct, which stores
+ * argc and argv values for each group.
+ *
+ * Takes the work struct as an argument and puts values into its array.
+ */
+static void
+parse_options(FILE *script, struct work *work,
+              const struct script_config *config)
+{
+    char *line, *group, *token;
+    size_t length = 0;
+    enum group_type type;
+
+    for (line = readline(script); line != NULL; line = readline(script)) {
+        length = strlen(line);
+        group = strtok(line, " ");
+        if (group == NULL)
+            bail("malformed script line");
+        if (group[0] == '[')
+            break;
+        type = string_to_group(group);
+        token = strtok(NULL, " ");
+        if (token == NULL)
+            bail("malformed action line");
+        if (strcmp(token, "=") != 0)
+            bail("malformed action line near %s", token);
+        token = strtok(NULL, "");
+        split_options(token, &work->options[type], config);
+        free(line);
+    }
+    if (line != NULL) {
+        free(line);
+        rewind_section(script, length);
+    }
+}
+
+
+/*
+ * Parse the call portion of a PAM call in the run section of a PAM script.
+ * This handles parsing the PAM flags that optionally may be given as part of
+ * the call.  Takes the token representing the call and a pointer to the
+ * action struct to fill in with the call and the option flags.
+ */
+static void
+parse_call(char *token, struct action *action)
+{
+    char *flags, *flag;
+
+    action->flags = 0;
+    flags = strchr(token, '(');
+    if (flags != NULL) {
+        *flags = '\0';
+        flags++;
+        for (flag = strtok(flags, "|,)"); flag != NULL;
+             flag = strtok(NULL, "|,)")) {
+            action->flags |= string_to_flag(flag);
+        }
+    }
+    action->call = string_to_call(token, &action->group);
+}
+
+
+/*
+ * Parse the run section of a PAM script.  This consists of one or more lines
+ * in the format:
+ *
+ *     <call> = <status>
+ *
+ * where <call> is a PAM call and <status> is what it should return.  Returns
+ * a linked list of actions.  Fails on any error in parsing.
+ */
+static struct action *
+parse_run(FILE *script)
+{
+    struct action *head = NULL, *current = NULL, *next;
+    char *line, *token, *call;
+    size_t length = 0;
+
+    for (line = readline(script); line != NULL; line = readline(script)) {
+        length = strlen(line);
+        token = strtok(line, " ");
+        if (token[0] == '[')
+            break;
+        next = bmalloc(sizeof(struct action));
+        next->next = NULL;
+        if (head == NULL)
+            head = next;
+        else
+            current->next = next;
+        next->name = bstrdup(token);
+        call = token;
+        token = strtok(NULL, " ");
+        if (token == NULL)
+            bail("malformed action line");
+        if (strcmp(token, "=") != 0)
+            bail("malformed action line near %s", token);
+        token = strtok(NULL, " ");
+        next->status = string_to_status(token);
+        parse_call(call, next);
+        free(line);
+        current = next;
+    }
+    if (head == NULL)
+        bail("empty run section in script");
+    if (line != NULL) {
+        free(line);
+        rewind_section(script, length);
+    }
+    return head;
+}
+
+
+/*
+ * Parse the end section of a PAM script.  There is one supported line in the
+ * format:
+ *
+ *     flags = <flag>|<flag>
+ *
+ * where <flag> is a flag to pass to pam_end.  Returns the flags.
+ */
+static int
+parse_end(FILE *script)
+{
+    char *line, *token, *flag;
+    size_t length = 0;
+    int flags = PAM_SUCCESS;
+
+    for (line = readline(script); line != NULL; line = readline(script)) {
+        length = strlen(line);
+        token = strtok(line, " ");
+        if (token[0] == '[')
+            break;
+        if (strcmp(token, "flags") != 0)
+            bail("unknown end setting %s", token);
+        token = strtok(NULL, " ");
+        if (token == NULL)
+            bail("malformed end line");
+        if (strcmp(token, "=") != 0)
+            bail("malformed end line near %s", token);
+        token = strtok(NULL, " ");
+        flag = strtok(token, "|");
+        while (flag != NULL) {
+            flags |= string_to_status(flag);
+            flag = strtok(NULL, "|");
+        }
+        free(line);
+    }
+    if (line != NULL) {
+        free(line);
+        rewind_section(script, length);
+    }
+    return flags;
+}
+
+
+/*
+ * Parse the output section of a PAM script.  This consists of zero or more
+ * lines in the format:
+ *
+ *     PRIORITY some output information
+ *     PRIORITY /output regex/
+ *
+ * where PRIORITY is replaced by the numeric syslog priority corresponding to
+ * that priority and the rest of the output undergoes %-esacape expansion.
+ * Returns the accumulated output as a vector.
+ */
+static struct output *
+parse_output(FILE *script, const struct script_config *config)
+{
+    char *line, *token, *message;
+    struct output *output;
+    int priority;
+
+    output = output_new();
+    if (output == NULL)
+        sysbail("cannot allocate vector");
+    for (line = readline(script); line != NULL; line = readline(script)) {
+        token = strtok(line, " ");
+        priority = string_to_priority(token);
+        token = strtok(NULL, "");
+        if (token == NULL)
+            bail("malformed line %s", line);
+        message = expand_string(token, config);
+        output_add(output, priority, message);
+        free(message);
+        free(line);
+    }
+    return output;
+}
+
+
+/*
+ * Parse the prompts section of a PAM script.  This consists of zero or more
+ * lines in one of the formats:
+ *
+ *     type = prompt
+ *     type = /prompt/
+ *     type = prompt|response
+ *     type = /prompt/|response
+ *
+ * If the type is error_msg or info, there is no response.  Otherwise,
+ * everything after the last | is taken to be the response that should be
+ * provided to that prompt.  The response undergoes %-escape expansion.
+ */
+static struct prompts *
+parse_prompts(FILE *script, const struct script_config *config)
+{
+    struct prompts *prompts = NULL;
+    struct prompt *prompt;
+    char *line, *token, *style, *end;
+    size_t size, count, i;
+    size_t length = 0;
+
+    for (line = readline(script); line != NULL; line = readline(script)) {
+        length = strlen(line);
+        token = strtok(line, " ");
+        if (token[0] == '[')
+            break;
+        if (prompts == NULL) {
+            prompts = bcalloc(1, sizeof(struct prompts));
+            prompts->prompts = bcalloc(1, sizeof(struct prompt));
+            prompts->allocated = 1;
+        } else if (prompts->allocated == prompts->size) {
+            count = prompts->allocated * 2;
+            size = sizeof(struct prompt);
+            prompts->prompts = breallocarray(prompts->prompts, count, size);
+            prompts->allocated = count;
+            for (i = prompts->size; i < prompts->allocated; i++) {
+                prompts->prompts[i].prompt = NULL;
+                prompts->prompts[i].response = NULL;
+            }
+        }
+        prompt = &prompts->prompts[prompts->size];
+        style = token;
+        token = strtok(NULL, " ");
+        if (token == NULL)
+            bail("malformed prompt line");
+        if (strcmp(token, "=") != 0)
+            bail("malformed prompt line near %s", token);
+        prompt->style = string_to_style(style);
+        token = strtok(NULL, "");
+        if (prompt->style == PAM_ERROR_MSG || prompt->style == PAM_TEXT_INFO)
+            prompt->prompt = expand_string(token, config);
+        else {
+            end = strrchr(token, '|');
+            if (end == NULL)
+                bail("malformed prompt line near %s", token);
+            *end = '\0';
+            prompt->prompt = expand_string(token, config);
+            token = end + 1;
+            prompt->response = expand_string(token, config);
+        }
+        prompts->size++;
+        free(line);
+    }
+    if (line != NULL) {
+        free(line);
+        rewind_section(script, length);
+    }
+    return prompts;
+}
+
+
+/*
+ * Parse a PAM interaction script.  This handles parsing of the top-level
+ * section markers and dispatches the parsing to other functions.  Returns the
+ * total work to do as a work struct.
+ */
+struct work *
+parse_script(FILE *script, const struct script_config *config)
+{
+    struct work *work;
+    char *line, *token;
+
+    work = bmalloc(sizeof(struct work));
+    memset(work, 0, sizeof(struct work));
+    work->end_flags = PAM_SUCCESS;
+    for (line = readline(script); line != NULL; line = readline(script)) {
+        token = strtok(line, " ");
+        if (token[0] != '[')
+            bail("line outside of section: %s", line);
+        if (strcmp(token, "[options]") == 0)
+            parse_options(script, work, config);
+        else if (strcmp(token, "[run]") == 0)
+            work->actions = parse_run(script);
+        else if (strcmp(token, "[end]") == 0)
+            work->end_flags = parse_end(script);
+        else if (strcmp(token, "[output]") == 0)
+            work->output = parse_output(script, config);
+        else if (strcmp(token, "[prompts]") == 0)
+            work->prompts = parse_prompts(script, config);
+        else
+            bail("unknown section: %s", token);
+        free(line);
+    }
+    if (work->actions == NULL)
+        bail("no run section defined");
+    return work;
+}
diff --git a/tests/fakepam/data.c b/tests/fakepam/data.c
new file mode 100644
index 000000000000..0650d59e9b75
--- /dev/null
+++ b/tests/fakepam/data.c
@@ -0,0 +1,356 @@
+/*
+ * Data manipulation functions for the fake PAM library, used for testing.
+ *
+ * This file contains the implementation of pam_get_* and pam_set_* for the
+ * various data items supported by the PAM library, plus the PAM environment
+ * manipulation functions.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/pam.h>
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+
+/*
+ * Return a stored PAM data element in the provided data variable.  As a
+ * special case, if the data is NULL, pretend it doesn't exist.
+ */
+int
+pam_get_data(const pam_handle_t *pamh, const char *name, const void **data)
+{
+    struct fakepam_data *item;
+
+    for (item = pamh->data; item != NULL; item = item->next)
+        if (strcmp(item->name, name) == 0) {
+            if (item->data == NULL)
+                return PAM_NO_MODULE_DATA;
+            *data = item->data;
+            return PAM_SUCCESS;
+        }
+    return PAM_NO_MODULE_DATA;
+}
+
+
+/*
+ * Store a data item.  Replaces the existing data item (calling its cleanup)
+ * if it is already set; otherwise, add a new data item.
+ */
+int
+pam_set_data(pam_handle_t *pamh, const char *item, void *data,
+             void (*cleanup)(pam_handle_t *, void *, int))
+{
+    struct fakepam_data *p;
+
+    for (p = pamh->data; p != NULL; p = p->next)
+        if (strcmp(p->name, item) == 0) {
+            if (p->cleanup != NULL)
+                p->cleanup(pamh, p->data, PAM_DATA_REPLACE);
+            p->data = data;
+            p->cleanup = cleanup;
+            return PAM_SUCCESS;
+        }
+    p = malloc(sizeof(struct fakepam_data));
+    if (p == NULL)
+        return PAM_BUF_ERR;
+    p->name = strdup(item);
+    if (p->name == NULL) {
+        free(p);
+        return PAM_BUF_ERR;
+    }
+    p->data = data;
+    p->cleanup = cleanup;
+    p->next = pamh->data;
+    pamh->data = p;
+    return PAM_SUCCESS;
+}
+
+
+/*
+ * Retrieve a PAM item.  Currently, this only supports a limited subset of the
+ * possible items.
+ */
+int
+pam_get_item(const pam_handle_t *pamh, int item, PAM_CONST void **data)
+{
+    switch (item) {
+    case PAM_AUTHTOK:
+        *data = pamh->authtok;
+        return PAM_SUCCESS;
+    case PAM_CONV:
+        if (pamh->conversation) {
+            *data = pamh->conversation;
+            return PAM_SUCCESS;
+        } else {
+            return PAM_BAD_ITEM;
+        }
+    case PAM_OLDAUTHTOK:
+        *data = pamh->oldauthtok;
+        return PAM_SUCCESS;
+    case PAM_RHOST:
+        *data = (PAM_CONST char *) pamh->rhost;
+        return PAM_SUCCESS;
+    case PAM_RUSER:
+        *data = (PAM_CONST char *) pamh->ruser;
+        return PAM_SUCCESS;
+    case PAM_SERVICE:
+        *data = (PAM_CONST char *) pamh->service;
+        return PAM_SUCCESS;
+    case PAM_TTY:
+        *data = (PAM_CONST char *) pamh->tty;
+        return PAM_SUCCESS;
+    case PAM_USER:
+        *data = (PAM_CONST char *) pamh->user;
+        return PAM_SUCCESS;
+    case PAM_USER_PROMPT:
+        *data = "login: ";
+        return PAM_SUCCESS;
+    default:
+        return PAM_BAD_ITEM;
+    }
+}
+
+
+/*
+ * Set a PAM item.  Currently only PAM_USER is supported.
+ */
+int
+pam_set_item(pam_handle_t *pamh, int item, PAM_CONST void *data)
+{
+    switch (item) {
+    case PAM_AUTHTOK:
+        free(pamh->authtok);
+        pamh->authtok = strdup(data);
+        if (pamh->authtok == NULL)
+            return PAM_BUF_ERR;
+        return PAM_SUCCESS;
+    case PAM_OLDAUTHTOK:
+        free(pamh->oldauthtok);
+        pamh->oldauthtok = strdup(data);
+        if (pamh->oldauthtok == NULL)
+            return PAM_BUF_ERR;
+        return PAM_SUCCESS;
+    case PAM_RHOST:
+        free(pamh->rhost);
+        pamh->rhost = strdup(data);
+        if (pamh->rhost == NULL)
+            return PAM_BUF_ERR;
+        return PAM_SUCCESS;
+    case PAM_RUSER:
+        free(pamh->ruser);
+        pamh->ruser = strdup(data);
+        if (pamh->ruser == NULL)
+            return PAM_BUF_ERR;
+        return PAM_SUCCESS;
+    case PAM_TTY:
+        free(pamh->tty);
+        pamh->tty = strdup(data);
+        if (pamh->tty == NULL)
+            return PAM_BUF_ERR;
+        return PAM_SUCCESS;
+    case PAM_USER:
+        pamh->user = (const char *) data;
+        return PAM_SUCCESS;
+    default:
+        return PAM_BAD_ITEM;
+    }
+}
+
+
+/*
+ * Return the user for the PAM context.
+ */
+int
+pam_get_user(pam_handle_t *pamh, PAM_CONST char **user,
+             const char *prompt UNUSED)
+{
+    if (pamh->user == NULL)
+        return PAM_CONV_ERR;
+    else {
+        *user = (PAM_CONST char *) pamh->user;
+        return PAM_SUCCESS;
+    }
+}
+
+
+/*
+ * Return a setting in the PAM environment.
+ */
+PAM_CONST char *
+pam_getenv(pam_handle_t *pamh, const char *name)
+{
+    size_t i;
+
+    if (pamh->environ == NULL)
+        return NULL;
+    for (i = 0; pamh->environ[i] != NULL; i++)
+        if (strncmp(name, pamh->environ[i], strlen(name)) == 0
+            && pamh->environ[i][strlen(name)] == '=')
+            return pamh->environ[i] + strlen(name) + 1;
+    return NULL;
+}
+
+
+/*
+ * Return a newly malloc'd copy of the complete PAM environment.  This must be
+ * freed by the caller.
+ */
+char **
+pam_getenvlist(pam_handle_t *pamh)
+{
+    char **env;
+    size_t i;
+
+    if (pamh->environ == NULL) {
+        pamh->environ = malloc(sizeof(char *));
+        if (pamh->environ == NULL)
+            return NULL;
+        pamh->environ[0] = NULL;
+    }
+    for (i = 0; pamh->environ[i] != NULL; i++)
+        ;
+    env = calloc(i + 1, sizeof(char *));
+    if (env == NULL)
+        return NULL;
+    for (i = 0; pamh->environ[i] != NULL; i++) {
+        env[i] = strdup(pamh->environ[i]);
+        if (env[i] == NULL)
+            goto fail;
+    }
+    env[i] = NULL;
+    return env;
+
+fail:
+    for (i = 0; env[i] != NULL; i++)
+        free(env[i]);
+    free(env);
+    return NULL;
+}
+
+
+/*
+ * Add a setting to the PAM environment.  If there is another existing
+ * variable with the same value, the value is replaced, unless the setting
+ * doesn't end in an equal sign.  If it doesn't end in an equal sign, any
+ * existing environment variable of that name is removed.  This follows the
+ * Linux PAM semantics.
+ *
+ * On HP-UX, there is no separate PAM environment, so the module just uses the
+ * main environment.  For our tests to work on that platform, we therefore
+ * have to do the same thing.
+ */
+#ifdef HAVE_PAM_GETENV
+int
+pam_putenv(pam_handle_t *pamh, const char *setting)
+{
+    char *copy = NULL;
+    const char *equals;
+    size_t namelen;
+    bool delete = false;
+    bool found = false;
+    size_t i, j;
+    char **env;
+
+    equals = strchr(setting, '=');
+    if (equals != NULL)
+        namelen = equals - setting;
+    else {
+        delete = true;
+        namelen = strlen(setting);
+    }
+    if (!delete) {
+        copy = strdup(setting);
+        if (copy == NULL)
+            return PAM_BUF_ERR;
+    }
+
+    /* Handle the first call to pam_putenv. */
+    if (pamh->environ == NULL) {
+        if (delete)
+            return PAM_BAD_ITEM;
+        pamh->environ = calloc(2, sizeof(char *));
+        if (pamh->environ == NULL) {
+            free(copy);
+            return PAM_BUF_ERR;
+        }
+        pamh->environ[0] = copy;
+        pamh->environ[1] = NULL;
+        return PAM_SUCCESS;
+    }
+
+    /*
+     * We have an existing array.  See if we're replacing a value, deleting a
+     * value, or adding a new one.  When deleting, waste a bit of memory but
+     * save some time by not bothering to reduce the size of the array.
+     */
+    for (i = 0; pamh->environ[i] != NULL; i++)
+        if (strncmp(setting, pamh->environ[i], namelen) == 0
+            && pamh->environ[i][namelen] == '=') {
+            if (delete) {
+                free(pamh->environ[i]);
+                for (j = i + 1; pamh->environ[j] != NULL; i++, j++)
+                    pamh->environ[i] = pamh->environ[j];
+                pamh->environ[i] = NULL;
+            } else {
+                free(pamh->environ[i]);
+                pamh->environ[i] = copy;
+            }
+            found = true;
+            break;
+        }
+    if (!found) {
+        if (delete)
+            return PAM_BAD_ITEM;
+        env = reallocarray(pamh->environ, (i + 2), sizeof(char *));
+        if (env == NULL) {
+            free(copy);
+            return PAM_BUF_ERR;
+        }
+        pamh->environ = env;
+        pamh->environ[i] = copy;
+        pamh->environ[i + 1] = NULL;
+    }
+    return PAM_SUCCESS;
+}
+
+#else /* !HAVE_PAM_GETENV */
+
+int
+pam_putenv(pam_handle_t *pamh UNUSED, const char *setting)
+{
+    return putenv((char *) setting);
+}
+
+#endif /* !HAVE_PAM_GETENV */
diff --git a/tests/fakepam/general.c b/tests/fakepam/general.c
new file mode 100644
index 000000000000..0f11bb2f7995
--- /dev/null
+++ b/tests/fakepam/general.c
@@ -0,0 +1,151 @@
+/*
+ * Interface for fake PAM library, used for testing.
+ *
+ * This contains the basic public interfaces for the fake PAM library, used
+ * for testing, and some general utility functions.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <errno.h>
+#include <pwd.h>
+
+#include <tests/fakepam/pam.h>
+
+/* Stores the static struct passwd returned by getpwnam if the name matches. */
+static struct passwd *pwd_info = NULL;
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+
+/*
+ * Initializes the pam_handle_t data structure.  This function is only called
+ * from test programs, not from any of the module code.  We can put anything
+ * we want in this structure, since it's opaque to the regular code.
+ */
+int
+pam_start(const char *service_name, const char *user,
+          const struct pam_conv *pam_conversation, pam_handle_t **pamh)
+{
+    struct pam_handle *handle;
+
+    handle = calloc(1, sizeof(struct pam_handle));
+    if (handle == NULL)
+        return PAM_BUF_ERR;
+    handle->service = service_name;
+    handle->user = user;
+    handle->conversation = pam_conversation;
+    *pamh = handle;
+    return PAM_SUCCESS;
+}
+
+
+/*
+ * Free the pam_handle_t data structure and related resources.  This is
+ * important to test the data cleanups.  Freeing the memory is not strictly
+ * required since it's only used for testing, but it helps keep our memory
+ * usage clean so that we can run the test suite under valgrind.
+ */
+int
+pam_end(pam_handle_t *pamh, int status)
+{
+    struct fakepam_data *item, *next;
+    size_t i;
+
+    if (pamh->environ != NULL) {
+        for (i = 0; pamh->environ[i] != NULL; i++)
+            free(pamh->environ[i]);
+        free(pamh->environ);
+    }
+    free(pamh->authtok);
+    free(pamh->oldauthtok);
+    free(pamh->rhost);
+    free(pamh->ruser);
+    free(pamh->tty);
+    for (item = pamh->data; item != NULL;) {
+        if (item->cleanup != NULL)
+            item->cleanup(pamh, item->data, status);
+        free(item->name);
+        next = item->next;
+        free(item);
+        item = next;
+    }
+    free(pamh);
+    return PAM_SUCCESS;
+}
+
+
+/*
+ * Interface specific to this fake PAM library to set the struct passwd that's
+ * returned by getpwnam queries if the name matches.
+ */
+void
+pam_set_pwd(struct passwd *pwd)
+{
+    pwd_info = pwd;
+}
+
+
+/*
+ * For testing purposes, we want to be able to intercept getpwnam.  This is
+ * fairly easy on platforms that have pam_modutil_getpwnam, since then our
+ * code will always call that function and we can provide an implementation
+ * that does whatever we want.  For platforms that don't have that function,
+ * we'll try to intercept the C library getpwnam function.
+ *
+ * We store only one struct passwd data structure statically.  If the user
+ * we're looking up matches that, we return it; otherwise, we return NULL.
+ */
+#ifdef HAVE_PAM_MODUTIL_GETPWNAM
+struct passwd *
+pam_modutil_getpwnam(pam_handle_t *pamh UNUSED, const char *name)
+{
+    if (pwd_info != NULL && strcmp(pwd_info->pw_name, name) == 0)
+        return pwd_info;
+    else {
+        errno = 0;
+        return NULL;
+    }
+}
+#else
+struct passwd *
+getpwnam(const char *name)
+{
+    if (pwd_info != NULL && strcmp(pwd_info->pw_name, name) == 0)
+        return pwd_info;
+    else {
+        errno = 0;
+        return NULL;
+    }
+}
+#endif
diff --git a/tests/fakepam/internal.h b/tests/fakepam/internal.h
new file mode 100644
index 000000000000..3c6fedacd45e
--- /dev/null
+++ b/tests/fakepam/internal.h
@@ -0,0 +1,119 @@
+/*
+ * Internal data types and prototypes for the fake PAM test framework.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2021 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef FAKEPAM_INTERNAL_H
+#define FAKEPAM_INTERNAL_H 1
+
+#include <portable/pam.h>
+#include <sys/types.h>
+
+/* Forward declarations to avoid unnecessary includes. */
+struct output;
+struct script_config;
+
+/* The type of a PAM module call. */
+typedef int (*pam_call)(pam_handle_t *, int, int, const char **);
+
+/* The possible PAM groups as element numbers in an array of options. */
+enum group_type
+{
+    GROUP_ACCOUNT = 0,
+    GROUP_AUTH = 1,
+    GROUP_PASSWORD = 2,
+    GROUP_SESSION = 3,
+};
+
+/* Holds a PAM argc and argv. */
+struct options {
+    char **argv;
+    int argc;
+};
+
+/*
+ * Holds a linked list of actions: a PAM call that should return some
+ * status.
+ */
+struct action {
+    char *name;
+    pam_call call;
+    int flags;
+    enum group_type group;
+    int status;
+    struct action *next;
+};
+
+/* Holds an expected PAM prompt style, the prompt, and the response. */
+struct prompt {
+    int style;
+    char *prompt;
+    char *response;
+};
+
+/* Holds an array of PAM prompts and the current index into that array. */
+struct prompts {
+    struct prompt *prompts;
+    size_t size;
+    size_t allocated;
+    size_t current;
+};
+
+/*
+ * Holds the complete set of things that we should do, configuration for them,
+ * and expected output and return values.
+ */
+struct work {
+    struct options options[4];
+    struct action *actions;
+    struct prompts *prompts;
+    struct output *output;
+    int end_flags;
+};
+
+BEGIN_DECLS
+
+
+/* Create a new output struct. */
+struct output *output_new(void);
+
+/* Add a new output line (with numeric priority) to an output struct. */
+void output_add(struct output *, int, const char *);
+
+
+/*
+ * Parse a PAM interaction script.  Returns the total work to do as a work
+ * struct.
+ */
+struct work *parse_script(FILE *, const struct script_config *);
+
+END_DECLS
+
+#endif /* !FAKEPAM_API_H */
diff --git a/tests/fakepam/kuserok.c b/tests/fakepam/kuserok.c
new file mode 100644
index 000000000000..d66bc1d03acc
--- /dev/null
+++ b/tests/fakepam/kuserok.c
@@ -0,0 +1,119 @@
+/*
+ * Replacement for krb5_kuserok for testing.
+ *
+ * This is a reimplementation of krb5_kuserok that uses the replacement
+ * getpwnam function and the special passwd struct internal to the fake PAM
+ * module to locate .k5login.  The default Kerberos krb5_kuserok always calls
+ * the system getpwnam, which we may not be able to intercept, and will
+ * therefore fail because it can't locate the .k5login file for the test user
+ * (or succeed oddly because it finds some random file on the testing system).
+ *
+ * This implementation is drastically simplified from the Kerberos library
+ * version, and much less secure (which shouldn't matter since it's only
+ * acting on test data).
+ *
+ * This is an optional part of the fake PAM library and can be omitted when
+ * testing modules that don't use Kerberos.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <pwd.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/tap/string.h>
+
+
+/*
+ * Given a Kerberos principal representing the authenticated identity and the
+ * username of the local account, return true if that principal is authorized
+ * to log on to that account.  The principal is authorized if the .k5login
+ * file does not exist and the user matches the localname form of the
+ * principal, or if the file does exist and the principal is listed in it.
+ *
+ * This version retrieves the home directory from the internal fake PAM
+ * library path.
+ */
+krb5_boolean
+krb5_kuserok(krb5_context ctx, krb5_principal princ, const char *user)
+{
+    char *principal, *path;
+    struct passwd *pwd;
+    FILE *file;
+    krb5_error_code code;
+    char buffer[BUFSIZ];
+    bool found = false;
+#ifdef HAVE_PAM_MODUTIL_GETPWNAM
+    struct pam_handle pamh;
+#endif
+
+    /*
+     * Find .k5login and confirm if it exists.  If it doesn't, fall back on
+     * krb5_aname_to_localname.
+     */
+#ifdef HAVE_PAM_MODUTIL_GETPWNAM
+    memset(&pamh, 0, sizeof(pamh));
+    pwd = pam_modutil_getpwnam(&pamh, user);
+#else
+    pwd = getpwnam(user);
+#endif
+    if (pwd == NULL)
+        return false;
+    basprintf(&path, "%s/.k5login", pwd->pw_dir);
+    if (access(path, R_OK) < 0) {
+        free(path);
+        code = krb5_aname_to_localname(ctx, princ, sizeof(buffer), buffer);
+        return (code == 0 && strcmp(buffer, user) == 0);
+    }
+    file = fopen(path, "r");
+    if (file == NULL) {
+        free(path);
+        return false;
+    }
+    free(path);
+
+    /* .k5login exists.  Scan it for the principal. */
+    if (krb5_unparse_name(ctx, princ, &principal) != 0) {
+        fclose(file);
+        return false;
+    }
+    while (!found && (fgets(buffer, sizeof(buffer), file) != NULL)) {
+        if (buffer[strlen(buffer) - 1] == '\n')
+            buffer[strlen(buffer) - 1] = '\0';
+        if (strcmp(buffer, principal) == 0)
+            found = true;
+    }
+    fclose(file);
+    krb5_free_unparsed_name(ctx, principal);
+    return found;
+}
diff --git a/tests/fakepam/logging.c b/tests/fakepam/logging.c
new file mode 100644
index 000000000000..c3a3fa044576
--- /dev/null
+++ b/tests/fakepam/logging.c
@@ -0,0 +1,183 @@
+/*
+ * Logging functions for the fake PAM library, used for testing.
+ *
+ * This file contains the implementation of pam_syslog and pam_vsyslog, which
+ * log to an internal buffer rather than to syslog, and the testing function
+ * used to recover that buffer.  It also includes the pam_strerror
+ * implementation.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/internal.h>
+#include <tests/fakepam/pam.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+/* The struct used to accumulate log messages. */
+static struct output *messages = NULL;
+
+
+/*
+ * Allocate a new, empty output struct and call bail if memory allocation
+ * fails.
+ */
+struct output *
+output_new(void)
+{
+    struct output *output;
+
+    output = bmalloc(sizeof(struct output));
+    output->count = 0;
+    output->allocated = 1;
+    output->lines = bmalloc(sizeof(output->lines[0]));
+    output->lines[0].line = NULL;
+    return output;
+}
+
+
+/*
+ * Add a new output line to the output struct, resizing the array as
+ * necessary.  Calls bail if memory allocation fails.
+ */
+void
+output_add(struct output *output, int priority, const char *string)
+{
+    size_t next = output->count;
+    size_t size, n;
+
+    if (output->count == output->allocated) {
+        n = output->allocated + 1;
+        size = sizeof(output->lines[0]);
+        output->lines = breallocarray(output->lines, n, size);
+        output->allocated = n;
+    }
+    output->lines[next].priority = priority;
+    output->lines[next].line = bstrdup(string);
+    output->count++;
+}
+
+
+/*
+ * Return the error string associated with the PAM error code.  We do this as
+ * a giant case statement so that we don't assume anything about the error
+ * codes used by the system PAM library.
+ */
+const char *
+pam_strerror(PAM_STRERROR_CONST pam_handle_t *pamh UNUSED, int code)
+{
+    /* clang-format off */
+    switch (code) {
+    case PAM_SUCCESS:     return "No error";
+    case PAM_OPEN_ERR:    return "Failure loading service module";
+    case PAM_SYMBOL_ERR:  return "Symbol not found";
+    case PAM_SERVICE_ERR: return "Error in service module";
+    case PAM_SYSTEM_ERR:  return "System error";
+    case PAM_BUF_ERR:     return "Memory buffer error";
+    default:              return "Unknown error";
+    }
+    /* clang-format on */
+}
+
+
+/*
+ * Log a message using variadic arguments.  Just a wrapper around
+ * pam_vsyslog.
+ */
+void
+pam_syslog(const pam_handle_t *pamh, int priority, const char *format, ...)
+{
+    va_list args;
+
+    va_start(args, format);
+    pam_vsyslog(pamh, priority, format, args);
+    va_end(args);
+}
+
+
+/*
+ * Log a PAM error message with a given priority.  Just appends the priority,
+ * a space, and the error message, followed by a newline, to the internal
+ * buffer, allocating new space if needed.  Ignore memory allocation failures;
+ * we have no way of reporting them, but the tests will fail due to missing
+ * output.
+ */
+void
+pam_vsyslog(const pam_handle_t *pamh UNUSED, int priority, const char *format,
+            va_list args)
+{
+    char *message = NULL;
+
+    bvasprintf(&message, format, args);
+    if (messages == NULL)
+        messages = output_new();
+    output_add(messages, priority, message);
+    free(message);
+}
+
+
+/*
+ * Used by test code.  Returns the accumulated messages in an output struct
+ * and starts a new one.  Caller is responsible for freeing with
+ * pam_output_free.
+ */
+struct output *
+pam_output(void)
+{
+    struct output *output;
+
+    output = messages;
+    messages = NULL;
+    return output;
+}
+
+
+/*
+ * Free an output struct.
+ */
+void
+pam_output_free(struct output *output)
+{
+    size_t i;
+
+    if (output == NULL)
+        return;
+    for (i = 0; i < output->count; i++)
+        if (output->lines[i].line != NULL)
+            free(output->lines[i].line);
+    free(output->lines);
+    free(output);
+}
diff --git a/tests/fakepam/pam.h b/tests/fakepam/pam.h
new file mode 100644
index 000000000000..41f508e0f31f
--- /dev/null
+++ b/tests/fakepam/pam.h
@@ -0,0 +1,101 @@
+/*
+ * Testing interfaces to the fake PAM library.
+ *
+ * This header defines the interfaces to the fake PAM library that are used by
+ * test code to initialize the library and recover test data from it.  We
+ * don't define any interface that we're going to duplicate from the main PAM
+ * API.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef FAKEPAM_PAM_H
+#define FAKEPAM_PAM_H 1
+
+#include <config.h>
+#include <portable/macros.h>
+#include <portable/pam.h>
+
+/* Used inside the fake PAM library to hold data items. */
+struct fakepam_data {
+    char *name;
+    void *data;
+    void (*cleanup)(pam_handle_t *, void *, int);
+    struct fakepam_data *next;
+};
+
+/* This is an opaque data structure, so we can put whatever we want in it. */
+struct pam_handle {
+    const char *service;
+    const char *user;
+    char *authtok;
+    char *oldauthtok;
+    char *rhost;
+    char *ruser;
+    char *tty;
+    const struct pam_conv *conversation;
+    char **environ;
+    struct fakepam_data *data;
+    struct passwd *pwd;
+};
+
+/*
+ * Used to accumulate output from the PAM module.  Each call to a logging
+ * function will result in an additional line added to the array, and count
+ * will hold the total.
+ */
+struct output {
+    size_t count;
+    size_t allocated;
+    struct {
+        int priority;
+        char *line;
+    } * lines;
+};
+
+BEGIN_DECLS
+
+/*
+ * Sets the struct passwd returned by getpwnam calls.  The last struct passed
+ * to this function will be returned provided the pw_name matches.
+ */
+void pam_set_pwd(struct passwd *pwd);
+
+/*
+ * Returns the accumulated messages logged with pam_syslog or pam_vsyslog
+ * since the last call to pam_output and then clears the output.  Returns
+ * newly allocated memory that the caller is responsible for freeing with
+ * pam_output_free, or NULL if no output has been logged since the last call
+ * or since startup.
+ */
+struct output *pam_output(void);
+void pam_output_free(struct output *);
+
+END_DECLS
+
+#endif /* !FAKEPAM_API_H */
diff --git a/tests/fakepam/script.c b/tests/fakepam/script.c
new file mode 100644
index 000000000000..6f3812577960
--- /dev/null
+++ b/tests/fakepam/script.c
@@ -0,0 +1,411 @@
+/*
+ * Run a PAM interaction script for testing.
+ *
+ * Provides an interface that loads a PAM interaction script from a file and
+ * runs through that script, calling the internal PAM module functions and
+ * checking their results.  This allows automation of PAM testing through
+ * external data files instead of coding everything in C.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2016, 2018, 2020-2021 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <ctype.h>
+#include <dirent.h>
+#include <errno.h>
+#ifdef HAVE_REGCOMP
+#    include <regex.h>
+#endif
+#include <syslog.h>
+
+#include <tests/fakepam/internal.h>
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/macros.h>
+#include <tests/tap/string.h>
+
+
+/*
+ * Compare a regex to a string.  If regular expression support isn't
+ * available, we skip this test.
+ */
+#ifdef HAVE_REGCOMP
+static void __attribute__((__format__(printf, 3, 4)))
+like(const char *wanted, const char *seen, const char *format, ...)
+{
+    va_list args;
+    regex_t regex;
+    char err[BUFSIZ];
+    int status;
+
+    if (seen == NULL) {
+        fflush(stderr);
+        printf("# wanted: /%s/\n#   seen: (null)\n", wanted);
+        va_start(args, format);
+        okv(0, format, args);
+        va_end(args);
+        return;
+    }
+    memset(&regex, 0, sizeof(regex));
+    status = regcomp(&regex, wanted, REG_EXTENDED | REG_NOSUB);
+    if (status != 0) {
+        regerror(status, &regex, err, sizeof(err));
+        bail("invalid regex /%s/: %s", wanted, err);
+    }
+    status = regexec(&regex, seen, 0, NULL, 0);
+    switch (status) {
+    case 0:
+        va_start(args, format);
+        okv(1, format, args);
+        va_end(args);
+        break;
+    case REG_NOMATCH:
+        printf("# wanted: /%s/\n#   seen: %s\n", wanted, seen);
+        va_start(args, format);
+        okv(0, format, args);
+        va_end(args);
+        break;
+    default:
+        regerror(status, &regex, err, sizeof(err));
+        bail("regexec failed for regex /%s/: %s", wanted, err);
+    }
+    regfree(&regex);
+}
+#else  /* !HAVE_REGCOMP */
+static void
+like(const char *wanted, const char *seen, const char *format UNUSED, ...)
+{
+    diag("wanted /%s/", wanted);
+    diag("  seen %s", seen);
+    skip("regex support not available");
+}
+#endif /* !HAVE_REGCOMP */
+
+
+/*
+ * Compare an expected string with a seen string, used by both output checking
+ * and prompt checking.  This is a separate function because the expected
+ * string may be a regex, determined by seeing if it starts and ends with a
+ * slash (/), which may require a regex comparison.
+ *
+ * Eventually calls either is_string or ok to report results via TAP.
+ */
+static void __attribute__((__format__(printf, 3, 4)))
+compare_string(char *wanted, char *seen, const char *format, ...)
+{
+    va_list args;
+    char *comment, *regex;
+    size_t length;
+
+    /* Format the comment since we need it regardless. */
+    va_start(args, format);
+    bvasprintf(&comment, format, args);
+    va_end(args);
+
+    /* Check whether the wanted string is a regex. */
+    length = strlen(wanted);
+    if (wanted[0] == '/' && wanted[length - 1] == '/') {
+        regex = bstrndup(wanted + 1, length - 2);
+        like(regex, seen, "%s", comment);
+        free(regex);
+    } else {
+        is_string(wanted, seen, "%s", comment);
+    }
+    free(comment);
+}
+
+
+/*
+ * The PAM conversation function.  Takes the prompts struct from the
+ * configuration and interacts appropriately.  If a prompt is of the expected
+ * type but not the expected string, it still responds; if it's not of the
+ * expected type, it returns PAM_CONV_ERR.
+ *
+ * Currently only handles a single prompt at a time.
+ */
+static int
+converse(int num_msg, const struct pam_message **msg,
+         struct pam_response **resp, void *appdata_ptr)
+{
+    struct prompts *prompts = appdata_ptr;
+    struct prompt *prompt;
+    char *message;
+    size_t length;
+    int i;
+
+    *resp = bcalloc(num_msg, sizeof(struct pam_response));
+    for (i = 0; i < num_msg; i++) {
+        message = bstrdup(msg[i]->msg);
+
+        /* Remove newlines for comparison purposes. */
+        length = strlen(message);
+        while (length > 0 && message[length - 1] == '\n')
+            message[length-- - 1] = '\0';
+
+        /* Check if we've gotten too many prompts but quietly ignore them. */
+        if (prompts->current >= prompts->size) {
+            diag("unexpected prompt: %s", message);
+            free(message);
+            ok(0, "more prompts than expected");
+            continue;
+        }
+
+        /* Be sure everything matches and return the response, if any. */
+        prompt = &prompts->prompts[prompts->current];
+        is_int(prompt->style, msg[i]->msg_style, "style of prompt %lu",
+               (unsigned long) prompts->current + 1);
+        compare_string(prompt->prompt, message, "value of prompt %lu",
+                       (unsigned long) prompts->current + 1);
+        free(message);
+        prompts->current++;
+        if (prompt->style == msg[i]->msg_style && prompt->response != NULL) {
+            (*resp)[i].resp = bstrdup(prompt->response);
+            (*resp)[i].resp_retcode = 0;
+        }
+    }
+
+    /*
+     * Always return success even if the prompts don't match.  Otherwise,
+     * we're likely to abort the conversation in the middle and possibly
+     * leave passwords set incorrectly.
+     */
+    return PAM_SUCCESS;
+}
+
+
+/*
+ * Check the actual PAM output against the expected output.  We divide the
+ * expected and seen output into separate lines and compare each one so that
+ * we can handle regular expressions and the output priority.
+ */
+static void
+check_output(const struct output *wanted, const struct output *seen)
+{
+    size_t i;
+
+    if (wanted == NULL && seen == NULL)
+        ok(1, "no output");
+    else if (wanted == NULL) {
+        for (i = 0; i < seen->count; i++)
+            diag("unexpected: (%d) %s", seen->lines[i].priority,
+                 seen->lines[i].line);
+        ok(0, "no output");
+    } else if (seen == NULL) {
+        for (i = 0; i < wanted->count; i++) {
+            is_int(wanted->lines[i].priority, 0, "output priority %lu",
+                   (unsigned long) i + 1);
+            is_string(wanted->lines[i].line, NULL, "output line %lu",
+                      (unsigned long) i + 1);
+        }
+    } else {
+        for (i = 0; i < wanted->count && i < seen->count; i++) {
+            is_int(wanted->lines[i].priority, seen->lines[i].priority,
+                   "output priority %lu", (unsigned long) i + 1);
+            compare_string(wanted->lines[i].line, seen->lines[i].line,
+                           "output line %lu", (unsigned long) i + 1);
+        }
+        if (wanted->count > seen->count)
+            for (i = seen->count; i < wanted->count; i++) {
+                is_int(wanted->lines[i].priority, 0, "output priority %lu",
+                       (unsigned long) i + 1);
+                is_string(wanted->lines[i].line, NULL, "output line %lu",
+                          (unsigned long) i + 1);
+            }
+        if (seen->count > wanted->count) {
+            for (i = wanted->count; i < seen->count; i++)
+                diag("unexpected: (%d) %s", seen->lines[i].priority,
+                     seen->lines[i].line);
+            ok(0, "unexpected output lines");
+        } else {
+            ok(1, "no excess output");
+        }
+    }
+}
+
+
+/*
+ * The core of the work.  Given the path to a PAM interaction script, which
+ * may be relative to C_TAP_SOURCE or C_TAP_BUILD, the user (may be NULL), and
+ * the stored password (may be NULL), run that script, outputting the results
+ * in TAP format.
+ */
+void
+run_script(const char *file, const struct script_config *config)
+{
+    char *path;
+    struct output *output;
+    FILE *script;
+    struct work *work;
+    struct options *opts;
+    struct action *action, *oaction;
+    struct pam_conv conv = {NULL, NULL};
+    pam_handle_t *pamh;
+    int status;
+    size_t i, j;
+    const char *argv_empty[] = {NULL};
+
+    /* Open and parse the script. */
+    if (access(file, R_OK) == 0)
+        path = bstrdup(file);
+    else {
+        path = test_file_path(file);
+        if (path == NULL)
+            bail("cannot find PAM script %s", file);
+    }
+    script = fopen(path, "r");
+    if (script == NULL)
+        sysbail("cannot open %s", path);
+    work = parse_script(script, config);
+    fclose(script);
+    diag("Starting %s", file);
+    if (work->prompts != NULL) {
+        conv.conv = converse;
+        conv.appdata_ptr = work->prompts;
+    }
+
+    /* Initialize PAM. */
+    status = pam_start("test", config->user, &conv, &pamh);
+    if (status != PAM_SUCCESS)
+        sysbail("cannot create PAM handle");
+    if (config->authtok != NULL)
+        pamh->authtok = bstrdup(config->authtok);
+    if (config->oldauthtok != NULL)
+        pamh->oldauthtok = bstrdup(config->oldauthtok);
+
+    /* Run the actions and check their return status. */
+    for (action = work->actions; action != NULL; action = action->next) {
+        if (work->options[action->group].argv == NULL)
+            status = (*action->call)(pamh, action->flags, 0, argv_empty);
+        else {
+            opts = &work->options[action->group];
+            status = (*action->call)(pamh, action->flags, opts->argc,
+                                     (const char **) opts->argv);
+        }
+        is_int(action->status, status, "status for %s", action->name);
+    }
+    output = pam_output();
+    check_output(work->output, output);
+    pam_output_free(output);
+
+    /* If we have a test callback, call it now. */
+    if (config->callback != NULL)
+        config->callback(pamh, config, config->data);
+
+    /* Free memory and return. */
+    pam_end(pamh, work->end_flags);
+    action = work->actions;
+    while (action != NULL) {
+        free(action->name);
+        oaction = action;
+        action = action->next;
+        free(oaction);
+    }
+    for (i = 0; i < ARRAY_SIZE(work->options); i++)
+        if (work->options[i].argv != NULL) {
+            for (j = 0; work->options[i].argv[j] != NULL; j++)
+                free(work->options[i].argv[j]);
+            free(work->options[i].argv);
+        }
+    if (work->output)
+        pam_output_free(work->output);
+    if (work->prompts != NULL) {
+        for (i = 0; i < work->prompts->size; i++) {
+            free(work->prompts->prompts[i].prompt);
+            free(work->prompts->prompts[i].response);
+        }
+        free(work->prompts->prompts);
+        free(work->prompts);
+    }
+    free(work);
+    free(path);
+}
+
+
+/*
+ * Check a filename for acceptable characters.  Returns true if the file
+ * consists solely of [a-zA-Z0-9-] and false otherwise.
+ */
+static bool
+valid_filename(const char *filename)
+{
+    const char *p;
+
+    for (p = filename; *p != '\0'; p++) {
+        if (*p >= 'A' && *p <= 'Z')
+            continue;
+        if (*p >= 'a' && *p <= 'z')
+            continue;
+        if (*p >= '0' && *p <= '9')
+            continue;
+        if (*p == '-')
+            continue;
+        return false;
+    }
+    return true;
+}
+
+
+/*
+ * The same as run_script, but run every script found in the given directory,
+ * skipping file names that contain characters other than alphanumerics and -.
+ */
+void
+run_script_dir(const char *dir, const struct script_config *config)
+{
+    DIR *handle;
+    struct dirent *entry;
+    const char *path;
+    char *file;
+
+    if (access(dir, R_OK) == 0)
+        path = dir;
+    else
+        path = test_file_path(dir);
+    handle = opendir(path);
+    if (handle == NULL)
+        sysbail("cannot open directory %s", dir);
+    errno = 0;
+    while ((entry = readdir(handle)) != NULL) {
+        if (!valid_filename(entry->d_name))
+            continue;
+        basprintf(&file, "%s/%s", path, entry->d_name);
+        run_script(file, config);
+        free(file);
+        errno = 0;
+    }
+    if (errno != 0)
+        sysbail("cannot read directory %s", dir);
+    closedir(handle);
+    if (path != dir)
+        test_file_path_free((char *) path);
+}
diff --git a/tests/fakepam/script.h b/tests/fakepam/script.h
new file mode 100644
index 000000000000..c99fc12f55d2
--- /dev/null
+++ b/tests/fakepam/script.h
@@ -0,0 +1,82 @@
+/*
+ * PAM interaction script API.
+ *
+ * Provides an interface that loads a PAM interaction script from a file and
+ * runs through that script, calling the internal PAM module functions and
+ * checking their results.  This allows automation of PAM testing through
+ * external data files instead of coding everything in C.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2016 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TESTS_MODULE_SCRIPT_H
+#define TESTS_MODULE_SCRIPT_H 1
+
+#include <portable/pam.h>
+
+#include <tests/tap/basic.h>
+
+/* A test callback called after PAM functions are run but before pam_end. */
+struct script_config;
+typedef void (*script_callback)(pam_handle_t *, const struct script_config *,
+                                void *);
+
+/* Configuration for the PAM interaction script API. */
+struct script_config {
+    const char *user;         /* Username to pass into pam_start (%u). */
+    const char *password;     /* Substituted for %p in prompts. */
+    const char *newpass;      /* Substituted for %n in prompts. */
+    const char *extra[10];    /* Substituted for %0-%9 in logging. */
+    const char *authtok;      /* Stored as AUTHTOK before PAM. */
+    const char *oldauthtok;   /* Stored as OLDAUTHTOK before PAM. */
+    script_callback callback; /* Called after PAM, before pam_end. */
+    void *data;               /* Passed to the callback function. */
+};
+
+BEGIN_DECLS
+
+/*
+ * Given the file name of an interaction script (which may be a full path or
+ * relative to C_TAP_SOURCE or C_TAP_BUILD) and configuration containing other
+ * parameters such as the user, run that script, reporting the results via the
+ * TAP format.
+ */
+void run_script(const char *file, const struct script_config *)
+    __attribute__((__nonnull__));
+
+/*
+ * The same as run_script, but run every script found in the given directory,
+ * skipping file names that contain characters other than alphanumerics and -.
+ */
+void run_script_dir(const char *dir, const struct script_config *)
+    __attribute__((__nonnull__));
+
+END_DECLS
+
+#endif /* !TESTS_MODULE_SCRIPT_H */
diff --git a/tests/module/alt-auth-t.c b/tests/module/alt-auth-t.c
new file mode 100644
index 000000000000..df32ff941001
--- /dev/null
+++ b/tests/module/alt-auth-t.c
@@ -0,0 +1,117 @@
+/*
+ * Tests for the alt_auth_map functionality in libpam-krb5.
+ *
+ * This test case tests the variations of the alt_auth_map functionality for
+ * both authentication and account management.  It requires a Kerberos
+ * configuration, but does not attempt to save a session ticket cache (to
+ * avoid requiring user configuration).
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+    char *user;
+
+    /*
+     * Load the Kerberos principal and password from a file, but set the
+     * principal as extra[0] and use something else bogus as the user.  We
+     * want to test that alt_auth_map works when there's no relationship
+     * between the mapped principal and the user.
+     */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = "bogus-nonexistent-account";
+    config.authtok = krbconf->password;
+    config.extra[0] = krbconf->username;
+    config.extra[1] = krbconf->userprinc;
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that we can be sure that our principals will stay fully-qualified in
+     * the logs.
+     */
+    kerberos_generate_conf("bogus.example.com");
+    config.extra[2] = "bogus.example.com";
+
+    /* Test without password prompting. */
+    plan_lazy();
+    run_script("data/scripts/alt-auth/basic", &config);
+    run_script("data/scripts/alt-auth/basic-debug", &config);
+    run_script("data/scripts/alt-auth/fail", &config);
+    run_script("data/scripts/alt-auth/fail-debug", &config);
+    run_script("data/scripts/alt-auth/force", &config);
+    run_script("data/scripts/alt-auth/only", &config);
+
+    /*
+     * If the alternate account exists but the password is incorrect, we
+     * should not fall back to the regular account.  Test with debug so that
+     * we don't need two principals configured.
+     */
+    config.authtok = "bogus incorrect password";
+    run_script("data/scripts/alt-auth/force-fail-debug", &config);
+
+    /*
+     * Switch to our correct user (but wrong realm) realm to test username
+     * mapping to a different realm.
+     */
+    config.authtok = krbconf->password;
+    config.user = krbconf->username;
+    config.extra[2] = krbconf->realm;
+    run_script("data/scripts/alt-auth/username-map", &config);
+
+    /*
+     * Split the username into two parts, one in the PAM configuration and one
+     * in the real username, so that we can test interpolation of the username
+     * when %s isn't the first token.
+     */
+    config.user = &krbconf->username[1];
+    user = bstrndup(krbconf->username, 1);
+    config.extra[3] = user;
+    run_script("data/scripts/alt-auth/username-map-prefix", &config);
+    free(user);
+    config.extra[3] = NULL;
+
+    /*
+     * Ensure that we don't add the realm of the authentication username when
+     * the alt_auth_map already includes a realm.
+     */
+    basprintf(&user, "%s@foo.example.com", krbconf->username);
+    config.user = user;
+    diag("re-running username-map with fully-qualified PAM user");
+    run_script("data/scripts/alt-auth/username-map", &config);
+    free(user);
+
+    /*
+     * Add the password and make the user match our authentication principal,
+     * and then test fallback to normal authentication when alternative
+     * authentication fails.
+     */
+    config.user = krbconf->userprinc;
+    config.password = krbconf->password;
+    config.extra[2] = krbconf->realm;
+    run_script("data/scripts/alt-auth/fallback", &config);
+    run_script("data/scripts/alt-auth/fallback-debug", &config);
+    run_script("data/scripts/alt-auth/fallback-realm", &config);
+    run_script("data/scripts/alt-auth/force-fallback", &config);
+    run_script("data/scripts/alt-auth/only-fail", &config);
+
+    return 0;
+}
diff --git a/tests/module/bad-authtok-t.c b/tests/module/bad-authtok-t.c
new file mode 100644
index 000000000000..385dd5946849
--- /dev/null
+++ b/tests/module/bad-authtok-t.c
@@ -0,0 +1,53 @@
+/*
+ * Authentication tests for the pam-krb5 module with an incorrect AUTHTOK.
+ *
+ * This test case includes tests that require Kerberos to be configured and a
+ * username and password available and that run with an incorrect AUTHTOK
+ * already set.  They test various prompting fallback cases.  They don't write
+ * a ticket cache (which requires additional work to test the cache
+ * ownership).
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->userprinc;
+    config.password = krbconf->password;
+
+    /* Set the authtok to something bogus. */
+    config.authtok = "BAD PASSWORD THAT WILL NOT WORK";
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that we can be sure that our principals will stay fully-qualified in
+     * the logs.
+     */
+    kerberos_generate_conf("bogus.example.com");
+
+    plan_lazy();
+    run_script_dir("data/scripts/bad-authtok", &config);
+
+    return 0;
+}
diff --git a/tests/module/basic-t.c b/tests/module/basic-t.c
new file mode 100644
index 000000000000..cacad5906ffb
--- /dev/null
+++ b/tests/module/basic-t.c
@@ -0,0 +1,67 @@
+/*
+ * Basic tests for the pam-krb5 module.
+ *
+ * This test case includes all tests that can be done without having Kerberos
+ * configured and a username and password available, and without any special
+ * configuration.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <pwd.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct passwd pwd;
+    char *uid;
+    char *uidplus;
+
+    plan_lazy();
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that this test will run on any system.
+     */
+    kerberos_generate_conf("bogus.example.com");
+
+    /* Create a fake passwd struct for our user. */
+    memset(&pwd, 0, sizeof(pwd));
+    pwd.pw_name = (char *) "root";
+    pwd.pw_uid = getuid();
+    pwd.pw_gid = getgid();
+    pam_set_pwd(&pwd);
+
+    /*
+     * Attempt login as the root user to test ignore_root.  Set our current
+     * UID and a UID one larger for testing minimum_uid.
+     */
+    basprintf(&uid, "%lu", (unsigned long) pwd.pw_uid);
+    basprintf(&uidplus, "%lu", (unsigned long) pwd.pw_uid + 1);
+    memset(&config, 0, sizeof(config));
+    config.user = "root";
+    config.extra[0] = uid;
+    config.extra[1] = uidplus;
+
+    run_script_dir("data/scripts/basic", &config);
+
+    free(uid);
+    free(uidplus);
+    return 0;
+}
diff --git a/tests/module/cache-cleanup-t.c b/tests/module/cache-cleanup-t.c
new file mode 100644
index 000000000000..8b5012fc3507
--- /dev/null
+++ b/tests/module/cache-cleanup-t.c
@@ -0,0 +1,104 @@
+/*
+ * Test for properly cleaning up ticket caches.
+ *
+ * Verify that the temporary Kerberos ticket cache generated during
+ * authentication is cleaned up on pam_end, even if no session was opened.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <dirent.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+    DIR *tmpdir;
+    struct dirent *file;
+    char *tmppath, *path;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->username;
+    config.authtok = krbconf->password;
+    config.extra[0] = krbconf->userprinc;
+
+    /* Generate a testing krb5.conf file. */
+    kerberos_generate_conf(krbconf->realm);
+
+    /* Get the temporary directory and store that as the %1 substitution. */
+    tmppath = test_tmpdir();
+    config.extra[1] = tmppath;
+
+    plan_lazy();
+
+    /*
+     * We need to ensure that the only thing in the test temporary directory
+     * is the krb5.conf file that we generated and any valgrind logs, since
+     * we're going to check for cleanup by looking for any out-of-place files.
+     */
+    tmpdir = opendir(tmppath);
+    if (tmpdir == NULL)
+        sysbail("cannot open directory %s", tmppath);
+    while ((file = readdir(tmpdir)) != NULL) {
+        if (strcmp(file->d_name, ".") == 0 || strcmp(file->d_name, "..") == 0)
+            continue;
+        if (strcmp(file->d_name, "krb5.conf") == 0)
+            continue;
+        if (strcmp(file->d_name, "valgrind") == 0)
+            continue;
+        basprintf(&path, "%s/%s", tmppath, file->d_name);
+        if (unlink(path) < 0)
+            sysbail("cannot delete temporary file %s", path);
+        free(path);
+    }
+    closedir(tmpdir);
+
+    /*
+     * Authenticate only, call pam_end, and be sure the ticket cache is
+     * gone.  The auth-only script sets ccache_dir to the temporary directory,
+     * so the module will create a temporary ticket cache there and then
+     * should clean it up.
+     */
+    run_script("data/scripts/cache-cleanup/auth-only", &config);
+    path = NULL;
+    tmpdir = opendir(tmppath);
+    if (tmpdir == NULL)
+        sysbail("cannot open directory %s", tmppath);
+    while ((file = readdir(tmpdir)) != NULL) {
+        if (strcmp(file->d_name, ".") == 0 || strcmp(file->d_name, "..") == 0)
+            continue;
+        if (strcmp(file->d_name, "krb5.conf") == 0)
+            continue;
+        if (strcmp(file->d_name, "valgrind") == 0)
+            continue;
+        if (path == NULL)
+            basprintf(&path, "%s/%s", tmppath, file->d_name);
+    }
+    closedir(tmpdir);
+    if (path != NULL)
+        diag("found stray temporary file %s", path);
+    ok(path == NULL, "ticket cache cleaned up");
+    if (path != NULL)
+        free(path);
+
+    test_tmpdir_free(tmppath);
+    return 0;
+}
diff --git a/tests/module/cache-t.c b/tests/module/cache-t.c
new file mode 100644
index 000000000000..8ec82df7c460
--- /dev/null
+++ b/tests/module/cache-t.c
@@ -0,0 +1,210 @@
+/*
+ * Authentication tests for the pam-krb5 module with ticket cache.
+ *
+ * This test case includes all tests that require Kerberos to be configured, a
+ * username and password available, and a ticket cache created, but with the
+ * PAM module running as the same user for which the ticket cache will be
+ * created (so without setuid and with chown doing nothing).
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011, 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/system.h>
+
+#include <pwd.h>
+#include <sys/stat.h>
+#include <time.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+/* Additional data used by the cache check callback. */
+struct extra {
+    char *realm;
+    char *cache_path;
+};
+
+
+/*
+ * PAM test callback to check whether we created a ticket cache and the ticket
+ * cache is for the correct user.
+ */
+static void
+check_cache(const char *file, const struct script_config *config,
+            const struct extra *extra)
+{
+    struct stat st;
+    krb5_error_code code;
+    krb5_context ctx = NULL;
+    krb5_ccache ccache = NULL;
+    krb5_principal princ = NULL;
+    krb5_principal tgtprinc = NULL;
+    krb5_creds in, out;
+    char *principal = NULL;
+
+    /* Check ownership and permissions. */
+    is_int(0, stat(file, &st), "cache exists");
+    is_int(getuid(), st.st_uid, "...with correct UID");
+    is_int(getgid(), st.st_gid, "...with correct GID");
+    is_int(0600, (st.st_mode & 0777), "...with correct permissions");
+
+    /* Check the existence of the ticket cache and its principal. */
+    code = krb5_init_context(&ctx);
+    if (code != 0)
+        bail("cannot create Kerberos context");
+    code = krb5_cc_resolve(ctx, file, &ccache);
+    is_int(0, code, "able to resolve Kerberos ticket cache");
+    code = krb5_cc_get_principal(ctx, ccache, &princ);
+    is_int(0, code, "able to get principal");
+    code = krb5_unparse_name(ctx, princ, &principal);
+    is_int(0, code, "...and principal is valid");
+    is_string(config->extra[0], principal, "...and matches our principal");
+
+    /* Retrieve the krbtgt for the realm and check properties. */
+    code = krb5_build_principal_ext(
+        ctx, &tgtprinc, (unsigned int) strlen(extra->realm), extra->realm,
+        KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME, strlen(extra->realm), extra->realm,
+        NULL);
+    if (code != 0)
+        bail("cannot create krbtgt principal name");
+    memset(&in, 0, sizeof(in));
+    memset(&out, 0, sizeof(out));
+    in.server = tgtprinc;
+    in.client = princ;
+    code = krb5_cc_retrieve_cred(ctx, ccache, KRB5_TC_MATCH_SRV_NAMEONLY, &in,
+                                 &out);
+    is_int(0, code, "able to get krbtgt credentials");
+    ok(out.times.endtime > time(NULL) + 30 * 60, "...good for 30 minutes");
+    krb5_free_cred_contents(ctx, &out);
+
+    /* Close things and release memory. */
+    krb5_free_principal(ctx, tgtprinc);
+    krb5_free_unparsed_name(ctx, principal);
+    krb5_free_principal(ctx, princ);
+    krb5_cc_close(ctx, ccache);
+    krb5_free_context(ctx);
+}
+
+
+/*
+ * Same as check_cache except unlink the ticket cache afterwards.  Used to
+ * check the ticket cache in cases where the PAM module will not clean it up
+ * afterwards, such as calling pam_end with PAM_DATA_SILENT.
+ */
+static void
+check_cache_callback(pam_handle_t *pamh, const struct script_config *config,
+                     void *data)
+{
+    struct extra *extra = data;
+    const char *cache, *file;
+    char *prefix;
+
+    cache = pam_getenv(pamh, "KRB5CCNAME");
+    ok(cache != NULL, "KRB5CCNAME is set in PAM environment");
+    if (cache == NULL)
+        return;
+    basprintf(&prefix, "FILE:/tmp/krb5cc_%lu_", (unsigned long) getuid());
+    diag("KRB5CCNAME = %s", cache);
+    ok(strncmp(prefix, cache, strlen(prefix)) == 0,
+       "cache file name prefix is correct");
+    free(prefix);
+    file = cache + strlen("FILE:");
+    extra->cache_path = bstrdup(file);
+    check_cache(file, config, extra);
+}
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+    char *k5login;
+    struct extra extra;
+    struct passwd pwd;
+    FILE *file;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->username;
+    extra.realm = krbconf->realm;
+    extra.cache_path = NULL;
+    config.authtok = krbconf->password;
+    config.extra[0] = krbconf->userprinc;
+
+    /* Generate a testing krb5.conf file. */
+    kerberos_generate_conf(krbconf->realm);
+
+    /* Create a fake passwd struct for our user. */
+    memset(&pwd, 0, sizeof(pwd));
+    pwd.pw_name = krbconf->username;
+    pwd.pw_uid = getuid();
+    pwd.pw_gid = getgid();
+    basprintf(&pwd.pw_dir, "%s/tmp", getenv("BUILD"));
+    pam_set_pwd(&pwd);
+
+    plan_lazy();
+
+    /* Basic test. */
+    run_script("data/scripts/cache/basic", &config);
+
+    /* Check the cache status before the session is closed. */
+    config.callback = check_cache_callback;
+    config.data = &extra;
+    run_script("data/scripts/cache/open-session", &config);
+    free(extra.cache_path);
+    extra.cache_path = NULL;
+
+    /*
+     * Try again but passing PAM_DATA_SILENT to pam_end.  This should leave
+     * the ticket cache intact.
+     */
+    run_script("data/scripts/cache/end-data-silent", &config);
+    check_cache(extra.cache_path, &config, &extra);
+    if (unlink(extra.cache_path) < 0)
+        sysdiag("unable to unlink temporary cache %s", extra.cache_path);
+    free(extra.cache_path);
+    extra.cache_path = NULL;
+
+    /* Change the authenticating user and test search_k5login. */
+    pwd.pw_name = (char *) "testuser";
+    pam_set_pwd(&pwd);
+    config.user = "testuser";
+    basprintf(&k5login, "%s/.k5login", pwd.pw_dir);
+    file = fopen(k5login, "w");
+    if (file == NULL)
+        sysbail("cannot create %s", k5login);
+    if (fprintf(file, "%s\n", krbconf->userprinc) < 0)
+        sysbail("cannot write to %s", k5login);
+    if (fclose(file) < 0)
+        sysbail("cannot flush %s", k5login);
+    run_script("data/scripts/cache/search-k5login", &config);
+    free(extra.cache_path);
+    extra.cache_path = NULL;
+    config.callback = NULL;
+    run_script("data/scripts/cache/search-k5login-debug", &config);
+    unlink(k5login);
+    free(k5login);
+
+    /* Test search_k5login when no .k5login file exists. */
+    pwd.pw_name = krbconf->username;
+    pam_set_pwd(&pwd);
+    config.user = krbconf->username;
+    diag("testing search_k5login with no .k5login file");
+    run_script("data/scripts/cache/search-k5login", &config);
+
+    free(pwd.pw_dir);
+    return 0;
+}
diff --git a/tests/module/expired-t.c b/tests/module/expired-t.c
new file mode 100644
index 000000000000..01a1892a0d04
--- /dev/null
+++ b/tests/module/expired-t.c
@@ -0,0 +1,175 @@
+/*
+ * Tests for the pam-krb5 module with an expired password.
+ *
+ * This test case checks correct handling of an account whose password has
+ * expired and the multiple different paths the module can take for handling
+ * that case.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <pwd.h>
+#include <time.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/kadmin.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+    char *newpass, *date;
+    struct passwd pwd;
+    time_t now;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->username;
+    config.password = krbconf->password;
+    config.extra[0] = krbconf->userprinc;
+
+    /*
+     * Ensure we can expire the password.  Heimdal has a prompt for the
+     * expiration time, so save that to use as a substitution in the script.
+     */
+    now = time(NULL) - 1;
+    if (!kerberos_expire_password(krbconf->userprinc, now))
+        skip_all("kadmin not configured or kadmin mismatch");
+    date = bstrdup(ctime(&now));
+    date[strlen(date) - 1] = '\0';
+    config.extra[1] = date;
+
+    /* Generate a testing krb5.conf file. */
+    kerberos_generate_conf(krbconf->realm);
+
+    /* Create a fake passwd struct for our user. */
+    memset(&pwd, 0, sizeof(pwd));
+    pwd.pw_name = krbconf->username;
+    pwd.pw_uid = getuid();
+    pwd.pw_gid = getgid();
+    basprintf(&pwd.pw_dir, "%s/tmp", getenv("BUILD"));
+    pam_set_pwd(&pwd);
+
+    /*
+     * We'll be changing the password to something new.  This needs to be
+     * sufficiently random that it's unlikely to fall afoul of password
+     * strength checking.
+     */
+    basprintf(&newpass, "ngh1,a%lu nn9af6", (unsigned long) getpid());
+    config.newpass = newpass;
+
+    plan_lazy();
+
+    /*
+     * Default behavior.  We have to distinguish between two versions of
+     * Heimdal for testing because the prompts changed substantially.  Use the
+     * existence of krb5_principal_set_comp_string to distinguish because it
+     * was introduced at the same time.
+     */
+#ifdef HAVE_KRB5_HEIMDAL
+#    ifdef HAVE_KRB5_PRINCIPAL_SET_COMP_STRING
+    run_script("data/scripts/expired/basic-heimdal", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-heimdal-debug", &config);
+#    else
+    run_script("data/scripts/expired/basic-heimdal-old", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-heimdal-old-debug", &config);
+#    endif
+#else
+    run_script("data/scripts/expired/basic-mit", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-mit-debug", &config);
+#endif
+
+    /* Test again with PAM_SILENT, specified two ways. */
+#ifdef HAVE_KRB5_HEIMDAL
+    config.newpass = newpass;
+    config.password = krbconf->password;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-heimdal-silent", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-heimdal-flag-silent", &config);
+#else
+    config.newpass = newpass;
+    config.password = krbconf->password;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-mit-silent", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-mit-flag-silent", &config);
+#endif
+
+    /*
+     * We can only run the remaining checks if we can suppress the Kerberos
+     * library behavior of prompting for a new password when the password has
+     * expired.
+     */
+#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CHANGE_PASSWORD_PROMPT
+
+    /* Check the forced failure behavior. */
+    run_script("data/scripts/expired/fail", &config);
+    run_script("data/scripts/expired/fail-debug", &config);
+
+    /*
+     * Defer the error to the account management check.
+     *
+     * Skip this check on Heimdal currently (Heimdal 7.4.0) because its
+     * implementation of krb5_get_init_creds_opt_set_change_password_prompt is
+     * incomplete.  See <https://github.com/heimdal/heimdal/issues/322>.
+     */
+#    ifdef HAVE_KRB5_HEIMDAL
+    skip_block(2, "deferring password changes broken in Heimdal");
+#    else
+    config.newpass = newpass;
+    config.password = krbconf->password;
+    config.authtok = krbconf->password;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/defer-mit", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    config.authtok = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/defer-mit-debug", &config);
+#    endif
+
+#else /* !HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CHANGE_PASSWORD_PROMPT */
+
+    /* Mention that we skipped something for the record. */
+    skip_block(4, "cannot disable library password prompting");
+
+#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CHANGE_PASSWORD_PROMPT */
+
+    /* In case we ran into some error, try to unexpire the password. */
+    kerberos_expire_password(krbconf->userprinc, 0);
+
+    free(date);
+    free(newpass);
+    free(pwd.pw_dir);
+    return 0;
+}
diff --git a/tests/module/fast-anon-t.c b/tests/module/fast-anon-t.c
new file mode 100644
index 000000000000..6355a5154f69
--- /dev/null
+++ b/tests/module/fast-anon-t.c
@@ -0,0 +1,108 @@
+/*
+ * Tests for anonymous FAST support in pam-krb5.
+ *
+ * Tests for anonymous Flexible Authentication Secure Tunneling, a mechanism
+ * for improving the preauthentication part of the Kerberos protocol and
+ * protecting it against various attacks.
+ *
+ * This is broken out from the other FAST tests because it uses PKINIT, and
+ * PKINIT code cannot be tested under valgrind with MIT Kerberos due to some
+ * bug in valgrind.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+
+
+/*
+ * Test whether anonymous authentication works.  If this doesn't, we need to
+ * skip the tests of anonymous FAST.
+ */
+static bool
+anon_fast_works(void)
+{
+    krb5_context ctx;
+    krb5_error_code retval;
+    krb5_principal princ = NULL;
+    char *realm;
+    krb5_creds creds;
+    krb5_get_init_creds_opt *opts = NULL;
+
+    /* Construct the anonymous principal name. */
+    retval = krb5_init_context(&ctx);
+    if (retval != 0)
+        bail("cannot initialize Kerberos");
+    retval = krb5_get_default_realm(ctx, &realm);
+    if (retval != 0)
+        bail("cannot get default realm");
+    retval = krb5_build_principal_ext(
+        ctx, &princ, (unsigned int) strlen(realm), realm,
+        strlen(KRB5_WELLKNOWN_NAME), KRB5_WELLKNOWN_NAME,
+        strlen(KRB5_ANON_NAME), KRB5_ANON_NAME, NULL);
+    if (retval != 0)
+        bail("cannot construct anonymous principal");
+    krb5_free_default_realm(ctx, realm);
+
+    /* Obtain the credentials. */
+    memset(&creds, 0, sizeof(creds));
+    retval = krb5_get_init_creds_opt_alloc(ctx, &opts);
+    if (retval != 0)
+        bail("cannot create credential options");
+    krb5_get_init_creds_opt_set_anonymous(opts, 1);
+    krb5_get_init_creds_opt_set_tkt_life(opts, 60);
+    retval = krb5_get_init_creds_password(ctx, &creds, princ, NULL, NULL, NULL,
+                                          0, NULL, opts);
+
+    /* Clean up. */
+    if (princ != NULL)
+        krb5_free_principal(ctx, princ);
+    if (opts != NULL)
+        krb5_get_init_creds_opt_free(ctx, opts);
+    krb5_free_cred_contents(ctx, &creds);
+
+    /* Return whether authentication succeeded. */
+    return (retval == 0);
+}
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+
+    /* Skip the test if FAST is not available. */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME
+    skip_all("FAST support not available");
+#endif
+
+    /* Initialize Kerberos configuration. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->username;
+    config.authtok = krbconf->password;
+    config.extra[0] = krbconf->userprinc;
+    kerberos_generate_conf(krbconf->realm);
+
+    /* Skip the test if anonymous PKINIT doesn't work. */
+    if (!anon_fast_works())
+        skip_all("anonymous PKINIT failed");
+
+    /* Test anonymous FAST. */
+    plan_lazy();
+    run_script("data/scripts/fast/anonymous", &config);
+    run_script("data/scripts/fast/anonymous-debug", &config);
+
+    return 0;
+}
diff --git a/tests/module/fast-t.c b/tests/module/fast-t.c
new file mode 100644
index 000000000000..51fee27098c8
--- /dev/null
+++ b/tests/module/fast-t.c
@@ -0,0 +1,57 @@
+/*
+ * Tests for authenticated FAST support in pam-krb5.
+ *
+ * Tests for Flexible Authentication Secure Tunneling, a mechanism for
+ * improving the preauthentication part of the Kerberos protocol and
+ * protecting it against various attacks.  This tests authenticated FAST;
+ * anonymous FAST is tested separately.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+
+    /* Skip the test if FAST is not available. */
+#ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME
+    skip_all("FAST support not available");
+#endif
+
+    /* Initialize Kerberos configuration. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_BOTH);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->userprinc;
+    config.authtok = krbconf->password;
+    config.extra[0] = krbconf->cache;
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that we can be sure that our principals will stay fully-qualified in
+     * the logs.
+     */
+    kerberos_generate_conf("bogus.example.com");
+
+    /* Test fast_ccache */
+    plan_lazy();
+    run_script("data/scripts/fast/ccache", &config);
+    run_script("data/scripts/fast/ccache-debug", &config);
+    run_script("data/scripts/fast/no-ccache", &config);
+    run_script("data/scripts/fast/no-ccache-debug", &config);
+
+    return 0;
+}
diff --git a/tests/module/long-t.c b/tests/module/long-t.c
new file mode 100644
index 000000000000..73614b0f6ec9
--- /dev/null
+++ b/tests/module/long-t.c
@@ -0,0 +1,46 @@
+/*
+ * Excessively long password tests for the pam-krb5 module.
+ *
+ * This test case includes all tests for excessively long passwords that can
+ * be done without having Kerberos configured and a username and password
+ * available.
+ *
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    char *password;
+
+    plan_lazy();
+
+    memset(&config, 0, sizeof(config));
+    config.user = "test";
+
+    /* Test a password that is too long. */
+    password = bcalloc_type(PAM_MAX_RESP_SIZE + 1, char);
+    memset(password, 'a', PAM_MAX_RESP_SIZE);
+    config.password = password;
+    run_script("data/scripts/long/password", &config);
+    run_script("data/scripts/long/password-debug", &config);
+
+    /* Test a stored authtok that's too long. */
+    config.authtok = password;
+    config.password = "testing";
+    run_script("data/scripts/long/use-first", &config);
+    run_script("data/scripts/long/use-first-debug", &config);
+
+    free(password);
+    return 0;
+}
diff --git a/tests/module/no-cache-t.c b/tests/module/no-cache-t.c
new file mode 100644
index 000000000000..8b282d1de397
--- /dev/null
+++ b/tests/module/no-cache-t.c
@@ -0,0 +1,47 @@
+/*
+ * Authentication tests for the pam-krb5 module without a ticket cache.
+ *
+ * This test case includes tests that require Kerberos to be configured and a
+ * username and password available, but which don't write a ticket cache
+ * (which requires additional work to test the cache ownership).  This test
+ * does not set AUTHTOK.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011, 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->userprinc;
+    config.password = krbconf->password;
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that we can be sure that our principals will stay fully-qualified in
+     * the logs.
+     */
+    kerberos_generate_conf("bogus.example.com");
+
+    plan_lazy();
+    run_script_dir("data/scripts/no-cache", &config);
+
+    return 0;
+}
diff --git a/tests/module/pam-user-t.c b/tests/module/pam-user-t.c
new file mode 100644
index 000000000000..72cc21eebae3
--- /dev/null
+++ b/tests/module/pam-user-t.c
@@ -0,0 +1,80 @@
+/*
+ * Tests for PAM_USER handling.
+ *
+ * This test case includes tests that require Kerberos to be configured and a
+ * username and password available, but which don't write a ticket cache
+ * (which requires additional work to test the cache ownership).
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/macros.h>
+
+
+/*
+ * Callback to check that PAM_USER matches the desired value, passed in as the
+ * data parameter.
+ */
+static void
+check_pam_user(pam_handle_t *pamh, const struct script_config *config UNUSED,
+               void *data)
+{
+    int retval;
+    const char *name = NULL;
+    const char *expected = data;
+
+    retval = pam_get_item(pamh, PAM_USER, (PAM_CONST void **) &name);
+    is_int(PAM_SUCCESS, retval, "Found PAM_USER");
+    is_string(expected, name, "...matching %s", expected);
+}
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.password = krbconf->password;
+    config.callback = check_pam_user;
+    config.extra[0] = krbconf->username;
+    config.extra[1] = krbconf->userprinc;
+
+    /*
+     * Generate a testing krb5.conf file matching the realm of the Kerberos
+     * configuration so that canonicalization will work.
+     */
+    kerberos_generate_conf(krbconf->realm);
+
+    /* Declare our plan. */
+    plan_lazy();
+
+    /* Authentication without a realm.  No canonicalization. */
+    config.user = krbconf->username;
+    config.data = krbconf->username;
+    run_script("data/scripts/pam-user/update", &config);
+
+    /* Authentication with the local realm.  Should be canonicalized. */
+    config.user = krbconf->userprinc;
+    run_script("data/scripts/pam-user/update", &config);
+
+    /*
+     * Now, test again with user updates disabled.  The PAM_USER value should
+     * now not be canonicalized.
+     */
+    config.data = krbconf->userprinc;
+    run_script("data/scripts/pam-user/no-update", &config);
+
+    return 0;
+}
diff --git a/tests/module/password-t.c b/tests/module/password-t.c
new file mode 100644
index 000000000000..bdf9762bc6cb
--- /dev/null
+++ b/tests/module/password-t.c
@@ -0,0 +1,152 @@
+/*
+ * Authentication tests for the pam-krb5 module with ticket cache.
+ *
+ * This test case includes all tests that require Kerberos to be configured, a
+ * username and password available, and a ticket cache created, but with the
+ * PAM module running as the same user for which the ticket cache will be
+ * created (so without setuid and with chown doing nothing).
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <pwd.h>
+#include <sys/stat.h>
+#include <time.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/macros.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+
+static void
+check_authtok(pam_handle_t *pamh, const struct script_config *config,
+              void *data UNUSED)
+{
+    int retval;
+    const char *authtok;
+
+    retval = pam_get_item(pamh, PAM_AUTHTOK, (PAM_CONST void **) &authtok);
+    is_int(PAM_SUCCESS, retval, "Found PAM_AUTHTOK");
+    is_string(config->newpass, authtok, "...and it is correct");
+}
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+    char *newpass;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->username;
+    config.password = krbconf->password;
+    config.extra[0] = krbconf->userprinc;
+
+    /* Generate a testing krb5.conf file. */
+    kerberos_generate_conf(krbconf->realm);
+
+    plan_lazy();
+
+    /*
+     * First test trying to change the password to something that's
+     * excessively long.
+     */
+    newpass = bcalloc_type(PAM_MAX_RESP_SIZE + 1, char);
+    memset(newpass, 'a', PAM_MAX_RESP_SIZE);
+    config.newpass = newpass;
+    run_script("data/scripts/password/too-long", &config);
+    run_script("data/scripts/password/too-long-debug", &config);
+
+    /* Test use_authtok with an excessively long password. */
+    config.newpass = NULL;
+    config.authtok = newpass;
+    run_script("data/scripts/password/authtok-too-long", &config);
+    run_script("data/scripts/password/authtok-too-long-debug", &config);
+
+    /*
+     * Change the password to something new.  This needs to be sufficiently
+     * random that it's unlikely to fall afoul of password strength checking.
+     */
+    free(newpass);
+    config.authtok = NULL;
+    basprintf(&newpass, "ngh1,a%lu nn9af6%lu", (unsigned long) getpid(),
+              (unsigned long) time(NULL));
+    config.newpass = newpass;
+    run_script("data/scripts/password/basic", &config);
+    config.password = newpass;
+    config.newpass = krbconf->password;
+    run_script("data/scripts/password/basic-debug", &config);
+
+    /* Test prompt_principal with password change. */
+    config.password = krbconf->password;
+    config.newpass = newpass;
+    run_script("data/scripts/password/prompt-principal", &config);
+
+    /* Change the password back and test expose-account. */
+    config.password = newpass;
+    config.newpass = krbconf->password;
+    run_script("data/scripts/password/expose", &config);
+
+    /*
+     * Test two banner settings by changing the password and then changing it
+     * back again.
+     */
+    config.password = krbconf->password;
+    config.newpass = newpass;
+    run_script("data/scripts/password/banner", &config);
+    config.password = newpass;
+    config.newpass = krbconf->password;
+    run_script("data/scripts/password/no-banner", &config);
+
+    /* Do the same, but with expose_account set as well. */
+    config.password = krbconf->password;
+    config.newpass = newpass;
+    run_script("data/scripts/password/banner-expose", &config);
+    config.password = newpass;
+    config.newpass = krbconf->password;
+    run_script("data/scripts/password/no-banner-expose", &config);
+
+    /* Test use_authtok. */
+    config.password = krbconf->password;
+    config.newpass = NULL;
+    config.authtok = newpass;
+    run_script("data/scripts/password/authtok", &config);
+
+    /* Test use_authtok with force_first_pass. */
+    config.password = NULL;
+    config.authtok = krbconf->password;
+    config.oldauthtok = newpass;
+    run_script("data/scripts/password/authtok-force", &config);
+
+    /*
+     * Ensure PAM_AUTHTOK and PAM_OLDAUTHTOK are set even if the user is
+     * ignored.
+     */
+    config.user = "root";
+    config.authtok = NULL;
+    config.oldauthtok = NULL;
+    config.password = "old-password";
+    config.newpass = "new-password";
+    config.callback = check_authtok;
+    run_script("data/scripts/password/ignore", &config);
+
+    free(newpass);
+    return 0;
+}
diff --git a/tests/module/pkinit-t.c b/tests/module/pkinit-t.c
new file mode 100644
index 000000000000..6bbb6993b2af
--- /dev/null
+++ b/tests/module/pkinit-t.c
@@ -0,0 +1,98 @@
+/*
+ * PKINIT authentication tests for the pam-krb5 module.
+ *
+ * This test case includes tests that require a PKINIT certificate, but which
+ * don't write a Kerberos ticket cache.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+#if defined(HAVE_KRB5_MIT) && defined(PATH_OPENSSL)
+    const char **generate_pkcs12;
+    char *tmpdir, *pkcs12_path;
+#endif
+
+    /* Load the Kerberos principal and certificate path. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PKINIT);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->pkinit_principal;
+    config.extra[0] = krbconf->pkinit_cert;
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that we can be sure that our principals will stay fully-qualified in
+     * the logs.
+     */
+    kerberos_generate_conf("bogus.example.com");
+
+    /* Check things that are the same with both Kerberos implementations. */
+    plan_lazy();
+    run_script("data/scripts/pkinit/basic", &config);
+    run_script("data/scripts/pkinit/basic-debug", &config);
+    run_script("data/scripts/pkinit/prompt-use", &config);
+    run_script("data/scripts/pkinit/prompt-try", &config);
+    run_script("data/scripts/pkinit/try-pkinit", &config);
+
+    /* Debugging output is a little different between the implementations. */
+#ifdef HAVE_KRB5_HEIMDAL
+    run_script("data/scripts/pkinit/try-pkinit-debug", &config);
+#else
+    run_script("data/scripts/pkinit/try-pkinit-debug-mit", &config);
+#endif
+
+    /* Only MIT Kerberos supports setting preauth options. */
+#ifdef HAVE_KRB5_MIT
+    run_script("data/scripts/pkinit/preauth-opt-mit", &config);
+#endif
+
+    /*
+     * If OpenSSL is available, test prompting with MIT Kerberos since we have
+     * to implement the prompting for the use_pkinit case ourselves.  To do
+     * this, convert the input PKINIT certificate to a PKCS12 file with a
+     * password.
+     */
+#if defined(HAVE_KRB5_MIT) && defined(PATH_OPENSSL)
+    tmpdir = test_tmpdir();
+    basprintf(&pkcs12_path, "%s/%s", tmpdir, "pkinit-pkcs12");
+    generate_pkcs12 = bcalloc_type(10, const char *);
+    generate_pkcs12[0] = PATH_OPENSSL;
+    generate_pkcs12[1] = "pkcs12";
+    generate_pkcs12[2] = "-export";
+    generate_pkcs12[3] = "-in";
+    generate_pkcs12[4] = krbconf->pkinit_cert;
+    generate_pkcs12[5] = "-password";
+    generate_pkcs12[6] = "pass:some-password";
+    generate_pkcs12[7] = "-out";
+    generate_pkcs12[8] = pkcs12_path;
+    generate_pkcs12[9] = NULL;
+    run_setup(generate_pkcs12);
+    free(generate_pkcs12);
+    config.extra[0] = pkcs12_path;
+    config.extra[1] = "some-password";
+    run_script("data/scripts/pkinit/pin-mit", &config);
+    unlink(pkcs12_path);
+    free(pkcs12_path);
+    test_tmpdir_free(tmpdir);
+#endif /* HAVE_KRB5_MIT && PATH_OPENSSL */
+
+    return 0;
+}
diff --git a/tests/module/realm-t.c b/tests/module/realm-t.c
new file mode 100644
index 000000000000..d5643ca1f3e5
--- /dev/null
+++ b/tests/module/realm-t.c
@@ -0,0 +1,87 @@
+/*
+ * Authentication tests for realm support in pam-krb5.
+ *
+ * Test the realm and user_realm option in the PAM configuration, which is
+ * special in several ways since it influences krb5.conf parsing and is read
+ * out of order in the initial configuration.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/krb5.h>
+#include <portable/system.h>
+
+#include <pwd.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+    struct passwd pwd;
+    FILE *file;
+    char *k5login;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->username;
+    config.authtok = krbconf->password;
+
+    /* Don't keep track of the tests in each script. */
+    plan_lazy();
+
+    /* Start with a nonexistent default realm for authentication failure. */
+    kerberos_generate_conf("bogus.example.com");
+    config.extra[0] = "bogus.example.com";
+    run_script("data/scripts/realm/fail-no-realm", &config);
+    run_script("data/scripts/realm/fail-no-realm-debug", &config);
+
+    /* Running a script that sets realm properly should pass. */
+    config.extra[0] = krbconf->realm;
+    run_script("data/scripts/realm/pass-realm", &config);
+
+    /* Setting user_realm should continue to fail due to no .k5login file. */
+    run_script("data/scripts/realm/fail-user-realm", &config);
+
+    /* If we add a .k5login file for the user, user_realm should work. */
+    pwd.pw_name = krbconf->username;
+    pwd.pw_uid = getuid();
+    pwd.pw_gid = getgid();
+    pwd.pw_dir = test_tmpdir();
+    pam_set_pwd(&pwd);
+    basprintf(&k5login, "%s/.k5login", pwd.pw_dir);
+    file = fopen(k5login, "w");
+    if (file == NULL)
+        sysbail("cannot create %s", k5login);
+    if (fprintf(file, "%s\n", krbconf->userprinc) < 0)
+        sysbail("cannot write to %s", k5login);
+    if (fclose(file) < 0)
+        sysbail("cannot flush %s", k5login);
+    run_script("data/scripts/realm/pass-user-realm", &config);
+    pam_set_pwd(NULL);
+    unlink(k5login);
+    free(k5login);
+    test_tmpdir_free(pwd.pw_dir);
+
+    /* Switch to the correct realm, but set the wrong realm in PAM. */
+    kerberos_generate_conf(krbconf->realm);
+    config.extra[0] = "bogus.example.com";
+    run_script("data/scripts/realm/fail-realm", &config);
+    run_script("data/scripts/realm/fail-bad-user-realm", &config);
+
+    return 0;
+}
diff --git a/tests/module/stacked-t.c b/tests/module/stacked-t.c
new file mode 100644
index 000000000000..ef8e70885ecb
--- /dev/null
+++ b/tests/module/stacked-t.c
@@ -0,0 +1,50 @@
+/*
+ * Authentication tests for the pam-krb5 module with an existing AUTHTOK.
+ *
+ * This test case includes tests that require Kerberos to be configured and a
+ * username and password available and that run with AUTHTOK already set, but
+ * which don't write a ticket cache (which requires additional work to test
+ * the cache ownership).
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    struct kerberos_config *krbconf;
+
+    /* Load the Kerberos principal and password from a file. */
+    krbconf = kerberos_setup(TAP_KRB_NEEDS_PASSWORD);
+    memset(&config, 0, sizeof(config));
+    config.user = krbconf->userprinc;
+    config.password = krbconf->password;
+    config.authtok = krbconf->password;
+
+    /*
+     * Generate a testing krb5.conf file with a nonexistent default realm so
+     * that we can be sure that our principals will stay fully-qualified in
+     * the logs.
+     */
+    kerberos_generate_conf("bogus.example.com");
+
+    plan_lazy();
+    run_script_dir("data/scripts/stacked", &config);
+
+    return 0;
+}
diff --git a/tests/module/trace-t.c b/tests/module/trace-t.c
new file mode 100644
index 000000000000..db3aa67f9e24
--- /dev/null
+++ b/tests/module/trace-t.c
@@ -0,0 +1,48 @@
+/*
+ * Tests for trace logging in the pam-krb5 module.
+ *
+ * Checks that trace logging is handled properly.  This is currently very
+ * simple and just checks that the file is created.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * SPDX-License-Identifier: BSD-3-clause or GPL-1+
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/script.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct script_config config;
+    char *tmpdir, *trace;
+
+    plan_lazy();
+
+    memset(&config, 0, sizeof(config));
+    config.user = "testuser";
+    tmpdir = test_tmpdir();
+    basprintf(&trace, "%s/trace", tmpdir);
+    config.extra[0] = trace;
+#ifdef HAVE_KRB5_SET_TRACE_FILENAME
+    run_script("data/scripts/trace/supported", &config);
+    is_int(0, access(trace, F_OK), "Trace file was created");
+    unlink(trace);
+#else
+    run_script("data/scripts/trace/unsupported", &config);
+    is_int(-1, access(trace, F_OK), "Trace file does not exist");
+#endif
+
+    free(trace);
+    test_tmpdir_free(tmpdir);
+    return 0;
+}
diff --git a/tests/pam-util/args-t.c b/tests/pam-util/args-t.c
new file mode 100644
index 000000000000..4ec102e511ed
--- /dev/null
+++ b/tests/pam-util/args-t.c
@@ -0,0 +1,86 @@
+/*
+ * PAM utility argument initialization test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010, 2012-2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <pam-util/args.h>
+#include <tests/fakepam/pam.h>
+#include <tests/tap/basic.h>
+
+
+int
+main(void)
+{
+    pam_handle_t *pamh;
+    struct pam_conv conv = {NULL, NULL};
+    struct pam_args *args;
+
+    plan(12);
+
+    if (pam_start("test", NULL, &conv, &pamh) != PAM_SUCCESS)
+        sysbail("Fake PAM initialization failed");
+    args = putil_args_new(pamh, 0);
+    ok(args != NULL, "New args struct is not NULL");
+    if (args == NULL)
+        ok_block(7, 0, "...args struct is NULL");
+    else {
+        ok(args->pamh == pamh, "...and pamh is correct");
+        ok(args->config == NULL, "...and config is NULL");
+        ok(args->user == NULL, "...and user is NULL");
+        is_int(args->debug, false, "...and debug is false");
+        is_int(args->silent, false, "...and silent is false");
+#ifdef HAVE_KRB5
+        ok(args->ctx != NULL, "...and the Kerberos context is initialized");
+        ok(args->realm == NULL, "...and realm is NULL");
+#else
+        skip_block(2, "Kerberos support not configured");
+#endif
+    }
+    putil_args_free(args);
+    ok(1, "Freeing the args struct works");
+
+    args = putil_args_new(pamh, PAM_SILENT);
+    ok(args != NULL, "New args struct with PAM_SILENT is not NULL");
+    if (args == NULL)
+        ok(0, "...args is NULL");
+    else
+        is_int(args->silent, true, "...and silent is true");
+    putil_args_free(args);
+
+    putil_args_free(NULL);
+    ok(1, "Freeing a NULL args struct works");
+
+    pam_end(pamh, 0);
+
+    return 0;
+}
diff --git a/tests/pam-util/fakepam-t.c b/tests/pam-util/fakepam-t.c
new file mode 100644
index 000000000000..1e09c5fdde75
--- /dev/null
+++ b/tests/pam-util/fakepam-t.c
@@ -0,0 +1,121 @@
+/*
+ * Fake PAM library test suite.
+ *
+ * This is not actually a test for the pam-util layer, but rather is a test
+ * for the trickier components of the fake PAM library that in turn is used to
+ * test the pam-util layer and PAM modules.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <tests/fakepam/pam.h>
+#include <tests/tap/basic.h>
+
+
+int
+main(void)
+{
+    pam_handle_t *pamh;
+    struct pam_conv conv = {NULL, NULL};
+    char **env;
+    size_t i;
+
+    /*
+     * Skip this test if the native PAM library doesn't support a PAM
+     * environment, since we "break" pam_putenv to mirror the native behavior
+     * in that case.
+     */
+#ifndef HAVE_PAM_GETENV
+    skip_all("system doesn't support PAM environment");
+#endif
+
+    plan(33);
+
+    /* Basic environment manipulation. */
+    if (pam_start("test", NULL, &conv, &pamh) != PAM_SUCCESS)
+        sysbail("Fake PAM initialization failed");
+    is_int(PAM_BAD_ITEM, pam_putenv(pamh, "TEST"), "delete when NULL");
+    ok(pam_getenv(pamh, "TEST") == NULL, "getenv when NULL");
+    env = pam_getenvlist(pamh);
+    ok(env != NULL, "getenvlist when NULL returns non-NULL");
+    if (env == NULL)
+        bail("pam_getenvlist returned NULL");
+    is_string(NULL, env[0], "...but first element is NULL");
+    for (i = 0; env[i] != NULL; i++)
+        free(env[i]);
+    free(env);
+
+    /* putenv and getenv. */
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "TEST=foo"), "putenv TEST");
+    is_string("foo", pam_getenv(pamh, "TEST"), "getenv TEST");
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "FOO=bar"), "putenv FOO");
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "BAR=baz"), "putenv BAR");
+    is_string("foo", pam_getenv(pamh, "TEST"), "getenv TEST");
+    is_string("bar", pam_getenv(pamh, "FOO"), "getenv FOO");
+    is_string("baz", pam_getenv(pamh, "BAR"), "getenv BAR");
+    ok(pam_getenv(pamh, "BAZ") == NULL, "getenv BAZ is NULL");
+
+    /* Replacing and deleting environment variables. */
+    is_int(PAM_BAD_ITEM, pam_putenv(pamh, "BAZ"), "putenv nonexistent delete");
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "FOO=foo"), "putenv replace");
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "FOON=bar=n"), "putenv prefix");
+    is_string("foo", pam_getenv(pamh, "FOO"), "getenv FOO");
+    is_string("bar=n", pam_getenv(pamh, "FOON"), "getenv FOON");
+    is_int(PAM_BAD_ITEM, pam_putenv(pamh, "FO"), "putenv delete FO");
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "FOO"), "putenv delete FOO");
+    ok(pam_getenv(pamh, "FOO") == NULL, "getenv FOO is NULL");
+    is_string("bar=n", pam_getenv(pamh, "FOON"), "getenv FOON");
+    is_string("baz", pam_getenv(pamh, "BAR"), "getenv BAR");
+
+    /* pam_getenvlist. */
+    env = pam_getenvlist(pamh);
+    ok(env != NULL, "getenvlist not NULL");
+    if (env == NULL)
+        bail("pam_getenvlist returned NULL");
+    is_string("TEST=foo", env[0], "getenvlist TEST");
+    is_string("BAR=baz", env[1], "getenvlist BAR");
+    is_string("FOON=bar=n", env[2], "getenvlist FOON");
+    ok(env[3] == NULL, "getenvlist length");
+    for (i = 0; env[i] != NULL; i++)
+        free(env[i]);
+    free(env);
+    is_int(PAM_SUCCESS, pam_putenv(pamh, "FOO=foo"), "putenv FOO");
+    is_string("TEST=foo", pamh->environ[0], "pamh environ TEST");
+    is_string("BAR=baz", pamh->environ[1], "pamh environ BAR");
+    is_string("FOON=bar=n", pamh->environ[2], "pamh environ FOON");
+    is_string("FOO=foo", pamh->environ[3], "pamh environ FOO");
+    ok(pamh->environ[4] == NULL, "pamh environ length");
+
+    pam_end(pamh, 0);
+
+    return 0;
+}
diff --git a/tests/pam-util/logging-t.c b/tests/pam-util/logging-t.c
new file mode 100644
index 000000000000..84072bd6b91a
--- /dev/null
+++ b/tests/pam-util/logging-t.c
@@ -0,0 +1,146 @@
+/*
+ * PAM logging test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <syslog.h>
+
+#include <pam-util/args.h>
+#include <pam-util/logging.h>
+#include <tests/fakepam/pam.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+/* Test a normal PAM logging function. */
+#define TEST(func, p, n)                                          \
+    do {                                                          \
+        (func)(args, "%s", "foo");                                \
+        seen = pam_output();                                      \
+        is_int((p), seen->lines[0].priority, "priority %d", (p)); \
+        is_string("foo", seen->lines[0].line, "line %s", (n));    \
+        pam_output_free(seen);                                    \
+    } while (0)
+
+/* Test a PAM error logging function. */
+#define TEST_PAM(func, c, p, n)                                   \
+    do {                                                          \
+        (func)(args, (c), "%s", "bar");                           \
+        if ((c) == PAM_SUCCESS)                                   \
+            expected = strdup("bar");                             \
+        else                                                      \
+            basprintf(&expected, "%s: %s", "bar",                 \
+                      pam_strerror(args->pamh, c));               \
+        seen = pam_output();                                      \
+        is_int((p), seen->lines[0].priority, "priority %s", (n)); \
+        is_string(expected, seen->lines[0].line, "line %s", (n)); \
+        pam_output_free(seen);                                    \
+        free(expected);                                           \
+    } while (0)
+
+/* Test a PAM Kerberos error logging function .*/
+#define TEST_KRB5(func, p, n)                                             \
+    do {                                                                  \
+        const char *msg;                                                  \
+                                                                          \
+        code = krb5_parse_name(args->ctx, "foo@bar@EXAMPLE.COM", &princ); \
+        (func)(args, code, "%s", "krb");                                  \
+        code = krb5_parse_name(args->ctx, "foo@bar@EXAMPLE.COM", &princ); \
+        msg = krb5_get_error_message(args->ctx, code);                    \
+        basprintf(&expected, "%s: %s", "krb", msg);                       \
+        seen = pam_output();                                              \
+        is_int((p), seen->lines[0].priority, "priority %s", (n));         \
+        is_string(expected, seen->lines[0].line, "line %s", (n));         \
+        pam_output_free(seen);                                            \
+        free(expected);                                                   \
+        krb5_free_error_message(args->ctx, msg);                          \
+    } while (0)
+
+
+int
+main(void)
+{
+    pam_handle_t *pamh;
+    struct pam_args *args;
+    struct pam_conv conv = {NULL, NULL};
+    char *expected;
+    struct output *seen;
+#ifdef HAVE_KRB5
+    krb5_error_code code;
+    krb5_principal princ;
+#endif
+
+    plan(27);
+
+    if (pam_start("test", NULL, &conv, &pamh) != PAM_SUCCESS)
+        sysbail("Fake PAM initialization failed");
+    args = putil_args_new(pamh, 0);
+    if (args == NULL)
+        bail("cannot create PAM argument struct");
+    TEST(putil_crit, LOG_CRIT, "putil_crit");
+    TEST(putil_err, LOG_ERR, "putil_err");
+    putil_debug(args, "%s", "foo");
+    ok(pam_output() == NULL, "putil_debug without debug on");
+    args->debug = true;
+    TEST(putil_debug, LOG_DEBUG, "putil_debug");
+    args->debug = false;
+
+    TEST_PAM(putil_crit_pam, PAM_SYSTEM_ERR, LOG_CRIT, "putil_crit_pam S");
+    TEST_PAM(putil_crit_pam, PAM_BUF_ERR, LOG_CRIT, "putil_crit_pam B");
+    TEST_PAM(putil_crit_pam, PAM_SUCCESS, LOG_CRIT, "putil_crit_pam ok");
+    TEST_PAM(putil_err_pam, PAM_SYSTEM_ERR, LOG_ERR, "putil_err_pam");
+    putil_debug_pam(args, PAM_SYSTEM_ERR, "%s", "bar");
+    ok(pam_output() == NULL, "putil_debug_pam without debug on");
+    args->debug = true;
+    TEST_PAM(putil_debug_pam, PAM_SYSTEM_ERR, LOG_DEBUG, "putil_debug_pam");
+    TEST_PAM(putil_debug_pam, PAM_SUCCESS, LOG_DEBUG, "putil_debug_pam ok");
+    args->debug = false;
+
+#ifdef HAVE_KRB5
+    TEST_KRB5(putil_crit_krb5, LOG_CRIT, "putil_crit_krb5");
+    TEST_KRB5(putil_err_krb5, LOG_ERR, "putil_err_krb5");
+    code = krb5_parse_name(args->ctx, "foo@bar@EXAMPLE.COM", &princ);
+    putil_debug_krb5(args, code, "%s", "krb");
+    ok(pam_output() == NULL, "putil_debug_krb5 without debug on");
+    args->debug = true;
+    TEST_KRB5(putil_debug_krb5, LOG_DEBUG, "putil_debug_krb5");
+    args->debug = false;
+#else
+    skip_block(4, "not built with Kerberos support");
+#endif
+
+    putil_args_free(args);
+    pam_end(pamh, 0);
+
+    return 0;
+}
diff --git a/tests/pam-util/options-t.c b/tests/pam-util/options-t.c
new file mode 100644
index 000000000000..f8b76730fb2d
--- /dev/null
+++ b/tests/pam-util/options-t.c
@@ -0,0 +1,458 @@
+/*
+ * PAM option parsing test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/pam.h>
+#include <portable/system.h>
+
+#include <syslog.h>
+
+#include <pam-util/args.h>
+#include <pam-util/options.h>
+#include <pam-util/vector.h>
+#include <tests/fakepam/pam.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+/* The configuration struct we will use for testing. */
+struct pam_config {
+    struct vector *cells;
+    bool debug;
+#ifdef HAVE_KRB5
+    krb5_deltat expires;
+#else
+    long expires;
+#endif
+    bool ignore_root;
+    long minimum_uid;
+    char *program;
+};
+
+#define K(name) (#name), offsetof(struct pam_config, name)
+
+/* The rules specifying the configuration options. */
+static struct option options[] = {
+    /* clang-format off */
+    { K(cells),       true,  LIST   (NULL)  },
+    { K(debug),       true,  BOOL   (false) },
+    { K(expires),     true,  TIME   (10)    },
+    { K(ignore_root), false, BOOL   (true)  },
+    { K(minimum_uid), true,  NUMBER (0)     },
+    { K(program),     true,  STRING (NULL)  },
+    /* clang-format on */
+};
+static const size_t optlen = sizeof(options) / sizeof(options[0]);
+
+/*
+ * A macro used to parse the various ways of spelling booleans.  This reuses
+ * the argv_bool variable, setting it to the first value provided and then
+ * calling putil_args_parse() on it.  It then checks whether the provided
+ * config option is set to the expected value.
+ */
+#define TEST_BOOL(a, c, v)                                              \
+    do {                                                                \
+        argv_bool[0] = (a);                                             \
+        status = putil_args_parse(args, 1, argv_bool, options, optlen); \
+        ok(status, "Parse of %s", (a));                                 \
+        is_int((v), (c), "...and value is correct");                    \
+        ok(pam_output() == NULL, "...and no output");                   \
+    } while (0)
+
+/*
+ * A macro used to test error reporting from putil_args_parse().  This reuses
+ * the argv_err variable, setting it to the first value provided and then
+ * calling putil_args_parse() on it.  It then recovers the error message and
+ * expects it to match the severity and error message given.
+ */
+#define TEST_ERROR(a, p, e)                                                  \
+    do {                                                                     \
+        argv_err[0] = (a);                                                   \
+        status = putil_args_parse(args, 1, argv_err, options, optlen);       \
+        ok(status, "Parse of %s", (a));                                      \
+        seen = pam_output();                                                 \
+        if (seen == NULL)                                                    \
+            ok_block(2, false, "...no error output");                        \
+        else {                                                               \
+            is_int((p), seen->lines[0].priority, "...priority for %s", (a)); \
+            is_string((e), seen->lines[0].line, "...error for %s", (a));     \
+        }                                                                    \
+        pam_output_free(seen);                                               \
+    } while (0)
+
+
+/*
+ * Allocate and initialize a new struct config.
+ */
+static struct pam_config *
+config_new(void)
+{
+    return bcalloc(1, sizeof(struct pam_config));
+}
+
+
+/*
+ * Free a struct config and all of its members.
+ */
+static void
+config_free(struct pam_config *config)
+{
+    if (config == NULL)
+        return;
+    vector_free(config->cells);
+    free(config->program);
+    free(config);
+}
+
+
+int
+main(void)
+{
+    pam_handle_t *pamh;
+    struct pam_args *args;
+    struct pam_conv conv = {NULL, NULL};
+    bool status;
+    struct vector *cells;
+    char *program;
+    struct output *seen;
+    const char *argv_bool[2] = {NULL, NULL};
+    const char *argv_err[2] = {NULL, NULL};
+    const char *argv_empty[] = {NULL};
+#ifdef HAVE_KRB5
+    const char *argv_all[] = {"cells=stanford.edu,ir.stanford.edu",
+                              "debug",
+                              "expires=1d",
+                              "ignore_root",
+                              "minimum_uid=1000",
+                              "program=/bin/true"};
+    char *krb5conf;
+#else
+    const char *argv_all[] = {"cells=stanford.edu,ir.stanford.edu",
+                              "debug",
+                              "expires=86400",
+                              "ignore_root",
+                              "minimum_uid=1000",
+                              "program=/bin/true"};
+#endif
+
+    if (pam_start("test", NULL, &conv, &pamh) != PAM_SUCCESS)
+        sysbail("cannot create pam_handle_t");
+    args = putil_args_new(pamh, 0);
+    if (args == NULL)
+        bail("cannot create PAM argument struct");
+
+    plan(161);
+
+    /* First, check just the defaults. */
+    args->config = config_new();
+    status = putil_args_defaults(args, options, optlen);
+    ok(status, "Setting the defaults");
+    ok(args->config->cells == NULL, "...cells default");
+    is_int(false, args->config->debug, "...debug default");
+    is_int(10, args->config->expires, "...expires default");
+    is_int(true, args->config->ignore_root, "...ignore_root default");
+    is_int(0, args->config->minimum_uid, "...minimum_uid default");
+    ok(args->config->program == NULL, "...program default");
+
+    /* Now parse an empty set of PAM arguments.  Nothing should change. */
+    status = putil_args_parse(args, 0, argv_empty, options, optlen);
+    ok(status, "Parse of empty argv");
+    ok(args->config->cells == NULL, "...cells still default");
+    is_int(false, args->config->debug, "...debug still default");
+    is_int(10, args->config->expires, "...expires default");
+    is_int(true, args->config->ignore_root, "...ignore_root still default");
+    is_int(0, args->config->minimum_uid, "...minimum_uid still default");
+    ok(args->config->program == NULL, "...program still default");
+
+    /* Now, check setting everything. */
+    status = putil_args_parse(args, 6, argv_all, options, optlen);
+    ok(status, "Parse of full argv");
+    if (args->config->cells == NULL)
+        ok_block(4, false, "...cells is set");
+    else {
+        ok(args->config->cells != NULL, "...cells is set");
+        is_int(2, args->config->cells->count, "...with two cells");
+        is_string("stanford.edu", args->config->cells->strings[0],
+                  "...first is stanford.edu");
+        is_string("ir.stanford.edu", args->config->cells->strings[1],
+                  "...second is ir.stanford.edu");
+    }
+    is_int(true, args->config->debug, "...debug is set");
+    is_int(86400, args->config->expires, "...expires is set");
+    is_int(true, args->config->ignore_root, "...ignore_root is set");
+    is_int(1000, args->config->minimum_uid, "...minimum_uid is set");
+    is_string("/bin/true", args->config->program, "...program is set");
+    config_free(args->config);
+    args->config = NULL;
+
+    /* Test deep copying of defaults. */
+    cells = vector_new();
+    if (cells == NULL)
+        sysbail("cannot allocate memory");
+    vector_add(cells, "foo.com");
+    vector_add(cells, "bar.com");
+    options[0].defaults.list = cells;
+    program = strdup("/bin/false");
+    if (program == NULL)
+        sysbail("cannot allocate memory");
+    options[5].defaults.string = program;
+    args->config = config_new();
+    status = putil_args_defaults(args, options, optlen);
+    ok(status, "Setting defaults with new defaults");
+    if (args->config->cells == NULL)
+        ok_block(4, false, "...cells is set");
+    else {
+        ok(args->config->cells != NULL, "...cells is set");
+        is_int(2, args->config->cells->count, "...with two cells");
+        is_string("foo.com", args->config->cells->strings[0],
+                  "...first is foo.com");
+        is_string("bar.com", args->config->cells->strings[1],
+                  "...second is bar.com");
+    }
+    is_string("/bin/false", args->config->program, "...program is /bin/false");
+    status = putil_args_parse(args, 6, argv_all, options, optlen);
+    ok(status, "Parse of full argv after defaults");
+    if (args->config->cells == NULL)
+        ok_block(4, false, "...cells is set");
+    else {
+        ok(args->config->cells != NULL, "...cells is set");
+        is_int(2, args->config->cells->count, "...with two cells");
+        is_string("stanford.edu", args->config->cells->strings[0],
+                  "...first is stanford.edu");
+        is_string("ir.stanford.edu", args->config->cells->strings[1],
+                  "...second is ir.stanford.edu");
+    }
+    is_int(true, args->config->debug, "...debug is set");
+    is_int(86400, args->config->expires, "...expires is set");
+    is_int(true, args->config->ignore_root, "...ignore_root is set");
+    is_int(1000, args->config->minimum_uid, "...minimum_uid is set");
+    is_string("/bin/true", args->config->program, "...program is set");
+    is_string("foo.com", cells->strings[0], "...first cell after parse");
+    is_string("bar.com", cells->strings[1], "...second cell after parse");
+    is_string("/bin/false", program, "...string after parse");
+    config_free(args->config);
+    args->config = NULL;
+    is_string("foo.com", cells->strings[0], "...first cell after free");
+    is_string("bar.com", cells->strings[1], "...second cell after free");
+    is_string("/bin/false", program, "...string after free");
+    options[0].defaults.list = NULL;
+    options[5].defaults.string = NULL;
+    vector_free(cells);
+    free(program);
+
+    /* Test specifying the default for a vector parameter as a string. */
+    options[0].type = TYPE_STRLIST;
+    options[0].defaults.string = "foo.com,bar.com";
+    args->config = config_new();
+    status = putil_args_defaults(args, options, optlen);
+    ok(status, "Setting defaults with string default for vector");
+    if (args->config->cells == NULL)
+        ok_block(4, false, "...cells is set");
+    else {
+        ok(args->config->cells != NULL, "...cells is set");
+        is_int(2, args->config->cells->count, "...with two cells");
+        is_string("foo.com", args->config->cells->strings[0],
+                  "...first is foo.com");
+        is_string("bar.com", args->config->cells->strings[1],
+                  "...second is bar.com");
+    }
+    config_free(args->config);
+    args->config = NULL;
+    options[0].type = TYPE_LIST;
+    options[0].defaults.string = NULL;
+
+    /* Should be no errors so far. */
+    ok(pam_output() == NULL, "No errors so far");
+
+    /* Test various ways of spelling booleans. */
+    args->config = config_new();
+    TEST_BOOL("debug", args->config->debug, true);
+    TEST_BOOL("debug=false", args->config->debug, false);
+    TEST_BOOL("debug=true", args->config->debug, true);
+    TEST_BOOL("debug=no", args->config->debug, false);
+    TEST_BOOL("debug=yes", args->config->debug, true);
+    TEST_BOOL("debug=off", args->config->debug, false);
+    TEST_BOOL("debug=on", args->config->debug, true);
+    TEST_BOOL("debug=0", args->config->debug, false);
+    TEST_BOOL("debug=1", args->config->debug, true);
+    TEST_BOOL("debug=False", args->config->debug, false);
+    TEST_BOOL("debug=trUe", args->config->debug, true);
+    TEST_BOOL("debug=No", args->config->debug, false);
+    TEST_BOOL("debug=Yes", args->config->debug, true);
+    TEST_BOOL("debug=OFF", args->config->debug, false);
+    TEST_BOOL("debug=ON", args->config->debug, true);
+    config_free(args->config);
+    args->config = NULL;
+
+    /* Test for various parsing errors. */
+    args->config = config_new();
+    TEST_ERROR("debug=", LOG_ERR, "invalid boolean in setting: debug=");
+    TEST_ERROR("debug=truth", LOG_ERR,
+               "invalid boolean in setting: debug=truth");
+    TEST_ERROR("minimum_uid", LOG_ERR, "value missing for option minimum_uid");
+    TEST_ERROR("minimum_uid=", LOG_ERR,
+               "value missing for option minimum_uid=");
+    TEST_ERROR("minimum_uid=foo", LOG_ERR,
+               "invalid number in setting: minimum_uid=foo");
+    TEST_ERROR("minimum_uid=1000foo", LOG_ERR,
+               "invalid number in setting: minimum_uid=1000foo");
+    TEST_ERROR("program", LOG_ERR, "value missing for option program");
+    TEST_ERROR("cells", LOG_ERR, "value missing for option cells");
+    config_free(args->config);
+    args->config = NULL;
+
+#ifdef HAVE_KRB5
+
+    /* Test for Kerberos krb5.conf option parsing. */
+    krb5conf = test_file_path("data/krb5-pam.conf");
+    if (krb5conf == NULL)
+        bail("cannot find data/krb5-pam.conf");
+    if (setenv("KRB5_CONFIG", krb5conf, 1) < 0)
+        sysbail("cannot set KRB5_CONFIG");
+    krb5_free_context(args->ctx);
+    status = krb5_init_context(&args->ctx);
+    if (status != 0)
+        bail("cannot parse test krb5.conf file");
+    args->config = config_new();
+    status = putil_args_defaults(args, options, optlen);
+    ok(status, "Setting the defaults");
+    status = putil_args_krb5(args, "testing", options, optlen);
+    ok(status, "Options from krb5.conf");
+    ok(args->config->cells == NULL, "...cells default");
+    is_int(true, args->config->debug, "...debug set from krb5.conf");
+    is_int(1800, args->config->expires, "...expires set from krb5.conf");
+    is_int(true, args->config->ignore_root, "...ignore_root default");
+    is_int(1000, args->config->minimum_uid,
+           "...minimum_uid set from krb5.conf");
+    ok(args->config->program == NULL, "...program default");
+    status = putil_args_krb5(args, "other-test", options, optlen);
+    ok(status, "Options from krb5.conf (other-test)");
+    is_int(-1000, args->config->minimum_uid,
+           "...minimum_uid set from krb5.conf other-test");
+
+    /* Test with a realm set, which should expose more settings. */
+    krb5_free_context(args->ctx);
+    status = krb5_init_context(&args->ctx);
+    if (status != 0)
+        bail("cannot parse test krb5.conf file");
+    args->realm = strdup("FOO.COM");
+    if (args->realm == NULL)
+        sysbail("cannot allocate memory");
+    status = putil_args_krb5(args, "testing", options, optlen);
+    ok(status, "Options from krb5.conf with FOO.COM");
+    is_int(2, args->config->cells->count, "...cells count from krb5.conf");
+    is_string("foo.com", args->config->cells->strings[0],
+              "...first cell from krb5.conf");
+    is_string("bar.com", args->config->cells->strings[1],
+              "...second cell from krb5.conf");
+    is_int(true, args->config->debug, "...debug set from krb5.conf");
+    is_int(1800, args->config->expires, "...expires set from krb5.conf");
+    is_int(true, args->config->ignore_root, "...ignore_root default");
+    is_int(1000, args->config->minimum_uid,
+           "...minimum_uid set from krb5.conf");
+    is_string("/bin/false", args->config->program,
+              "...program from krb5.conf");
+
+    /* Test with a different realm. */
+    free(args->realm);
+    args->realm = strdup("BAR.COM");
+    if (args->realm == NULL)
+        sysbail("cannot allocate memory");
+    status = putil_args_krb5(args, "testing", options, optlen);
+    ok(status, "Options from krb5.conf with BAR.COM");
+    is_int(2, args->config->cells->count, "...cells count from krb5.conf");
+    is_string("bar.com", args->config->cells->strings[0],
+              "...first cell from krb5.conf");
+    is_string("foo.com", args->config->cells->strings[1],
+              "...second cell from krb5.conf");
+    is_int(true, args->config->debug, "...debug set from krb5.conf");
+    is_int(1800, args->config->expires, "...expires set from krb5.conf");
+    is_int(true, args->config->ignore_root, "...ignore_root default");
+    is_int(1000, args->config->minimum_uid,
+           "...minimum_uid set from krb5.conf");
+    is_string("echo /bin/true", args->config->program,
+              "...program from krb5.conf");
+    config_free(args->config);
+    args->config = config_new();
+    status = putil_args_krb5(args, "other-test", options, optlen);
+    ok(status, "Options from krb5.conf (other-test with realm)");
+    ok(args->config->cells == NULL, "...cells is NULL");
+    is_string("echo /bin/true", args->config->program,
+              "...program from krb5.conf");
+    config_free(args->config);
+    args->config = NULL;
+
+    /* Test for time parsing errors. */
+    args->config = config_new();
+    TEST_ERROR("expires=ft87", LOG_ERR,
+               "bad time value in setting: expires=ft87");
+    config_free(args->config);
+
+    /* Test error reporting from the krb5.conf parser. */
+    args->config = config_new();
+    status = putil_args_krb5(args, "bad-number", options, optlen);
+    ok(status, "Options from krb5.conf (bad-number)");
+    seen = pam_output();
+    is_string("invalid number in krb5.conf setting for minimum_uid: 1000foo",
+              seen->lines[0].line, "...and correct error reported");
+    is_int(LOG_ERR, seen->lines[0].priority, "...with correct priority");
+    pam_output_free(seen);
+    config_free(args->config);
+    args->config = NULL;
+
+    /* Test error reporting on times from the krb5.conf parser. */
+    args->config = config_new();
+    status = putil_args_krb5(args, "bad-time", options, optlen);
+    ok(status, "Options from krb5.conf (bad-time)");
+    seen = pam_output();
+    if (seen == NULL)
+        ok_block(2, false, "...no error output");
+    else {
+        is_string("invalid time in krb5.conf setting for expires: ft87",
+                  seen->lines[0].line, "...and correct error reported");
+        is_int(LOG_ERR, seen->lines[0].priority, "...with correct priority");
+    }
+    pam_output_free(seen);
+    config_free(args->config);
+    args->config = NULL;
+
+    test_file_path_free(krb5conf);
+
+#else /* !HAVE_KRB5 */
+
+    skip_block(37, "Kerberos support not configured");
+
+#endif
+
+    putil_args_free(args);
+    pam_end(pamh, 0);
+    return 0;
+}
diff --git a/tests/pam-util/vector-t.c b/tests/pam-util/vector-t.c
new file mode 100644
index 000000000000..d7b87e36d8f4
--- /dev/null
+++ b/tests/pam-util/vector-t.c
@@ -0,0 +1,149 @@
+/*
+ * PAM utility vector library test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2014, 2016, 2018-2019 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2010-2011, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <sys/wait.h>
+
+#include <pam-util/vector.h>
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+
+int
+main(void)
+{
+    struct vector *vector, *ovector, *copy;
+    char *command, *string;
+    const char *env[2];
+    pid_t child;
+    size_t i;
+    const char cstring[] = "This is a\ttest.  ";
+
+    plan(60);
+
+    vector = vector_new();
+    ok(vector != NULL, "vector_new returns non-NULL");
+    if (vector == NULL)
+        bail("vector_new returned NULL");
+    ok(vector_add(vector, cstring), "vector_add succeeds");
+    is_int(1, vector->count, "vector_add increases count");
+    ok(vector->strings[0] != cstring, "...and allocated new memory");
+    ok(vector_resize(vector, 4), "vector_resize succeeds");
+    is_int(4, vector->allocated, "vector_resize works");
+    ok(vector_add(vector, cstring), "vector_add #2");
+    ok(vector_add(vector, cstring), "vector_add #3");
+    ok(vector_add(vector, cstring), "vector_add #4");
+    is_int(4, vector->allocated, "...and no reallocation when adding strings");
+    is_int(4, vector->count, "...and the count matches");
+    is_string(cstring, vector->strings[0], "added the right string");
+    is_string(cstring, vector->strings[1], "added the right string");
+    is_string(cstring, vector->strings[2], "added the right string");
+    is_string(cstring, vector->strings[3], "added the right string");
+    ok(vector->strings[1] != vector->strings[2], "each pointer is different");
+    ok(vector->strings[2] != vector->strings[3], "each pointer is different");
+    ok(vector->strings[3] != vector->strings[0], "each pointer is different");
+    ok(vector->strings[0] != cstring, "each pointer is different");
+    copy = vector_copy(vector);
+    ok(copy != NULL, "vector_copy returns non-NULL");
+    if (copy == NULL)
+        bail("vector_copy returned NULL");
+    is_int(4, copy->count, "...and has right count");
+    is_int(4, copy->allocated, "...and has right allocated count");
+    for (i = 0; i < 4; i++) {
+        is_string(cstring, copy->strings[i], "...and string %lu is right",
+                  (unsigned long) i);
+        ok(copy->strings[i] != vector->strings[i],
+           "...and pointer %lu is different", (unsigned long) i);
+    }
+    vector_free(copy);
+    vector_clear(vector);
+    is_int(0, vector->count, "vector_clear works");
+    is_int(4, vector->allocated, "...but doesn't free the allocation");
+    string = strdup(cstring);
+    if (string == NULL)
+        sysbail("cannot allocate memory");
+    ok(vector_add(vector, cstring), "vector_add succeeds");
+    ok(vector_add(vector, string), "vector_add succeeds");
+    is_int(2, vector->count, "added two strings to the vector");
+    ok(vector->strings[1] != string, "...and the pointers are different");
+    ok(vector_resize(vector, 1), "vector_resize succeeds");
+    is_int(1, vector->count, "vector_resize shrinks the vector");
+    ok(vector->strings[0] != cstring, "...and the pointer is different");
+    vector_free(vector);
+    free(string);
+
+    vector = vector_split_multi("foo, bar, baz", ", ", NULL);
+    ok(vector != NULL, "vector_split_multi returns non-NULL");
+    if (vector == NULL)
+        bail("vector_split_multi returned NULL");
+    is_int(3, vector->count, "vector_split_multi returns right count");
+    is_string("foo", vector->strings[0], "...first string");
+    is_string("bar", vector->strings[1], "...second string");
+    is_string("baz", vector->strings[2], "...third string");
+    ovector = vector;
+    vector = vector_split_multi("", ", ", vector);
+    ok(vector != NULL, "reuse of vector doesn't return NULL");
+    ok(vector == ovector, "...and reuses the same vector pointer");
+    is_int(0, vector->count, "vector_split_multi reuse with empty string");
+    is_int(3, vector->allocated, "...and doesn't free allocation");
+    vector = vector_split_multi(",,,  foo,   ", ", ", vector);
+    ok(vector != NULL, "reuse of vector doesn't return NULL");
+    is_int(1, vector->count, "vector_split_multi with extra separators");
+    is_string("foo", vector->strings[0], "...first string");
+    vector = vector_split_multi(", ,  ", ", ", vector);
+    is_int(0, vector->count, "vector_split_multi with only separators");
+    vector_free(vector);
+
+    vector = vector_new();
+    ok(vector_add(vector, "/bin/sh"), "vector_add succeeds");
+    ok(vector_add(vector, "-c"), "vector_add succeeds");
+    basprintf(&command, "echo ok %lu - vector_exec", testnum++);
+    ok(vector_add(vector, command), "vector_add succeeds");
+    child = fork();
+    if (child < 0)
+        sysbail("unable to fork");
+    else if (child == 0)
+        if (vector_exec("/bin/sh", vector) < 0)
+            sysdiag("unable to exec /bin/sh");
+    waitpid(child, NULL, 0);
+    vector_free(vector);
+    free(command);
+
+    vector = vector_new();
+    ok(vector_add(vector, "/bin/sh"), "vector_add succeeds");
+    ok(vector_add(vector, "-c"), "vector_add succeeds");
+    ok(vector_add(vector, "echo ok $NUMBER - vector_exec_env"),
+       "vector_add succeeds");
+    basprintf(&string, "NUMBER=%lu", testnum++);
+    env[0] = string;
+    env[1] = NULL;
+    child = fork();
+    if (child < 0)
+        sysbail("unable to fork");
+    else if (child == 0)
+        if (vector_exec_env("/bin/sh", vector, env) < 0)
+            sysdiag("unable to exec /bin/sh");
+    waitpid(child, NULL, 0);
+    vector_free(vector);
+    free(string);
+
+    return 0;
+}
diff --git a/tests/portable/asprintf-t.c b/tests/portable/asprintf-t.c
new file mode 100644
index 000000000000..3b10a6622c31
--- /dev/null
+++ b/tests/portable/asprintf-t.c
@@ -0,0 +1,69 @@
+/*
+ * asprintf and vasprintf test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2014, 2018 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2009, 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/macros.h>
+#include <portable/system.h>
+
+#include <tests/tap/basic.h>
+
+int test_asprintf(char **, const char *, ...)
+    __attribute__((__format__(printf, 2, 3)));
+int test_vasprintf(char **, const char *, va_list)
+    __attribute__((__format__(printf, 2, 0)));
+
+static int __attribute__((__format__(printf, 2, 3)))
+vatest(char **result, const char *format, ...)
+{
+    va_list args;
+    int status;
+
+    va_start(args, format);
+    status = test_vasprintf(result, format, args);
+    va_end(args);
+    return status;
+}
+
+int
+main(void)
+{
+    char *result = NULL;
+
+    plan(12);
+
+    is_int(7, test_asprintf(&result, "%s", "testing"), "asprintf length");
+    is_string("testing", result, "asprintf result");
+    free(result);
+    ok(3, "free asprintf");
+    is_int(0, test_asprintf(&result, "%s", ""), "asprintf empty length");
+    is_string("", result, "asprintf empty string");
+    free(result);
+    ok(6, "free asprintf of empty string");
+
+    is_int(6, vatest(&result, "%d %s", 2, "test"), "vasprintf length");
+    is_string("2 test", result, "vasprintf result");
+    free(result);
+    ok(9, "free vasprintf");
+    is_int(0, vatest(&result, "%s", ""), "vasprintf empty length");
+    is_string("", result, "vasprintf empty string");
+    free(result);
+    ok(12, "free vasprintf of empty string");
+
+    return 0;
+}
diff --git a/tests/portable/asprintf.c b/tests/portable/asprintf.c
new file mode 100644
index 000000000000..221c9932c5cd
--- /dev/null
+++ b/tests/portable/asprintf.c
@@ -0,0 +1,2 @@
+#define TESTING 1
+#include <portable/asprintf.c>
diff --git a/tests/portable/mkstemp-t.c b/tests/portable/mkstemp-t.c
new file mode 100644
index 000000000000..dc268210f063
--- /dev/null
+++ b/tests/portable/mkstemp-t.c
@@ -0,0 +1,81 @@
+/*
+ * mkstemp test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2009, 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <errno.h>
+#include <sys/stat.h>
+
+#include <tests/tap/basic.h>
+
+int test_mkstemp(char *template);
+
+int
+main(void)
+{
+    int fd;
+    char template[] = "tsXXXXXXX";
+    char tooshort[] = "XXXXX";
+    char bad1[] = "/foo/barXXXXX";
+    char bad2[] = "/foo/barXXXXXX.out";
+    char buffer[256];
+    struct stat st1, st2;
+    ssize_t length;
+
+    plan(20);
+
+    /* First, test a few error messages. */
+    errno = 0;
+    is_int(-1, test_mkstemp(tooshort), "too short of template");
+    is_int(EINVAL, errno, "...with correct errno");
+    is_string("XXXXX", tooshort, "...and template didn't change");
+    errno = 0;
+    is_int(-1, test_mkstemp(bad1), "bad template");
+    is_int(EINVAL, errno, "...with correct errno");
+    is_string("/foo/barXXXXX", bad1, "...and template didn't change");
+    errno = 0;
+    is_int(-1, test_mkstemp(bad2), "template doesn't end in XXXXXX");
+    is_int(EINVAL, errno, "...with correct errno");
+    is_string("/foo/barXXXXXX.out", bad2, "...and template didn't change");
+    errno = 0;
+
+    /* Now try creating a real file. */
+    fd = test_mkstemp(template);
+    ok(fd >= 0, "mkstemp works with valid template");
+    ok(strcmp(template, "tsXXXXXXX") != 0, "...and template changed");
+    ok(strncmp(template, "tsX", 3) == 0, "...and didn't touch first X");
+    ok(access(template, F_OK) == 0, "...and the file exists");
+
+    /* Make sure that it's the same file as template refers to now. */
+    ok(stat(template, &st1) == 0, "...and stat of template works");
+    ok(fstat(fd, &st2) == 0, "...and stat of open file descriptor works");
+    ok(st1.st_ino == st2.st_ino, "...and they're the same file");
+    unlink(template);
+
+    /* Make sure the open mode is correct. */
+    length = strlen(template);
+    is_int(length, write(fd, template, length), "write to open file works");
+    ok(lseek(fd, 0, SEEK_SET) == 0, "...and rewind works");
+    is_int(length, read(fd, buffer, length), "...and the data is there");
+    buffer[length] = '\0';
+    is_string(template, buffer, "...and matches what we wrote");
+    close(fd);
+
+    return 0;
+}
diff --git a/tests/portable/mkstemp.c b/tests/portable/mkstemp.c
new file mode 100644
index 000000000000..4632d3de86ed
--- /dev/null
+++ b/tests/portable/mkstemp.c
@@ -0,0 +1,2 @@
+#define TESTING 1
+#include <portable/mkstemp.c>
diff --git a/tests/portable/strndup-t.c b/tests/portable/strndup-t.c
new file mode 100644
index 000000000000..9bf28a31beec
--- /dev/null
+++ b/tests/portable/strndup-t.c
@@ -0,0 +1,60 @@
+/*
+ * strndup test suite.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2018 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011-2012
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Copying and distribution of this file, with or without modification, are
+ * permitted in any medium without royalty provided the copyright notice and
+ * this notice are preserved.  This file is offered as-is, without any
+ * warranty.
+ *
+ * SPDX-License-Identifier: FSFAP
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <errno.h>
+
+#include <tests/tap/basic.h>
+
+char *test_strndup(const char *, size_t);
+
+
+int
+main(void)
+{
+    char buffer[3];
+    char *result;
+
+    plan(7);
+
+    result = test_strndup("foo", 8);
+    is_string("foo", result, "strndup longer than string");
+    free(result);
+    result = test_strndup("foo", 2);
+    is_string("fo", result, "strndup shorter than string");
+    free(result);
+    result = test_strndup("foo", 3);
+    is_string("foo", result, "strndup same size as string");
+    free(result);
+    result = test_strndup("foo", 0);
+    is_string("", result, "strndup of size 0");
+    free(result);
+    memcpy(buffer, "foo", 3);
+    result = test_strndup(buffer, 3);
+    is_string("foo", result, "strndup of non-nul-terminated string");
+    free(result);
+    errno = 0;
+    result = test_strndup(NULL, 0);
+    is_string(NULL, result, "strndup of NULL");
+    is_int(errno, EINVAL, "...and returns EINVAL");
+
+    return 0;
+}
diff --git a/tests/portable/strndup.c b/tests/portable/strndup.c
new file mode 100644
index 000000000000..99c3bc13a744
--- /dev/null
+++ b/tests/portable/strndup.c
@@ -0,0 +1,2 @@
+#define TESTING 1
+#include <portable/strndup.c>
diff --git a/tests/runtests.c b/tests/runtests.c
new file mode 100644
index 000000000000..54ec1c93d08b
--- /dev/null
+++ b/tests/runtests.c
@@ -0,0 +1,1782 @@
+/*
+ * Run a set of tests, reporting results.
+ *
+ * Test suite driver that runs a set of tests implementing a subset of the
+ * Test Anything Protocol (TAP) and reports the results.
+ *
+ * Any bug reports, bug fixes, and improvements are very much welcome and
+ * should be sent to the e-mail address below.  This program is part of C TAP
+ * Harness <https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+ *
+ * Copyright 2000-2001, 2004, 2006-2019 Russ Allbery <eagle@eyrie.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+/*
+ * Usage:
+ *
+ *      runtests [-hv] [-b <build-dir>] [-s <source-dir>] -l <test-list>
+ *      runtests [-hv] [-b <build-dir>] [-s <source-dir>] <test> [<test> ...]
+ *      runtests -o [-h] [-b <build-dir>] [-s <source-dir>] <test>
+ *
+ * In the first case, expects a list of executables located in the given file,
+ * one line per executable, possibly followed by a space-separated list of
+ * options.  For each one, runs it as part of a test suite, reporting results.
+ * In the second case, use the same infrastructure, but run only the tests
+ * listed on the command line.
+ *
+ * Test output should start with a line containing the number of tests
+ * (numbered from 1 to this number), optionally preceded by "1..", although
+ * that line may be given anywhere in the output.  Each additional line should
+ * be in the following format:
+ *
+ *      ok <number>
+ *      not ok <number>
+ *      ok <number> # skip
+ *      not ok <number> # todo
+ *
+ * where <number> is the number of the test.  An optional comment is permitted
+ * after the number if preceded by whitespace.  ok indicates success, not ok
+ * indicates failure.  "# skip" and "# todo" are a special cases of a comment,
+ * and must start with exactly that formatting.  They indicate the test was
+ * skipped for some reason (maybe because it doesn't apply to this platform)
+ * or is testing something known to currently fail.  The text following either
+ * "# skip" or "# todo" and whitespace is the reason.
+ *
+ * As a special case, the first line of the output may be in the form:
+ *
+ *      1..0 # skip some reason
+ *
+ * which indicates that this entire test case should be skipped and gives a
+ * reason.
+ *
+ * Any other lines are ignored, although for compliance with the TAP protocol
+ * all lines other than the ones in the above format should be sent to
+ * standard error rather than standard output and start with #.
+ *
+ * This is a subset of TAP as documented in Test::Harness::TAP or
+ * TAP::Parser::Grammar, which comes with Perl.
+ *
+ * If the -o option is given, instead run a single test and display all of its
+ * output.  This is intended for use with failing tests so that the person
+ * running the test suite can get more details about what failed.
+ *
+ * If built with the C preprocessor symbols C_TAP_SOURCE and C_TAP_BUILD
+ * defined, C TAP Harness will export those values in the environment so that
+ * tests can find the source and build directory and will look for tests under
+ * both directories.  These paths can also be set with the -b and -s
+ * command-line options, which will override anything set at build time.
+ *
+ * If the -v option is given, or the C_TAP_VERBOSE environment variable is set,
+ * display the full output of each test as it runs rather than showing a
+ * summary of the results of each test.
+ */
+
+/* Required for fdopen(), getopt(), and putenv(). */
+#if defined(__STRICT_ANSI__) || defined(PEDANTIC)
+#    ifndef _XOPEN_SOURCE
+#        define _XOPEN_SOURCE 500
+#    endif
+#endif
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+/* sys/time.h must be included before sys/resource.h on some platforms. */
+#include <sys/resource.h>
+
+/* AIX 6.1 (and possibly later) doesn't have WCOREDUMP. */
+#ifndef WCOREDUMP
+#    define WCOREDUMP(status) ((unsigned) (status) &0x80)
+#endif
+
+/*
+ * POSIX requires that these be defined in <unistd.h>, but they're not always
+ * available.  If one of them has been defined, all the rest almost certainly
+ * have.
+ */
+#ifndef STDIN_FILENO
+#    define STDIN_FILENO  0
+#    define STDOUT_FILENO 1
+#    define STDERR_FILENO 2
+#endif
+
+/*
+ * Used for iterating through arrays.  Returns the number of elements in the
+ * array (useful for a < upper bound in a for loop).
+ */
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
+
+/*
+ * The source and build versions of the tests directory.  This is used to set
+ * the C_TAP_SOURCE and C_TAP_BUILD environment variables (and the SOURCE and
+ * BUILD environment variables set for backward compatibility) and find test
+ * programs, if set.  Normally, this should be set as part of the build
+ * process to the test subdirectories of $(abs_top_srcdir) and
+ * $(abs_top_builddir) respectively.
+ */
+#ifndef C_TAP_SOURCE
+#    define C_TAP_SOURCE NULL
+#endif
+#ifndef C_TAP_BUILD
+#    define C_TAP_BUILD NULL
+#endif
+
+/* Test status codes. */
+enum test_status
+{
+    TEST_FAIL,
+    TEST_PASS,
+    TEST_SKIP,
+    TEST_INVALID
+};
+
+/* Really, just a boolean, but this is more self-documenting. */
+enum test_verbose
+{
+    CONCISE = 0,
+    VERBOSE = 1
+};
+
+/* Indicates the state of our plan. */
+enum plan_status
+{
+    PLAN_INIT,    /* Nothing seen yet. */
+    PLAN_FIRST,   /* Plan seen before any tests. */
+    PLAN_PENDING, /* Test seen and no plan yet. */
+    PLAN_FINAL    /* Plan seen after some tests. */
+};
+
+/* Error exit statuses for test processes. */
+#define CHILDERR_DUP    100 /* Couldn't redirect stderr or stdout. */
+#define CHILDERR_EXEC   101 /* Couldn't exec child process. */
+#define CHILDERR_STDIN  102 /* Couldn't open stdin file. */
+#define CHILDERR_STDERR 103 /* Couldn't open stderr file. */
+
+/* Structure to hold data for a set of tests. */
+struct testset {
+    char *file;                /* The file name of the test. */
+    char **command;            /* The argv vector to run the command. */
+    enum plan_status plan;     /* The status of our plan. */
+    unsigned long count;       /* Expected count of tests. */
+    unsigned long current;     /* The last seen test number. */
+    unsigned int length;       /* The length of the last status message. */
+    unsigned long passed;      /* Count of passing tests. */
+    unsigned long failed;      /* Count of failing lists. */
+    unsigned long skipped;     /* Count of skipped tests (passed). */
+    unsigned long allocated;   /* The size of the results table. */
+    enum test_status *results; /* Table of results by test number. */
+    unsigned int aborted;      /* Whether the set was aborted. */
+    unsigned int reported;     /* Whether the results were reported. */
+    int status;                /* The exit status of the test. */
+    unsigned int all_skipped;  /* Whether all tests were skipped. */
+    char *reason;              /* Why all tests were skipped. */
+};
+
+/* Structure to hold a linked list of test sets. */
+struct testlist {
+    struct testset *ts;
+    struct testlist *next;
+};
+
+/*
+ * Usage message.  Should be used as a printf format with four arguments: the
+ * path to runtests, given three times, and the usage_description.  This is
+ * split into variables to satisfy the pedantic ISO C90 limit on strings.
+ */
+static const char usage_message[] = "\
+Usage: %s [-hv] [-b <build-dir>] [-s <source-dir>] <test> ...\n\
+       %s [-hv] [-b <build-dir>] [-s <source-dir>] -l <test-list>\n\
+       %s -o [-h] [-b <build-dir>] [-s <source-dir>] <test>\n\
+\n\
+Options:\n\
+    -b <build-dir>      Set the build directory to <build-dir>\n\
+%s";
+static const char usage_extra[] = "\
+    -l <list>           Take the list of tests to run from <test-list>\n\
+    -o                  Run a single test rather than a list of tests\n\
+    -s <source-dir>     Set the source directory to <source-dir>\n\
+    -v                  Show the full output of each test\n\
+\n\
+runtests normally runs each test listed on the command line.  With the -l\n\
+option, it instead runs every test listed in a file.  With the -o option,\n\
+it instead runs a single test and shows its complete output.\n";
+
+/*
+ * Header used for test output.  %s is replaced by the file name of the list
+ * of tests.
+ */
+static const char banner[] = "\n\
+Running all tests listed in %s.  If any tests fail, run the failing\n\
+test program with runtests -o to see more details.\n\n";
+
+/* Header for reports of failed tests. */
+static const char header[] = "\n\
+Failed Set                 Fail/Total (%) Skip Stat  Failing Tests\n\
+-------------------------- -------------- ---- ----  ------------------------";
+
+/* Include the file name and line number in malloc failures. */
+#define xcalloc(n, type) \
+    ((type *) x_calloc((n), sizeof(type), __FILE__, __LINE__))
+#define xmalloc(size)     ((char *) x_malloc((size), __FILE__, __LINE__))
+#define xstrdup(p)        x_strdup((p), __FILE__, __LINE__)
+#define xstrndup(p, size) x_strndup((p), (size), __FILE__, __LINE__)
+#define xreallocarray(p, n, type) \
+    ((type *) x_reallocarray((p), (n), sizeof(type), __FILE__, __LINE__))
+
+/*
+ * __attribute__ is available in gcc 2.5 and later, but only with gcc 2.7
+ * could you use the __format__ form of the attributes, which is what we use
+ * (to avoid confusion with other macros).
+ */
+#ifndef __attribute__
+#    if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 7)
+#        define __attribute__(spec) /* empty */
+#    endif
+#endif
+
+/*
+ * We use __alloc_size__, but it was only available in fairly recent versions
+ * of GCC.  Suppress warnings about the unknown attribute if GCC is too old.
+ * We know that we're GCC at this point, so we can use the GCC variadic macro
+ * extension, which will still work with versions of GCC too old to have C99
+ * variadic macro support.
+ */
+#if !defined(__attribute__) && !defined(__alloc_size__)
+#    if defined(__GNUC__) && !defined(__clang__)
+#        if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 3)
+#            define __alloc_size__(spec, args...) /* empty */
+#        endif
+#    endif
+#endif
+
+/*
+ * LLVM and Clang pretend to be GCC but don't support all of the __attribute__
+ * settings that GCC does.  For them, suppress warnings about unknown
+ * attributes on declarations.  This unfortunately will affect the entire
+ * compilation context, but there's no push and pop available.
+ */
+#if !defined(__attribute__) && (defined(__llvm__) || defined(__clang__))
+#    pragma GCC diagnostic ignored "-Wattributes"
+#endif
+
+/* Declare internal functions that benefit from compiler attributes. */
+static void die(const char *, ...)
+    __attribute__((__nonnull__, __noreturn__, __format__(printf, 1, 2)));
+static void sysdie(const char *, ...)
+    __attribute__((__nonnull__, __noreturn__, __format__(printf, 1, 2)));
+static void *x_calloc(size_t, size_t, const char *, int)
+    __attribute__((__alloc_size__(1, 2), __malloc__, __nonnull__));
+static void *x_malloc(size_t, const char *, int)
+    __attribute__((__alloc_size__(1), __malloc__, __nonnull__));
+static void *x_reallocarray(void *, size_t, size_t, const char *, int)
+    __attribute__((__alloc_size__(2, 3), __malloc__, __nonnull__(4)));
+static char *x_strdup(const char *, const char *, int)
+    __attribute__((__malloc__, __nonnull__));
+static char *x_strndup(const char *, size_t, const char *, int)
+    __attribute__((__malloc__, __nonnull__));
+
+
+/*
+ * Report a fatal error and exit.
+ */
+static void
+die(const char *format, ...)
+{
+    va_list args;
+
+    fflush(stdout);
+    fprintf(stderr, "runtests: ");
+    va_start(args, format);
+    vfprintf(stderr, format, args);
+    va_end(args);
+    fprintf(stderr, "\n");
+    exit(1);
+}
+
+
+/*
+ * Report a fatal error, including the results of strerror, and exit.
+ */
+static void
+sysdie(const char *format, ...)
+{
+    int oerrno;
+    va_list args;
+
+    oerrno = errno;
+    fflush(stdout);
+    fprintf(stderr, "runtests: ");
+    va_start(args, format);
+    vfprintf(stderr, format, args);
+    va_end(args);
+    fprintf(stderr, ": %s\n", strerror(oerrno));
+    exit(1);
+}
+
+
+/*
+ * Allocate zeroed memory, reporting a fatal error and exiting on failure.
+ */
+static void *
+x_calloc(size_t n, size_t size, const char *file, int line)
+{
+    void *p;
+
+    n = (n > 0) ? n : 1;
+    size = (size > 0) ? size : 1;
+    p = calloc(n, size);
+    if (p == NULL)
+        sysdie("failed to calloc %lu bytes at %s line %d",
+               (unsigned long) size, file, line);
+    return p;
+}
+
+
+/*
+ * Allocate memory, reporting a fatal error and exiting on failure.
+ */
+static void *
+x_malloc(size_t size, const char *file, int line)
+{
+    void *p;
+
+    p = malloc(size);
+    if (p == NULL)
+        sysdie("failed to malloc %lu bytes at %s line %d",
+               (unsigned long) size, file, line);
+    return p;
+}
+
+
+/*
+ * Reallocate memory, reporting a fatal error and exiting on failure.
+ *
+ * We should technically use SIZE_MAX here for the overflow check, but
+ * SIZE_MAX is C99 and we're only assuming C89 + SUSv3, which does not
+ * guarantee that it exists.  They do guarantee that UINT_MAX exists, and we
+ * can assume that UINT_MAX <= SIZE_MAX.  And we should not be allocating
+ * anything anywhere near that large.
+ *
+ * (In theory, C89 and C99 permit size_t to be smaller than unsigned int, but
+ * I disbelieve in the existence of such systems and they will have to cope
+ * without overflow checks.)
+ */
+static void *
+x_reallocarray(void *p, size_t n, size_t size, const char *file, int line)
+{
+    n = (n > 0) ? n : 1;
+    size = (size > 0) ? size : 1;
+
+    if (n > 0 && UINT_MAX / n <= size)
+        sysdie("realloc too large at %s line %d", file, line);
+    p = realloc(p, n * size);
+    if (p == NULL)
+        sysdie("failed to realloc %lu bytes at %s line %d",
+               (unsigned long) (n * size), file, line);
+    return p;
+}
+
+
+/*
+ * Copy a string, reporting a fatal error and exiting on failure.
+ */
+static char *
+x_strdup(const char *s, const char *file, int line)
+{
+    char *p;
+    size_t len;
+
+    len = strlen(s) + 1;
+    p = (char *) malloc(len);
+    if (p == NULL)
+        sysdie("failed to strdup %lu bytes at %s line %d", (unsigned long) len,
+               file, line);
+    memcpy(p, s, len);
+    return p;
+}
+
+
+/*
+ * Copy the first n characters of a string, reporting a fatal error and
+ * existing on failure.
+ *
+ * Avoid using the system strndup function since it may not exist (on Mac OS
+ * X, for example), and there's no need to introduce another portability
+ * requirement.
+ */
+char *
+x_strndup(const char *s, size_t size, const char *file, int line)
+{
+    const char *p;
+    size_t len;
+    char *copy;
+
+    /* Don't assume that the source string is nul-terminated. */
+    for (p = s; (size_t)(p - s) < size && *p != '\0'; p++)
+        ;
+    len = (size_t)(p - s);
+    copy = (char *) malloc(len + 1);
+    if (copy == NULL)
+        sysdie("failed to strndup %lu bytes at %s line %d",
+               (unsigned long) len, file, line);
+    memcpy(copy, s, len);
+    copy[len] = '\0';
+    return copy;
+}
+
+
+/*
+ * Form a new string by concatenating multiple strings.  The arguments must be
+ * terminated by (const char *) 0.
+ *
+ * This function only exists because we can't assume asprintf.  We can't
+ * simulate asprintf with snprintf because we're only assuming SUSv3, which
+ * does not require that snprintf with a NULL buffer return the required
+ * length.  When those constraints are relaxed, this should be ripped out and
+ * replaced with asprintf or a more trivial replacement with snprintf.
+ */
+static char *
+concat(const char *first, ...)
+{
+    va_list args;
+    char *result;
+    const char *string;
+    size_t offset;
+    size_t length = 0;
+
+    /*
+     * Find the total memory required.  Ensure we don't overflow length.  We
+     * aren't guaranteed to have SIZE_MAX, so use UINT_MAX as an acceptable
+     * substitute (see the x_nrealloc comments).
+     */
+    va_start(args, first);
+    for (string = first; string != NULL; string = va_arg(args, const char *)) {
+        if (length >= UINT_MAX - strlen(string)) {
+            errno = EINVAL;
+            sysdie("strings too long in concat");
+        }
+        length += strlen(string);
+    }
+    va_end(args);
+    length++;
+
+    /* Create the string. */
+    result = xmalloc(length);
+    va_start(args, first);
+    offset = 0;
+    for (string = first; string != NULL; string = va_arg(args, const char *)) {
+        memcpy(result + offset, string, strlen(string));
+        offset += strlen(string);
+    }
+    va_end(args);
+    result[offset] = '\0';
+    return result;
+}
+
+
+/*
+ * Given a struct timeval, return the number of seconds it represents as a
+ * double.  Use difftime() to convert a time_t to a double.
+ */
+static double
+tv_seconds(const struct timeval *tv)
+{
+    return difftime(tv->tv_sec, 0) + (double) tv->tv_usec * 1e-6;
+}
+
+
+/*
+ * Given two struct timevals, return the difference in seconds.
+ */
+static double
+tv_diff(const struct timeval *tv1, const struct timeval *tv0)
+{
+    return tv_seconds(tv1) - tv_seconds(tv0);
+}
+
+
+/*
+ * Given two struct timevals, return the sum in seconds as a double.
+ */
+static double
+tv_sum(const struct timeval *tv1, const struct timeval *tv2)
+{
+    return tv_seconds(tv1) + tv_seconds(tv2);
+}
+
+
+/*
+ * Given a pointer to a string, skip any leading whitespace and return a
+ * pointer to the first non-whitespace character.
+ */
+static const char *
+skip_whitespace(const char *p)
+{
+    while (isspace((unsigned char) (*p)))
+        p++;
+    return p;
+}
+
+
+/*
+ * Given a pointer to a string, skip any non-whitespace characters and return
+ * a pointer to the first whitespace character, or to the end of the string.
+ */
+static const char *
+skip_non_whitespace(const char *p)
+{
+    while (*p != '\0' && !isspace((unsigned char) (*p)))
+        p++;
+    return p;
+}
+
+
+/*
+ * Start a program, connecting its stdout to a pipe on our end and its stderr
+ * to /dev/null, and storing the file descriptor to read from in the two
+ * argument.  Returns the PID of the new process.  Errors are fatal.
+ */
+static pid_t
+test_start(char *const *command, int *fd)
+{
+    int fds[2], infd, errfd;
+    pid_t child;
+
+    /* Create a pipe used to capture the output from the test program. */
+    if (pipe(fds) == -1) {
+        puts("ABORTED");
+        fflush(stdout);
+        sysdie("can't create pipe");
+    }
+
+    /* Fork a child process, massage the file descriptors, and exec. */
+    child = fork();
+    switch (child) {
+    case -1:
+        puts("ABORTED");
+        fflush(stdout);
+        sysdie("can't fork");
+
+    /* In the child.  Set up our standard output. */
+    case 0:
+        close(fds[0]);
+        close(STDOUT_FILENO);
+        if (dup2(fds[1], STDOUT_FILENO) < 0)
+            _exit(CHILDERR_DUP);
+        close(fds[1]);
+
+        /* Point standard input at /dev/null. */
+        close(STDIN_FILENO);
+        infd = open("/dev/null", O_RDONLY);
+        if (infd < 0)
+            _exit(CHILDERR_STDIN);
+        if (infd != STDIN_FILENO) {
+            if (dup2(infd, STDIN_FILENO) < 0)
+                _exit(CHILDERR_DUP);
+            close(infd);
+        }
+
+        /* Point standard error at /dev/null. */
+        close(STDERR_FILENO);
+        errfd = open("/dev/null", O_WRONLY);
+        if (errfd < 0)
+            _exit(CHILDERR_STDERR);
+        if (errfd != STDERR_FILENO) {
+            if (dup2(errfd, STDERR_FILENO) < 0)
+                _exit(CHILDERR_DUP);
+            close(errfd);
+        }
+
+        /* Now, exec our process. */
+        if (execv(command[0], command) == -1)
+            _exit(CHILDERR_EXEC);
+        break;
+
+    /* In parent.  Close the extra file descriptor. */
+    default:
+        close(fds[1]);
+        break;
+    }
+    *fd = fds[0];
+    return child;
+}
+
+
+/*
+ * Back up over the output saying what test we were executing.
+ */
+static void
+test_backspace(struct testset *ts)
+{
+    unsigned int i;
+
+    if (!isatty(STDOUT_FILENO))
+        return;
+    for (i = 0; i < ts->length; i++)
+        putchar('\b');
+    for (i = 0; i < ts->length; i++)
+        putchar(' ');
+    for (i = 0; i < ts->length; i++)
+        putchar('\b');
+    ts->length = 0;
+}
+
+
+/*
+ * Allocate or resize the array of test results to be large enough to contain
+ * the test number in.
+ */
+static void
+resize_results(struct testset *ts, unsigned long n)
+{
+    unsigned long i;
+    size_t s;
+
+    /* If there's already enough space, return quickly. */
+    if (n <= ts->allocated)
+        return;
+
+    /*
+     * If no space has been allocated, do the initial allocation.  Otherwise,
+     * resize.  Start with 32 test cases and then add 1024 with each resize to
+     * try to reduce the number of reallocations.
+     */
+    if (ts->allocated == 0) {
+        s = (n > 32) ? n : 32;
+        ts->results = xcalloc(s, enum test_status);
+    } else {
+        s = (n > ts->allocated + 1024) ? n : ts->allocated + 1024;
+        ts->results = xreallocarray(ts->results, s, enum test_status);
+    }
+
+    /* Set the results for the newly-allocated test array. */
+    for (i = ts->allocated; i < s; i++)
+        ts->results[i] = TEST_INVALID;
+    ts->allocated = s;
+}
+
+
+/*
+ * Report an invalid test number and set the appropriate flags.  Pulled into a
+ * separate function since we do this in several places.
+ */
+static void
+invalid_test_number(struct testset *ts, long n, enum test_verbose verbose)
+{
+    if (!verbose)
+        test_backspace(ts);
+    printf("ABORTED (invalid test number %ld)\n", n);
+    ts->aborted = 1;
+    ts->reported = 1;
+}
+
+
+/*
+ * Read the plan line of test output, which should contain the range of test
+ * numbers.  We may initialize the testset structure here if we haven't yet
+ * seen a test.  Return true if initialization succeeded and the test should
+ * continue, false otherwise.
+ */
+static int
+test_plan(const char *line, struct testset *ts, enum test_verbose verbose)
+{
+    long n;
+
+    /*
+     * Accept a plan without the leading 1.. for compatibility with older
+     * versions of runtests.  This will only be allowed if we've not yet seen
+     * a test result.
+     */
+    line = skip_whitespace(line);
+    if (strncmp(line, "1..", 3) == 0)
+        line += 3;
+
+    /*
+     * Get the count and check it for validity.
+     *
+     * If we have something of the form "1..0 # skip foo", the whole file was
+     * skipped; record that.  If we do skip the whole file, zero out all of
+     * our statistics, since they're no longer relevant.
+     *
+     * strtol is called with a second argument to advance the line pointer
+     * past the count to make it simpler to detect the # skip case.
+     */
+    n = strtol(line, (char **) &line, 10);
+    if (n == 0) {
+        line = skip_whitespace(line);
+        if (*line == '#') {
+            line = skip_whitespace(line + 1);
+            if (strncasecmp(line, "skip", 4) == 0) {
+                line = skip_whitespace(line + 4);
+                if (*line != '\0') {
+                    ts->reason = xstrdup(line);
+                    ts->reason[strlen(ts->reason) - 1] = '\0';
+                }
+                ts->all_skipped = 1;
+                ts->aborted = 1;
+                ts->count = 0;
+                ts->passed = 0;
+                ts->skipped = 0;
+                ts->failed = 0;
+                return 0;
+            }
+        }
+    }
+    if (n <= 0) {
+        puts("ABORTED (invalid test count)");
+        ts->aborted = 1;
+        ts->reported = 1;
+        return 0;
+    }
+
+    /*
+     * If we are doing lazy planning, check the plan against the largest test
+     * number that we saw and fail now if we saw a check outside the plan
+     * range.
+     */
+    if (ts->plan == PLAN_PENDING && (unsigned long) n < ts->count) {
+        invalid_test_number(ts, (long) ts->count, verbose);
+        return 0;
+    }
+
+    /*
+     * Otherwise, allocated or resize the results if needed and update count,
+     * and then record that we've seen a plan.
+     */
+    resize_results(ts, (unsigned long) n);
+    ts->count = (unsigned long) n;
+    if (ts->plan == PLAN_INIT)
+        ts->plan = PLAN_FIRST;
+    else if (ts->plan == PLAN_PENDING)
+        ts->plan = PLAN_FINAL;
+    return 1;
+}
+
+
+/*
+ * Given a single line of output from a test, parse it and return the success
+ * status of that test.  Anything printed to stdout not matching the form
+ * /^(not )?ok \d+/ is ignored.  Sets ts->current to the test number that just
+ * reported status.
+ */
+static void
+test_checkline(const char *line, struct testset *ts, enum test_verbose verbose)
+{
+    enum test_status status = TEST_PASS;
+    const char *bail;
+    char *end;
+    long number;
+    unsigned long current;
+    int outlen;
+
+    /* Before anything, check for a test abort. */
+    bail = strstr(line, "Bail out!");
+    if (bail != NULL) {
+        bail = skip_whitespace(bail + strlen("Bail out!"));
+        if (*bail != '\0') {
+            size_t length;
+
+            length = strlen(bail);
+            if (bail[length - 1] == '\n')
+                length--;
+            if (!verbose)
+                test_backspace(ts);
+            printf("ABORTED (%.*s)\n", (int) length, bail);
+            ts->reported = 1;
+        }
+        ts->aborted = 1;
+        return;
+    }
+
+    /*
+     * If the given line isn't newline-terminated, it was too big for an
+     * fgets(), which means ignore it.
+     */
+    if (line[strlen(line) - 1] != '\n')
+        return;
+
+    /* If the line begins with a hash mark, ignore it. */
+    if (line[0] == '#')
+        return;
+
+    /* If we haven't yet seen a plan, look for one. */
+    if (ts->plan == PLAN_INIT && isdigit((unsigned char) (*line))) {
+        if (!test_plan(line, ts, verbose))
+            return;
+    } else if (strncmp(line, "1..", 3) == 0) {
+        if (ts->plan == PLAN_PENDING) {
+            if (!test_plan(line, ts, verbose))
+                return;
+        } else {
+            if (!verbose)
+                test_backspace(ts);
+            puts("ABORTED (multiple plans)");
+            ts->aborted = 1;
+            ts->reported = 1;
+            return;
+        }
+    }
+
+    /* Parse the line, ignoring something we can't parse. */
+    if (strncmp(line, "not ", 4) == 0) {
+        status = TEST_FAIL;
+        line += 4;
+    }
+    if (strncmp(line, "ok", 2) != 0)
+        return;
+    line = skip_whitespace(line + 2);
+    errno = 0;
+    number = strtol(line, &end, 10);
+    if (errno != 0 || end == line)
+        current = ts->current + 1;
+    else if (number <= 0) {
+        invalid_test_number(ts, number, verbose);
+        return;
+    } else
+        current = (unsigned long) number;
+    if (current > ts->count && ts->plan == PLAN_FIRST) {
+        invalid_test_number(ts, (long) current, verbose);
+        return;
+    }
+
+    /* We have a valid test result.  Tweak the results array if needed. */
+    if (ts->plan == PLAN_INIT || ts->plan == PLAN_PENDING) {
+        ts->plan = PLAN_PENDING;
+        resize_results(ts, current);
+        if (current > ts->count)
+            ts->count = current;
+    }
+
+    /*
+     * Handle directives.  We should probably do something more interesting
+     * with unexpected passes of todo tests.
+     */
+    while (isdigit((unsigned char) (*line)))
+        line++;
+    line = skip_whitespace(line);
+    if (*line == '#') {
+        line = skip_whitespace(line + 1);
+        if (strncasecmp(line, "skip", 4) == 0)
+            status = TEST_SKIP;
+        if (strncasecmp(line, "todo", 4) == 0)
+            status = (status == TEST_FAIL) ? TEST_SKIP : TEST_FAIL;
+    }
+
+    /* Make sure that the test number is in range and not a duplicate. */
+    if (ts->results[current - 1] != TEST_INVALID) {
+        if (!verbose)
+            test_backspace(ts);
+        printf("ABORTED (duplicate test number %lu)\n", current);
+        ts->aborted = 1;
+        ts->reported = 1;
+        return;
+    }
+
+    /* Good results.  Increment our various counters. */
+    switch (status) {
+    case TEST_PASS:
+        ts->passed++;
+        break;
+    case TEST_FAIL:
+        ts->failed++;
+        break;
+    case TEST_SKIP:
+        ts->skipped++;
+        break;
+    case TEST_INVALID:
+        break;
+    }
+    ts->current = current;
+    ts->results[current - 1] = status;
+    if (!verbose && isatty(STDOUT_FILENO)) {
+        test_backspace(ts);
+        if (ts->plan == PLAN_PENDING)
+            outlen = printf("%lu/?", current);
+        else
+            outlen = printf("%lu/%lu", current, ts->count);
+        ts->length = (outlen >= 0) ? (unsigned int) outlen : 0;
+        fflush(stdout);
+    }
+}
+
+
+/*
+ * Print out a range of test numbers, returning the number of characters it
+ * took up.  Takes the first number, the last number, the number of characters
+ * already printed on the line, and the limit of number of characters the line
+ * can hold.  Add a comma and a space before the range if chars indicates that
+ * something has already been printed on the line, and print ... instead if
+ * chars plus the space needed would go over the limit (use a limit of 0 to
+ * disable this).
+ */
+static unsigned int
+test_print_range(unsigned long first, unsigned long last, unsigned long chars,
+                 unsigned int limit)
+{
+    unsigned int needed = 0;
+    unsigned long n;
+
+    for (n = first; n > 0; n /= 10)
+        needed++;
+    if (last > first) {
+        for (n = last; n > 0; n /= 10)
+            needed++;
+        needed++;
+    }
+    if (chars > 0)
+        needed += 2;
+    if (limit > 0 && chars + needed > limit) {
+        needed = 0;
+        if (chars <= limit) {
+            if (chars > 0) {
+                printf(", ");
+                needed += 2;
+            }
+            printf("...");
+            needed += 3;
+        }
+    } else {
+        if (chars > 0)
+            printf(", ");
+        if (last > first)
+            printf("%lu-", first);
+        printf("%lu", last);
+    }
+    return needed;
+}
+
+
+/*
+ * Summarize a single test set.  The second argument is 0 if the set exited
+ * cleanly, a positive integer representing the exit status if it exited
+ * with a non-zero status, and a negative integer representing the signal
+ * that terminated it if it was killed by a signal.
+ */
+static void
+test_summarize(struct testset *ts, int status)
+{
+    unsigned long i;
+    unsigned long missing = 0;
+    unsigned long failed = 0;
+    unsigned long first = 0;
+    unsigned long last = 0;
+
+    if (ts->aborted) {
+        fputs("ABORTED", stdout);
+        if (ts->count > 0)
+            printf(" (passed %lu/%lu)", ts->passed, ts->count - ts->skipped);
+    } else {
+        for (i = 0; i < ts->count; i++) {
+            if (ts->results[i] == TEST_INVALID) {
+                if (missing == 0)
+                    fputs("MISSED ", stdout);
+                if (first && i == last)
+                    last = i + 1;
+                else {
+                    if (first)
+                        test_print_range(first, last, missing - 1, 0);
+                    missing++;
+                    first = i + 1;
+                    last = i + 1;
+                }
+            }
+        }
+        if (first)
+            test_print_range(first, last, missing - 1, 0);
+        first = 0;
+        last = 0;
+        for (i = 0; i < ts->count; i++) {
+            if (ts->results[i] == TEST_FAIL) {
+                if (missing && !failed)
+                    fputs("; ", stdout);
+                if (failed == 0)
+                    fputs("FAILED ", stdout);
+                if (first && i == last)
+                    last = i + 1;
+                else {
+                    if (first)
+                        test_print_range(first, last, failed - 1, 0);
+                    failed++;
+                    first = i + 1;
+                    last = i + 1;
+                }
+            }
+        }
+        if (first)
+            test_print_range(first, last, failed - 1, 0);
+        if (!missing && !failed) {
+            fputs(!status ? "ok" : "dubious", stdout);
+            if (ts->skipped > 0) {
+                if (ts->skipped == 1)
+                    printf(" (skipped %lu test)", ts->skipped);
+                else
+                    printf(" (skipped %lu tests)", ts->skipped);
+            }
+        }
+    }
+    if (status > 0)
+        printf(" (exit status %d)", status);
+    else if (status < 0)
+        printf(" (killed by signal %d%s)", -status,
+               WCOREDUMP(ts->status) ? ", core dumped" : "");
+    putchar('\n');
+}
+
+
+/*
+ * Given a test set, analyze the results, classify the exit status, handle a
+ * few special error messages, and then pass it along to test_summarize() for
+ * the regular output.  Returns true if the test set ran successfully and all
+ * tests passed or were skipped, false otherwise.
+ */
+static int
+test_analyze(struct testset *ts)
+{
+    if (ts->reported)
+        return 0;
+    if (ts->all_skipped) {
+        if (ts->reason == NULL)
+            puts("skipped");
+        else
+            printf("skipped (%s)\n", ts->reason);
+        return 1;
+    } else if (WIFEXITED(ts->status) && WEXITSTATUS(ts->status) != 0) {
+        switch (WEXITSTATUS(ts->status)) {
+        case CHILDERR_DUP:
+            if (!ts->reported)
+                puts("ABORTED (can't dup file descriptors)");
+            break;
+        case CHILDERR_EXEC:
+            if (!ts->reported)
+                puts("ABORTED (execution failed -- not found?)");
+            break;
+        case CHILDERR_STDIN:
+        case CHILDERR_STDERR:
+            if (!ts->reported)
+                puts("ABORTED (can't open /dev/null)");
+            break;
+        default:
+            test_summarize(ts, WEXITSTATUS(ts->status));
+            break;
+        }
+        return 0;
+    } else if (WIFSIGNALED(ts->status)) {
+        test_summarize(ts, -WTERMSIG(ts->status));
+        return 0;
+    } else if (ts->plan != PLAN_FIRST && ts->plan != PLAN_FINAL) {
+        puts("ABORTED (no valid test plan)");
+        ts->aborted = 1;
+        return 0;
+    } else {
+        test_summarize(ts, 0);
+        return (ts->failed == 0);
+    }
+}
+
+
+/*
+ * Runs a single test set, accumulating and then reporting the results.
+ * Returns true if the test set was successfully run and all tests passed,
+ * false otherwise.
+ */
+static int
+test_run(struct testset *ts, enum test_verbose verbose)
+{
+    pid_t testpid, child;
+    int outfd, status;
+    unsigned long i;
+    FILE *output;
+    char buffer[BUFSIZ];
+
+    /* Run the test program. */
+    testpid = test_start(ts->command, &outfd);
+    output = fdopen(outfd, "r");
+    if (!output) {
+        puts("ABORTED");
+        fflush(stdout);
+        sysdie("fdopen failed");
+    }
+
+    /*
+     * Pass each line of output to test_checkline(), and print the line if
+     * verbosity is requested.
+     */
+    while (!ts->aborted && fgets(buffer, sizeof(buffer), output)) {
+        if (verbose)
+            printf("%s", buffer);
+        test_checkline(buffer, ts, verbose);
+    }
+    if (ferror(output) || ts->plan == PLAN_INIT)
+        ts->aborted = 1;
+    if (!verbose)
+        test_backspace(ts);
+
+    /*
+     * Consume the rest of the test output, close the output descriptor,
+     * retrieve the exit status, and pass that information to test_analyze()
+     * for eventual output.
+     */
+    while (fgets(buffer, sizeof(buffer), output))
+        if (verbose)
+            printf("%s", buffer);
+    fclose(output);
+    child = waitpid(testpid, &ts->status, 0);
+    if (child == (pid_t) -1) {
+        if (!ts->reported) {
+            puts("ABORTED");
+            fflush(stdout);
+        }
+        sysdie("waitpid for %u failed", (unsigned int) testpid);
+    }
+    if (ts->all_skipped)
+        ts->aborted = 0;
+    status = test_analyze(ts);
+
+    /* Convert missing tests to failed tests. */
+    for (i = 0; i < ts->count; i++) {
+        if (ts->results[i] == TEST_INVALID) {
+            ts->failed++;
+            ts->results[i] = TEST_FAIL;
+            status = 0;
+        }
+    }
+    return status;
+}
+
+
+/* Summarize a list of test failures. */
+static void
+test_fail_summary(const struct testlist *fails)
+{
+    struct testset *ts;
+    unsigned int chars;
+    unsigned long i, first, last, total;
+    double failed;
+
+    puts(header);
+
+    /* Failed Set                 Fail/Total (%) Skip Stat  Failing (25)
+       -------------------------- -------------- ---- ----  -------------- */
+    for (; fails; fails = fails->next) {
+        ts = fails->ts;
+        total = ts->count - ts->skipped;
+        failed = (double) ts->failed;
+        printf("%-26.26s %4lu/%-4lu %3.0f%% %4lu ", ts->file, ts->failed,
+               total, total ? (failed * 100.0) / (double) total : 0,
+               ts->skipped);
+        if (WIFEXITED(ts->status))
+            printf("%4d  ", WEXITSTATUS(ts->status));
+        else
+            printf("  --  ");
+        if (ts->aborted) {
+            puts("aborted");
+            continue;
+        }
+        chars = 0;
+        first = 0;
+        last = 0;
+        for (i = 0; i < ts->count; i++) {
+            if (ts->results[i] == TEST_FAIL) {
+                if (first != 0 && i == last)
+                    last = i + 1;
+                else {
+                    if (first != 0)
+                        chars += test_print_range(first, last, chars, 19);
+                    first = i + 1;
+                    last = i + 1;
+                }
+            }
+        }
+        if (first != 0)
+            test_print_range(first, last, chars, 19);
+        putchar('\n');
+    }
+}
+
+
+/*
+ * Check whether a given file path is a valid test.  Currently, this checks
+ * whether it is executable and is a regular file.  Returns true or false.
+ */
+static int
+is_valid_test(const char *path)
+{
+    struct stat st;
+
+    if (access(path, X_OK) < 0)
+        return 0;
+    if (stat(path, &st) < 0)
+        return 0;
+    if (!S_ISREG(st.st_mode))
+        return 0;
+    return 1;
+}
+
+
+/*
+ * Given the name of a test, a pointer to the testset struct, and the source
+ * and build directories, find the test.  We try first relative to the current
+ * directory, then in the build directory (if not NULL), then in the source
+ * directory.  In each of those directories, we first try a "-t" extension and
+ * then a ".t" extension.  When we find an executable program, we return the
+ * path to that program.  If none of those paths are executable, just fill in
+ * the name of the test as is.
+ *
+ * The caller is responsible for freeing the path member of the testset
+ * struct.
+ */
+static char *
+find_test(const char *name, const char *source, const char *build)
+{
+    char *path = NULL;
+    const char *bases[3], *suffix, *base;
+    unsigned int i, j;
+    const char *suffixes[3] = {"-t", ".t", ""};
+
+    /* Possible base directories. */
+    bases[0] = ".";
+    bases[1] = build;
+    bases[2] = source;
+
+    /* Try each suffix with each base. */
+    for (i = 0; i < ARRAY_SIZE(suffixes); i++) {
+        suffix = suffixes[i];
+        for (j = 0; j < ARRAY_SIZE(bases); j++) {
+            base = bases[j];
+            if (base == NULL)
+                continue;
+            path = concat(base, "/", name, suffix, (const char *) 0);
+            if (is_valid_test(path))
+                return path;
+            free(path);
+            path = NULL;
+        }
+    }
+    if (path == NULL)
+        path = xstrdup(name);
+    return path;
+}
+
+
+/*
+ * Parse a single line of a test list and store the test name and command to
+ * execute it in the given testset struct.
+ *
+ * Normally, each line is just the name of the test, which is located in the
+ * test directory and turned into a command to run.  However, each line may
+ * have whitespace-separated options, which change the command that's run.
+ * Current supported options are:
+ *
+ * valgrind
+ *     Run the test under valgrind if C_TAP_VALGRIND is set.  The contents
+ *     of that environment variable are taken as the valgrind command (with
+ *     options) to run.  The command is parsed with a simple split on
+ *     whitespace and no quoting is supported.
+ *
+ * libtool
+ *     If running under valgrind, use libtool to invoke valgrind.  This avoids
+ *     running valgrind on the wrapper shell script generated by libtool.  If
+ *     set, C_TAP_LIBTOOL must be set to the full path to the libtool program
+ *     to use to run valgrind and thus the test.  Ignored if the test isn't
+ *     being run under valgrind.
+ */
+static void
+parse_test_list_line(const char *line, struct testset *ts, const char *source,
+                     const char *build)
+{
+    const char *p, *end, *option, *libtool;
+    const char *valgrind = NULL;
+    unsigned int use_libtool = 0;
+    unsigned int use_valgrind = 0;
+    size_t len, i;
+
+    /* Determine the name of the test. */
+    p = skip_non_whitespace(line);
+    ts->file = xstrndup(line, p - line);
+
+    /* Check if any test options are set. */
+    p = skip_whitespace(p);
+    while (*p != '\0') {
+        end = skip_non_whitespace(p);
+        if (strncmp(p, "libtool", end - p) == 0) {
+            use_libtool = 1;
+        } else if (strncmp(p, "valgrind", end - p) == 0) {
+            valgrind = getenv("C_TAP_VALGRIND");
+            use_valgrind = (valgrind != NULL);
+        } else {
+            option = xstrndup(p, end - p);
+            die("unknown test list option %s", option);
+        }
+        p = skip_whitespace(end);
+    }
+
+    /* Construct the argv to run the test.  First, find the length. */
+    len = 1;
+    if (use_valgrind && valgrind != NULL) {
+        p = skip_whitespace(valgrind);
+        while (*p != '\0') {
+            len++;
+            p = skip_whitespace(skip_non_whitespace(p));
+        }
+        if (use_libtool)
+            len += 2;
+    }
+
+    /* Now, build the command. */
+    ts->command = xcalloc(len + 1, char *);
+    i = 0;
+    if (use_valgrind && valgrind != NULL) {
+        if (use_libtool) {
+            libtool = getenv("C_TAP_LIBTOOL");
+            if (libtool == NULL)
+                die("valgrind with libtool requested, but C_TAP_LIBTOOL is not"
+                    " set");
+            ts->command[i++] = xstrdup(libtool);
+            ts->command[i++] = xstrdup("--mode=execute");
+        }
+        p = skip_whitespace(valgrind);
+        while (*p != '\0') {
+            end = skip_non_whitespace(p);
+            ts->command[i++] = xstrndup(p, end - p);
+            p = skip_whitespace(end);
+        }
+    }
+    if (i != len - 1)
+        die("internal error while constructing command line");
+    ts->command[i++] = find_test(ts->file, source, build);
+    ts->command[i] = NULL;
+}
+
+
+/*
+ * Read a list of tests from a file, returning the list of tests as a struct
+ * testlist, or NULL if there were no tests (such as a file containing only
+ * comments).  Reports an error to standard error and exits if the list of
+ * tests cannot be read.
+ */
+static struct testlist *
+read_test_list(const char *filename, const char *source, const char *build)
+{
+    FILE *file;
+    unsigned int line;
+    size_t length;
+    char buffer[BUFSIZ];
+    const char *start;
+    struct testlist *listhead, *current;
+
+    /* Create the initial container list that will hold our results. */
+    listhead = xcalloc(1, struct testlist);
+    current = NULL;
+
+    /*
+     * Open our file of tests to run and read it line by line, creating a new
+     * struct testlist and struct testset for each line.
+     */
+    file = fopen(filename, "r");
+    if (file == NULL)
+        sysdie("can't open %s", filename);
+    line = 0;
+    while (fgets(buffer, sizeof(buffer), file)) {
+        line++;
+        length = strlen(buffer) - 1;
+        if (buffer[length] != '\n') {
+            fprintf(stderr, "%s:%u: line too long\n", filename, line);
+            exit(1);
+        }
+        buffer[length] = '\0';
+
+        /* Skip comments, leading spaces, and blank lines. */
+        start = skip_whitespace(buffer);
+        if (strlen(start) == 0)
+            continue;
+        if (start[0] == '#')
+            continue;
+
+        /* Allocate the new testset structure. */
+        if (current == NULL)
+            current = listhead;
+        else {
+            current->next = xcalloc(1, struct testlist);
+            current = current->next;
+        }
+        current->ts = xcalloc(1, struct testset);
+        current->ts->plan = PLAN_INIT;
+
+        /* Parse the line and store the results in the testset struct. */
+        parse_test_list_line(start, current->ts, source, build);
+    }
+    fclose(file);
+
+    /* If there were no tests, current is still NULL. */
+    if (current == NULL) {
+        free(listhead);
+        return NULL;
+    }
+
+    /* Return the results. */
+    return listhead;
+}
+
+
+/*
+ * Build a list of tests from command line arguments.  Takes the argv and argc
+ * representing the command line arguments and returns a newly allocated test
+ * list, or NULL if there were no tests.  The caller is responsible for
+ * freeing.
+ */
+static struct testlist *
+build_test_list(char *argv[], int argc, const char *source, const char *build)
+{
+    int i;
+    struct testlist *listhead, *current;
+
+    /* Create the initial container list that will hold our results. */
+    listhead = xcalloc(1, struct testlist);
+    current = NULL;
+
+    /* Walk the list of arguments and create test sets for them. */
+    for (i = 0; i < argc; i++) {
+        if (current == NULL)
+            current = listhead;
+        else {
+            current->next = xcalloc(1, struct testlist);
+            current = current->next;
+        }
+        current->ts = xcalloc(1, struct testset);
+        current->ts->plan = PLAN_INIT;
+        current->ts->file = xstrdup(argv[i]);
+        current->ts->command = xcalloc(2, char *);
+        current->ts->command[0] = find_test(current->ts->file, source, build);
+        current->ts->command[1] = NULL;
+    }
+
+    /* If there were no tests, current is still NULL. */
+    if (current == NULL) {
+        free(listhead);
+        return NULL;
+    }
+
+    /* Return the results. */
+    return listhead;
+}
+
+
+/* Free a struct testset. */
+static void
+free_testset(struct testset *ts)
+{
+    size_t i;
+
+    free(ts->file);
+    for (i = 0; ts->command[i] != NULL; i++)
+        free(ts->command[i]);
+    free(ts->command);
+    free(ts->results);
+    free(ts->reason);
+    free(ts);
+}
+
+
+/*
+ * Run a batch of tests.  Takes two additional parameters: the root of the
+ * source directory and the root of the build directory.  Test programs will
+ * be first searched for in the current directory, then the build directory,
+ * then the source directory.  Returns true iff all tests passed, and always
+ * frees the test list that's passed in.
+ */
+static int
+test_batch(struct testlist *tests, enum test_verbose verbose)
+{
+    size_t length, i;
+    size_t longest = 0;
+    unsigned int count = 0;
+    struct testset *ts;
+    struct timeval start, end;
+    struct rusage stats;
+    struct testlist *failhead = NULL;
+    struct testlist *failtail = NULL;
+    struct testlist *current, *next;
+    int succeeded;
+    unsigned long total = 0;
+    unsigned long passed = 0;
+    unsigned long skipped = 0;
+    unsigned long failed = 0;
+    unsigned long aborted = 0;
+
+    /* Walk the list of tests to find the longest name. */
+    for (current = tests; current != NULL; current = current->next) {
+        length = strlen(current->ts->file);
+        if (length > longest)
+            longest = length;
+    }
+
+    /*
+     * Add two to longest and round up to the nearest tab stop.  This is how
+     * wide the column for printing the current test name will be.
+     */
+    longest += 2;
+    if (longest % 8)
+        longest += 8 - (longest % 8);
+
+    /* Start the wall clock timer. */
+    gettimeofday(&start, NULL);
+
+    /* Now, plow through our tests again, running each one. */
+    for (current = tests; current != NULL; current = current->next) {
+        ts = current->ts;
+
+        /* Print out the name of the test file. */
+        fputs(ts->file, stdout);
+        if (verbose)
+            fputs("\n\n", stdout);
+        else
+            for (i = strlen(ts->file); i < longest; i++)
+                putchar('.');
+        if (isatty(STDOUT_FILENO))
+            fflush(stdout);
+
+        /* Run the test. */
+        succeeded = test_run(ts, verbose);
+        fflush(stdout);
+        if (verbose)
+            putchar('\n');
+
+        /* Record cumulative statistics. */
+        aborted += ts->aborted;
+        total += ts->count + ts->all_skipped;
+        passed += ts->passed;
+        skipped += ts->skipped + ts->all_skipped;
+        failed += ts->failed;
+        count++;
+
+        /* If the test fails, we shuffle it over to the fail list. */
+        if (!succeeded) {
+            if (failhead == NULL) {
+                failhead = xcalloc(1, struct testlist);
+                failtail = failhead;
+            } else {
+                failtail->next = xcalloc(1, struct testlist);
+                failtail = failtail->next;
+            }
+            failtail->ts = ts;
+            failtail->next = NULL;
+        }
+    }
+    total -= skipped;
+
+    /* Stop the timer and get our child resource statistics. */
+    gettimeofday(&end, NULL);
+    getrusage(RUSAGE_CHILDREN, &stats);
+
+    /* Summarize the failures and free the failure list. */
+    if (failhead != NULL) {
+        test_fail_summary(failhead);
+        while (failhead != NULL) {
+            next = failhead->next;
+            free(failhead);
+            failhead = next;
+        }
+    }
+
+    /* Free the memory used by the test lists. */
+    while (tests != NULL) {
+        next = tests->next;
+        free_testset(tests->ts);
+        free(tests);
+        tests = next;
+    }
+
+    /* Print out the final test summary. */
+    putchar('\n');
+    if (aborted != 0) {
+        if (aborted == 1)
+            printf("Aborted %lu test set", aborted);
+        else
+            printf("Aborted %lu test sets", aborted);
+        printf(", passed %lu/%lu tests", passed, total);
+    } else if (failed == 0)
+        fputs("All tests successful", stdout);
+    else
+        printf("Failed %lu/%lu tests, %.2f%% okay", failed, total,
+               (double) (total - failed) * 100.0 / (double) total);
+    if (skipped != 0) {
+        if (skipped == 1)
+            printf(", %lu test skipped", skipped);
+        else
+            printf(", %lu tests skipped", skipped);
+    }
+    puts(".");
+    printf("Files=%u,  Tests=%lu", count, total);
+    printf(",  %.2f seconds", tv_diff(&end, &start));
+    printf(" (%.2f usr + %.2f sys = %.2f CPU)\n", tv_seconds(&stats.ru_utime),
+           tv_seconds(&stats.ru_stime),
+           tv_sum(&stats.ru_utime, &stats.ru_stime));
+    return (failed == 0 && aborted == 0);
+}
+
+
+/*
+ * Run a single test case.  This involves just running the test program after
+ * having done the environment setup and finding the test program.
+ */
+static void
+test_single(const char *program, const char *source, const char *build)
+{
+    char *path;
+
+    path = find_test(program, source, build);
+    if (execl(path, path, (char *) 0) == -1)
+        sysdie("cannot exec %s", path);
+}
+
+
+/*
+ * Main routine.  Set the C_TAP_SOURCE, C_TAP_BUILD, SOURCE, and BUILD
+ * environment variables and then, given a file listing tests, run each test
+ * listed.
+ */
+int
+main(int argc, char *argv[])
+{
+    int option;
+    int status = 0;
+    int single = 0;
+    enum test_verbose verbose = CONCISE;
+    char *c_tap_source_env = NULL;
+    char *c_tap_build_env = NULL;
+    char *source_env = NULL;
+    char *build_env = NULL;
+    const char *program;
+    const char *shortlist;
+    const char *list = NULL;
+    const char *source = C_TAP_SOURCE;
+    const char *build = C_TAP_BUILD;
+    struct testlist *tests;
+
+    program = argv[0];
+    while ((option = getopt(argc, argv, "b:hl:os:v")) != EOF) {
+        switch (option) {
+        case 'b':
+            build = optarg;
+            break;
+        case 'h':
+            printf(usage_message, program, program, program, usage_extra);
+            exit(0);
+        case 'l':
+            list = optarg;
+            break;
+        case 'o':
+            single = 1;
+            break;
+        case 's':
+            source = optarg;
+            break;
+        case 'v':
+            verbose = VERBOSE;
+            break;
+        default:
+            exit(1);
+        }
+    }
+    argv += optind;
+    argc -= optind;
+    if ((list == NULL && argc < 1) || (list != NULL && argc > 0)) {
+        fprintf(stderr, usage_message, program, program, program, usage_extra);
+        exit(1);
+    }
+
+    /*
+     * If C_TAP_VERBOSE is set in the environment, that also turns on verbose
+     * mode.
+     */
+    if (getenv("C_TAP_VERBOSE") != NULL)
+        verbose = VERBOSE;
+
+    /*
+     * Set C_TAP_SOURCE and C_TAP_BUILD environment variables.  Also set
+     * SOURCE and BUILD for backward compatibility, although we're trying to
+     * migrate to the ones with a C_TAP_* prefix.
+     */
+    if (source != NULL) {
+        c_tap_source_env = concat("C_TAP_SOURCE=", source, (const char *) 0);
+        if (putenv(c_tap_source_env) != 0)
+            sysdie("cannot set C_TAP_SOURCE in the environment");
+        source_env = concat("SOURCE=", source, (const char *) 0);
+        if (putenv(source_env) != 0)
+            sysdie("cannot set SOURCE in the environment");
+    }
+    if (build != NULL) {
+        c_tap_build_env = concat("C_TAP_BUILD=", build, (const char *) 0);
+        if (putenv(c_tap_build_env) != 0)
+            sysdie("cannot set C_TAP_BUILD in the environment");
+        build_env = concat("BUILD=", build, (const char *) 0);
+        if (putenv(build_env) != 0)
+            sysdie("cannot set BUILD in the environment");
+    }
+
+    /* Run the tests as instructed. */
+    if (single)
+        test_single(argv[0], source, build);
+    else if (list != NULL) {
+        shortlist = strrchr(list, '/');
+        if (shortlist == NULL)
+            shortlist = list;
+        else
+            shortlist++;
+        printf(banner, shortlist);
+        tests = read_test_list(list, source, build);
+        status = test_batch(tests, verbose) ? 0 : 1;
+    } else {
+        tests = build_test_list(argv, argc, source, build);
+        status = test_batch(tests, verbose) ? 0 : 1;
+    }
+
+    /* For valgrind cleanliness, free all our memory. */
+    if (source_env != NULL) {
+        putenv((char *) "C_TAP_SOURCE=");
+        putenv((char *) "SOURCE=");
+        free(c_tap_source_env);
+        free(source_env);
+    }
+    if (build_env != NULL) {
+        putenv((char *) "C_TAP_BUILD=");
+        putenv((char *) "BUILD=");
+        free(c_tap_build_env);
+        free(build_env);
+    }
+    exit(status);
+}
diff --git a/tests/style/obsolete-strings-t b/tests/style/obsolete-strings-t
new file mode 100755
index 000000000000..430f07219cef
--- /dev/null
+++ b/tests/style/obsolete-strings-t
@@ -0,0 +1,104 @@
+#!/usr/bin/perl
+#
+# Check for obsolete strings in source files.
+#
+# Examine all source files in a distribution for obsolete strings and report
+# on files that fail this check.  This catches various transitions I want to
+# do globally in all my packages, like changing my personal URLs to https.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Copyright 2016, 2018-2020 Russ Allbery <eagle@eyrie.org>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+use 5.010;
+use strict;
+use warnings;
+
+use lib "$ENV{C_TAP_SOURCE}/tap/perl";
+
+use Test::RRA qw(skip_unless_author);
+use Test::RRA::Automake qw(all_files automake_setup);
+
+use File::Basename qw(basename);
+use Test::More;
+
+# Bad patterns to search for.
+my @BAD_REGEXES = (qr{ http:// \S+ [.]eyrie[.]org }xms);
+my @BAD_STRINGS = qw(rra@stanford.edu RRA_MAINTAINER_TESTS);
+
+# File names to exclude from this check.
+my %EXCLUDE
+  = map { $_ => 1 } qw(NEWS changelog obsolete-strings.t obsolete-strings-t);
+
+# Only run this test for the package author, since it doesn't indicate any
+# user-noticable flaw in the package itself.
+skip_unless_author('Obsolete strings tests');
+
+# Set up Automake testing.
+automake_setup();
+
+# Check a single file for one of the bad patterns.
+#
+# $path - Path to the file
+#
+# Returns: undef
+sub check_file {
+    my ($path) = @_;
+    my $filename = basename($path);
+
+    # Ignore excluded and binary files.
+    return if $EXCLUDE{$filename};
+    return if !-T $path;
+
+    # Scan the file.
+    open(my $fh, '<', $path) or BAIL_OUT("Cannot open $path");
+    while (defined(my $line = <$fh>)) {
+        for my $regex (@BAD_REGEXES) {
+            if ($line =~ $regex) {
+                ok(0, "$path contains $regex");
+                close($fh) or BAIL_OUT("Cannot close $path");
+                return;
+            }
+        }
+        for my $string (@BAD_STRINGS) {
+            if (index($line, $string) != -1) {
+                ok(0, "$path contains $string");
+                close($fh) or BAIL_OUT("Cannot close $path");
+                return;
+            }
+        }
+    }
+    close($fh) or BAIL_OUT("Cannot close $path");
+    ok(1, $path);
+    return;
+}
+
+# Scan every file for any of the bad patterns or strings.  We don't declare a
+# plan since we skip a lot of files and don't want to precalculate the file
+# list.
+my @paths = all_files();
+for my $path (@paths) {
+    check_file($path);
+}
+done_testing();
diff --git a/tests/tap/basic.c b/tests/tap/basic.c
new file mode 100644
index 000000000000..b5f42d0211a4
--- /dev/null
+++ b/tests/tap/basic.c
@@ -0,0 +1,1029 @@
+/*
+ * Some utility routines for writing tests.
+ *
+ * Here are a variety of utility routines for writing tests compatible with
+ * the TAP protocol.  All routines of the form ok() or is*() take a test
+ * number and some number of appropriate arguments, check to be sure the
+ * results match the expected output using the arguments, and print out
+ * something appropriate for that test number.  Other utility routines help in
+ * constructing more complex tests, skipping tests, reporting errors, setting
+ * up the TAP output format, or finding things in the test environment.
+ *
+ * This file is part of C TAP Harness.  The current version plus supporting
+ * documentation is at <https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2009-2019 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2001-2002, 2004-2008, 2011-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <errno.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#ifdef _WIN32
+#    include <direct.h>
+#else
+#    include <sys/stat.h>
+#endif
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <tests/tap/basic.h>
+
+/* Windows provides mkdir and rmdir under different names. */
+#ifdef _WIN32
+#    define mkdir(p, m) _mkdir(p)
+#    define rmdir(p)    _rmdir(p)
+#endif
+
+/*
+ * The test count.  Always contains the number that will be used for the next
+ * test status.  This is exported to callers of the library.
+ */
+unsigned long testnum = 1;
+
+/*
+ * Status information stored so that we can give a test summary at the end of
+ * the test case.  We store the planned final test and the count of failures.
+ * We can get the highest test count from testnum.
+ */
+static unsigned long _planned = 0;
+static unsigned long _failed = 0;
+
+/*
+ * Store the PID of the process that called plan() and only summarize
+ * results when that process exits, so as to not misreport results in forked
+ * processes.
+ */
+static pid_t _process = 0;
+
+/*
+ * If true, we're doing lazy planning and will print out the plan based on the
+ * last test number at the end of testing.
+ */
+static int _lazy = 0;
+
+/*
+ * If true, the test was aborted by calling bail().  Currently, this is only
+ * used to ensure that we pass a false value to any cleanup functions even if
+ * all tests to that point have passed.
+ */
+static int _aborted = 0;
+
+/*
+ * Registered cleanup functions.  These are stored as a linked list and run in
+ * registered order by finish when the test program exits.  Each function is
+ * passed a boolean value indicating whether all tests were successful.
+ */
+struct cleanup_func {
+    test_cleanup_func func;
+    test_cleanup_func_with_data func_with_data;
+    void *data;
+    struct cleanup_func *next;
+};
+static struct cleanup_func *cleanup_funcs = NULL;
+
+/*
+ * Registered diag files.  Any output found in these files will be printed out
+ * as if it were passed to diag() before any other output we do.  This allows
+ * background processes to log to a file and have that output interleaved with
+ * the test output.
+ */
+struct diag_file {
+    char *name;
+    FILE *file;
+    char *buffer;
+    size_t bufsize;
+    struct diag_file *next;
+};
+static struct diag_file *diag_files = NULL;
+
+/*
+ * Print a specified prefix and then the test description.  Handles turning
+ * the argument list into a va_args structure suitable for passing to
+ * print_desc, which has to be done in a macro.  Assumes that format is the
+ * argument immediately before the variadic arguments.
+ */
+#define PRINT_DESC(prefix, format)  \
+    do {                            \
+        if (format != NULL) {       \
+            va_list args;           \
+            printf("%s", prefix);   \
+            va_start(args, format); \
+            vprintf(format, args);  \
+            va_end(args);           \
+        }                           \
+    } while (0)
+
+
+/*
+ * Form a new string by concatenating multiple strings.  The arguments must be
+ * terminated by (const char *) 0.
+ *
+ * This function only exists because we can't assume asprintf.  We can't
+ * simulate asprintf with snprintf because we're only assuming SUSv3, which
+ * does not require that snprintf with a NULL buffer return the required
+ * length.  When those constraints are relaxed, this should be ripped out and
+ * replaced with asprintf or a more trivial replacement with snprintf.
+ */
+static char *
+concat(const char *first, ...)
+{
+    va_list args;
+    char *result;
+    const char *string;
+    size_t offset;
+    size_t length = 0;
+
+    /*
+     * Find the total memory required.  Ensure we don't overflow length.  See
+     * the comment for breallocarray for why we're using UINT_MAX here.
+     */
+    va_start(args, first);
+    for (string = first; string != NULL; string = va_arg(args, const char *)) {
+        if (length >= UINT_MAX - strlen(string))
+            bail("strings too long in concat");
+        length += strlen(string);
+    }
+    va_end(args);
+    length++;
+
+    /* Create the string. */
+    result = bcalloc_type(length, char);
+    va_start(args, first);
+    offset = 0;
+    for (string = first; string != NULL; string = va_arg(args, const char *)) {
+        memcpy(result + offset, string, strlen(string));
+        offset += strlen(string);
+    }
+    va_end(args);
+    result[offset] = '\0';
+    return result;
+}
+
+
+/*
+ * Helper function for check_diag_files to handle a single line in a diag
+ * file.
+ *
+ * The general scheme here used is as follows: read one line of output.  If we
+ * get NULL, check for an error.  If there was one, bail out of the test
+ * program; otherwise, return, and the enclosing loop will check for EOF.
+ *
+ * If we get some data, see if it ends in a newline.  If it doesn't end in a
+ * newline, we have one of two cases: our buffer isn't large enough, in which
+ * case we resize it and try again, or we have incomplete data in the file, in
+ * which case we rewind the file and will try again next time.
+ *
+ * Returns a boolean indicating whether the last line was incomplete.
+ */
+static int
+handle_diag_file_line(struct diag_file *file, fpos_t where)
+{
+    int size;
+    size_t length;
+
+    /* Read the next line from the file. */
+    size = file->bufsize > INT_MAX ? INT_MAX : (int) file->bufsize;
+    if (fgets(file->buffer, size, file->file) == NULL) {
+        if (ferror(file->file))
+            sysbail("cannot read from %s", file->name);
+        return 0;
+    }
+
+    /*
+     * See if the line ends in a newline.  If not, see which error case we
+     * have.
+     */
+    length = strlen(file->buffer);
+    if (file->buffer[length - 1] != '\n') {
+        int incomplete = 0;
+
+        /* Check whether we ran out of buffer space and resize if so. */
+        if (length < file->bufsize - 1)
+            incomplete = 1;
+        else {
+            file->bufsize += BUFSIZ;
+            file->buffer =
+                breallocarray_type(file->buffer, file->bufsize, char);
+        }
+
+        /*
+         * On either incomplete lines or too small of a buffer, rewind
+         * and read the file again (on the next pass, if incomplete).
+         * It's simpler than trying to double-buffer the file.
+         */
+        if (fsetpos(file->file, &where) < 0)
+            sysbail("cannot set position in %s", file->name);
+        return incomplete;
+    }
+
+    /* We saw a complete line.  Print it out. */
+    printf("# %s", file->buffer);
+    return 0;
+}
+
+
+/*
+ * Check all registered diag_files for any output.  We only print out the
+ * output if we see a complete line; otherwise, we wait for the next newline.
+ */
+static void
+check_diag_files(void)
+{
+    struct diag_file *file;
+    fpos_t where;
+    int incomplete;
+
+    /*
+     * Walk through each file and read each line of output available.
+     */
+    for (file = diag_files; file != NULL; file = file->next) {
+        clearerr(file->file);
+
+        /* Store the current position in case we have to rewind. */
+        if (fgetpos(file->file, &where) < 0)
+            sysbail("cannot get position in %s", file->name);
+
+        /* Continue until we get EOF or an incomplete line of data. */
+        incomplete = 0;
+        while (!feof(file->file) && !incomplete) {
+            incomplete = handle_diag_file_line(file, where);
+        }
+    }
+}
+
+
+/*
+ * Our exit handler.  Called on completion of the test to report a summary of
+ * results provided we're still in the original process.  This also handles
+ * printing out the plan if we used plan_lazy(), although that's suppressed if
+ * we never ran a test (due to an early bail, for example), and running any
+ * registered cleanup functions.
+ */
+static void
+finish(void)
+{
+    int success, primary;
+    struct cleanup_func *current;
+    unsigned long highest = testnum - 1;
+    struct diag_file *file, *tmp;
+
+    /* Check for pending diag_file output. */
+    check_diag_files();
+
+    /* Free the diag_files. */
+    file = diag_files;
+    while (file != NULL) {
+        tmp = file;
+        file = file->next;
+        fclose(tmp->file);
+        free(tmp->name);
+        free(tmp->buffer);
+        free(tmp);
+    }
+    diag_files = NULL;
+
+    /*
+     * Determine whether all tests were successful, which is needed before
+     * calling cleanup functions since we pass that fact to the functions.
+     */
+    if (_planned == 0 && _lazy)
+        _planned = highest;
+    success = (!_aborted && _planned == highest && _failed == 0);
+
+    /*
+     * If there are any registered cleanup functions, we run those first.  We
+     * always run them, even if we didn't run a test.  Don't do anything
+     * except free the diag_files and call cleanup functions if we aren't the
+     * primary process (the process in which plan or plan_lazy was called),
+     * and tell the cleanup functions that fact.
+     */
+    primary = (_process == 0 || getpid() == _process);
+    while (cleanup_funcs != NULL) {
+        if (cleanup_funcs->func_with_data) {
+            void *data = cleanup_funcs->data;
+
+            cleanup_funcs->func_with_data(success, primary, data);
+        } else {
+            cleanup_funcs->func(success, primary);
+        }
+        current = cleanup_funcs;
+        cleanup_funcs = cleanup_funcs->next;
+        free(current);
+    }
+    if (!primary)
+        return;
+
+    /* Don't do anything further if we never planned a test. */
+    if (_planned == 0)
+        return;
+
+    /* If we're aborting due to bail, don't print summaries. */
+    if (_aborted)
+        return;
+
+    /* Print out the lazy plan if needed. */
+    fflush(stderr);
+    if (_lazy && _planned > 0)
+        printf("1..%lu\n", _planned);
+
+    /* Print out a summary of the results. */
+    if (_planned > highest)
+        diag("Looks like you planned %lu test%s but only ran %lu", _planned,
+             (_planned > 1 ? "s" : ""), highest);
+    else if (_planned < highest)
+        diag("Looks like you planned %lu test%s but ran %lu extra", _planned,
+             (_planned > 1 ? "s" : ""), highest - _planned);
+    else if (_failed > 0)
+        diag("Looks like you failed %lu test%s of %lu", _failed,
+             (_failed > 1 ? "s" : ""), _planned);
+    else if (_planned != 1)
+        diag("All %lu tests successful or skipped", _planned);
+    else
+        diag("%lu test successful or skipped", _planned);
+}
+
+
+/*
+ * Initialize things.  Turns on line buffering on stdout and then prints out
+ * the number of tests in the test suite.  We intentionally don't check for
+ * pending diag_file output here, since it should really come after the plan.
+ */
+void
+plan(unsigned long count)
+{
+    if (setvbuf(stdout, NULL, _IOLBF, BUFSIZ) != 0)
+        sysdiag("cannot set stdout to line buffered");
+    fflush(stderr);
+    printf("1..%lu\n", count);
+    testnum = 1;
+    _planned = count;
+    _process = getpid();
+    if (atexit(finish) != 0) {
+        sysdiag("cannot register exit handler");
+        diag("cleanups will not be run");
+    }
+}
+
+
+/*
+ * Initialize things for lazy planning, where we'll automatically print out a
+ * plan at the end of the program.  Turns on line buffering on stdout as well.
+ */
+void
+plan_lazy(void)
+{
+    if (setvbuf(stdout, NULL, _IOLBF, BUFSIZ) != 0)
+        sysdiag("cannot set stdout to line buffered");
+    testnum = 1;
+    _process = getpid();
+    _lazy = 1;
+    if (atexit(finish) != 0)
+        sysbail("cannot register exit handler to display plan");
+}
+
+
+/*
+ * Skip the entire test suite and exits.  Should be called instead of plan(),
+ * not after it, since it prints out a special plan line.  Ignore diag_file
+ * output here, since it's not clear if it's allowed before the plan.
+ */
+void
+skip_all(const char *format, ...)
+{
+    fflush(stderr);
+    printf("1..0 # skip");
+    PRINT_DESC(" ", format);
+    putchar('\n');
+    exit(0);
+}
+
+
+/*
+ * Takes a boolean success value and assumes the test passes if that value
+ * is true and fails if that value is false.
+ */
+int
+ok(int success, const char *format, ...)
+{
+    fflush(stderr);
+    check_diag_files();
+    printf("%sok %lu", success ? "" : "not ", testnum++);
+    if (!success)
+        _failed++;
+    PRINT_DESC(" - ", format);
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Same as ok(), but takes the format arguments as a va_list.
+ */
+int
+okv(int success, const char *format, va_list args)
+{
+    fflush(stderr);
+    check_diag_files();
+    printf("%sok %lu", success ? "" : "not ", testnum++);
+    if (!success)
+        _failed++;
+    if (format != NULL) {
+        printf(" - ");
+        vprintf(format, args);
+    }
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Skip a test.
+ */
+void
+skip(const char *reason, ...)
+{
+    fflush(stderr);
+    check_diag_files();
+    printf("ok %lu # skip", testnum++);
+    PRINT_DESC(" ", reason);
+    putchar('\n');
+}
+
+
+/*
+ * Report the same status on the next count tests.
+ */
+int
+ok_block(unsigned long count, int success, const char *format, ...)
+{
+    unsigned long i;
+
+    fflush(stderr);
+    check_diag_files();
+    for (i = 0; i < count; i++) {
+        printf("%sok %lu", success ? "" : "not ", testnum++);
+        if (!success)
+            _failed++;
+        PRINT_DESC(" - ", format);
+        putchar('\n');
+    }
+    return success;
+}
+
+
+/*
+ * Skip the next count tests.
+ */
+void
+skip_block(unsigned long count, const char *reason, ...)
+{
+    unsigned long i;
+
+    fflush(stderr);
+    check_diag_files();
+    for (i = 0; i < count; i++) {
+        printf("ok %lu # skip", testnum++);
+        PRINT_DESC(" ", reason);
+        putchar('\n');
+    }
+}
+
+
+/*
+ * Takes two boolean values and requires the truth value of both match.
+ */
+int
+is_bool(int left, int right, const char *format, ...)
+{
+    int success;
+
+    fflush(stderr);
+    check_diag_files();
+    success = (!!left == !!right);
+    if (success)
+        printf("ok %lu", testnum++);
+    else {
+        diag(" left: %s", !!left ? "true" : "false");
+        diag("right: %s", !!right ? "true" : "false");
+        printf("not ok %lu", testnum++);
+        _failed++;
+    }
+    PRINT_DESC(" - ", format);
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Takes two integer values and requires they match.
+ */
+int
+is_int(long left, long right, const char *format, ...)
+{
+    int success;
+
+    fflush(stderr);
+    check_diag_files();
+    success = (left == right);
+    if (success)
+        printf("ok %lu", testnum++);
+    else {
+        diag(" left: %ld", left);
+        diag("right: %ld", right);
+        printf("not ok %lu", testnum++);
+        _failed++;
+    }
+    PRINT_DESC(" - ", format);
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Takes two strings and requires they match (using strcmp).  NULL arguments
+ * are permitted and handled correctly.
+ */
+int
+is_string(const char *left, const char *right, const char *format, ...)
+{
+    int success;
+
+    fflush(stderr);
+    check_diag_files();
+
+    /* Compare the strings, being careful of NULL. */
+    if (left == NULL)
+        success = (right == NULL);
+    else if (right == NULL)
+        success = 0;
+    else
+        success = (strcmp(left, right) == 0);
+
+    /* Report the results. */
+    if (success)
+        printf("ok %lu", testnum++);
+    else {
+        diag(" left: %s", left == NULL ? "(null)" : left);
+        diag("right: %s", right == NULL ? "(null)" : right);
+        printf("not ok %lu", testnum++);
+        _failed++;
+    }
+    PRINT_DESC(" - ", format);
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Takes two unsigned longs and requires they match.  On failure, reports them
+ * in hex.
+ */
+int
+is_hex(unsigned long left, unsigned long right, const char *format, ...)
+{
+    int success;
+
+    fflush(stderr);
+    check_diag_files();
+    success = (left == right);
+    if (success)
+        printf("ok %lu", testnum++);
+    else {
+        diag(" left: %lx", (unsigned long) left);
+        diag("right: %lx", (unsigned long) right);
+        printf("not ok %lu", testnum++);
+        _failed++;
+    }
+    PRINT_DESC(" - ", format);
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Takes pointers to a regions of memory and requires that len bytes from each
+ * match.  Otherwise reports any bytes which didn't match.
+ */
+int
+is_blob(const void *left, const void *right, size_t len, const char *format,
+        ...)
+{
+    int success;
+    size_t i;
+
+    fflush(stderr);
+    check_diag_files();
+    success = (memcmp(left, right, len) == 0);
+    if (success)
+        printf("ok %lu", testnum++);
+    else {
+        const unsigned char *left_c = (const unsigned char *) left;
+        const unsigned char *right_c = (const unsigned char *) right;
+
+        for (i = 0; i < len; i++) {
+            if (left_c[i] != right_c[i])
+                diag("offset %lu: left %02x, right %02x", (unsigned long) i,
+                     left_c[i], right_c[i]);
+        }
+        printf("not ok %lu", testnum++);
+        _failed++;
+    }
+    PRINT_DESC(" - ", format);
+    putchar('\n');
+    return success;
+}
+
+
+/*
+ * Bail out with an error.
+ */
+void
+bail(const char *format, ...)
+{
+    va_list args;
+
+    _aborted = 1;
+    fflush(stderr);
+    check_diag_files();
+    fflush(stdout);
+    printf("Bail out! ");
+    va_start(args, format);
+    vprintf(format, args);
+    va_end(args);
+    printf("\n");
+    exit(255);
+}
+
+
+/*
+ * Bail out with an error, appending strerror(errno).
+ */
+void
+sysbail(const char *format, ...)
+{
+    va_list args;
+    int oerrno = errno;
+
+    _aborted = 1;
+    fflush(stderr);
+    check_diag_files();
+    fflush(stdout);
+    printf("Bail out! ");
+    va_start(args, format);
+    vprintf(format, args);
+    va_end(args);
+    printf(": %s\n", strerror(oerrno));
+    exit(255);
+}
+
+
+/*
+ * Report a diagnostic to stderr.  Always returns 1 to allow embedding in
+ * compound statements.
+ */
+int
+diag(const char *format, ...)
+{
+    va_list args;
+
+    fflush(stderr);
+    check_diag_files();
+    fflush(stdout);
+    printf("# ");
+    va_start(args, format);
+    vprintf(format, args);
+    va_end(args);
+    printf("\n");
+    return 1;
+}
+
+
+/*
+ * Report a diagnostic to stderr, appending strerror(errno).  Always returns 1
+ * to allow embedding in compound statements.
+ */
+int
+sysdiag(const char *format, ...)
+{
+    va_list args;
+    int oerrno = errno;
+
+    fflush(stderr);
+    check_diag_files();
+    fflush(stdout);
+    printf("# ");
+    va_start(args, format);
+    vprintf(format, args);
+    va_end(args);
+    printf(": %s\n", strerror(oerrno));
+    return 1;
+}
+
+
+/*
+ * Register a new file for diag_file processing.
+ */
+void
+diag_file_add(const char *name)
+{
+    struct diag_file *file, *prev;
+
+    file = bcalloc_type(1, struct diag_file);
+    file->name = bstrdup(name);
+    file->file = fopen(file->name, "r");
+    if (file->file == NULL)
+        sysbail("cannot open %s", name);
+    file->buffer = bcalloc_type(BUFSIZ, char);
+    file->bufsize = BUFSIZ;
+    if (diag_files == NULL)
+        diag_files = file;
+    else {
+        for (prev = diag_files; prev->next != NULL; prev = prev->next)
+            ;
+        prev->next = file;
+    }
+}
+
+
+/*
+ * Remove a file from diag_file processing.  If the file is not found, do
+ * nothing, since there are some situations where it can be removed twice
+ * (such as if it's removed from a cleanup function, since cleanup functions
+ * are called after freeing all the diag_files).
+ */
+void
+diag_file_remove(const char *name)
+{
+    struct diag_file *file;
+    struct diag_file **prev = &diag_files;
+
+    for (file = diag_files; file != NULL; file = file->next) {
+        if (strcmp(file->name, name) == 0) {
+            *prev = file->next;
+            fclose(file->file);
+            free(file->name);
+            free(file->buffer);
+            free(file);
+            return;
+        }
+        prev = &file->next;
+    }
+}
+
+
+/*
+ * Allocate cleared memory, reporting a fatal error with bail on failure.
+ */
+void *
+bcalloc(size_t n, size_t size)
+{
+    void *p;
+
+    p = calloc(n, size);
+    if (p == NULL)
+        sysbail("failed to calloc %lu", (unsigned long) (n * size));
+    return p;
+}
+
+
+/*
+ * Allocate memory, reporting a fatal error with bail on failure.
+ */
+void *
+bmalloc(size_t size)
+{
+    void *p;
+
+    p = malloc(size);
+    if (p == NULL)
+        sysbail("failed to malloc %lu", (unsigned long) size);
+    return p;
+}
+
+
+/*
+ * Reallocate memory, reporting a fatal error with bail on failure.
+ */
+void *
+brealloc(void *p, size_t size)
+{
+    p = realloc(p, size);
+    if (p == NULL)
+        sysbail("failed to realloc %lu bytes", (unsigned long) size);
+    return p;
+}
+
+
+/*
+ * The same as brealloc, but determine the size by multiplying an element
+ * count by a size, similar to calloc.  The multiplication is checked for
+ * integer overflow.
+ *
+ * We should technically use SIZE_MAX here for the overflow check, but
+ * SIZE_MAX is C99 and we're only assuming C89 + SUSv3, which does not
+ * guarantee that it exists.  They do guarantee that UINT_MAX exists, and we
+ * can assume that UINT_MAX <= SIZE_MAX.
+ *
+ * (In theory, C89 and C99 permit size_t to be smaller than unsigned int, but
+ * I disbelieve in the existence of such systems and they will have to cope
+ * without overflow checks.)
+ */
+void *
+breallocarray(void *p, size_t n, size_t size)
+{
+    if (n > 0 && UINT_MAX / n <= size)
+        bail("reallocarray too large");
+    if (n == 0)
+        n = 1;
+    p = realloc(p, n * size);
+    if (p == NULL)
+        sysbail("failed to realloc %lu bytes", (unsigned long) (n * size));
+    return p;
+}
+
+
+/*
+ * Copy a string, reporting a fatal error with bail on failure.
+ */
+char *
+bstrdup(const char *s)
+{
+    char *p;
+    size_t len;
+
+    len = strlen(s) + 1;
+    p = (char *) malloc(len);
+    if (p == NULL)
+        sysbail("failed to strdup %lu bytes", (unsigned long) len);
+    memcpy(p, s, len);
+    return p;
+}
+
+
+/*
+ * Copy up to n characters of a string, reporting a fatal error with bail on
+ * failure.  Don't use the system strndup function, since it may not exist and
+ * the TAP library doesn't assume any portability support.
+ */
+char *
+bstrndup(const char *s, size_t n)
+{
+    const char *p;
+    char *copy;
+    size_t length;
+
+    /* Don't assume that the source string is nul-terminated. */
+    for (p = s; (size_t)(p - s) < n && *p != '\0'; p++)
+        ;
+    length = (size_t)(p - s);
+    copy = (char *) malloc(length + 1);
+    if (copy == NULL)
+        sysbail("failed to strndup %lu bytes", (unsigned long) length);
+    memcpy(copy, s, length);
+    copy[length] = '\0';
+    return copy;
+}
+
+
+/*
+ * Locate a test file.  Given the partial path to a file, look under
+ * C_TAP_BUILD and then C_TAP_SOURCE for the file and return the full path to
+ * the file.  Returns NULL if the file doesn't exist.  A non-NULL return
+ * should be freed with test_file_path_free().
+ */
+char *
+test_file_path(const char *file)
+{
+    char *base;
+    char *path = NULL;
+    const char *envs[] = {"C_TAP_BUILD", "C_TAP_SOURCE", NULL};
+    int i;
+
+    for (i = 0; envs[i] != NULL; i++) {
+        base = getenv(envs[i]);
+        if (base == NULL)
+            continue;
+        path = concat(base, "/", file, (const char *) 0);
+        if (access(path, R_OK) == 0)
+            break;
+        free(path);
+        path = NULL;
+    }
+    return path;
+}
+
+
+/*
+ * Free a path returned from test_file_path().  This function exists primarily
+ * for Windows, where memory must be freed from the same library domain that
+ * it was allocated from.
+ */
+void
+test_file_path_free(char *path)
+{
+    free(path);
+}
+
+
+/*
+ * Create a temporary directory, tmp, under C_TAP_BUILD if set and the current
+ * directory if it does not.  Returns the path to the temporary directory in
+ * newly allocated memory, and calls bail on any failure.  The return value
+ * should be freed with test_tmpdir_free.
+ *
+ * This function uses sprintf because it attempts to be independent of all
+ * other portability layers.  The use immediately after a memory allocation
+ * should be safe without using snprintf or strlcpy/strlcat.
+ */
+char *
+test_tmpdir(void)
+{
+    const char *build;
+    char *path = NULL;
+
+    build = getenv("C_TAP_BUILD");
+    if (build == NULL)
+        build = ".";
+    path = concat(build, "/tmp", (const char *) 0);
+    if (access(path, X_OK) < 0)
+        if (mkdir(path, 0777) < 0)
+            sysbail("error creating temporary directory %s", path);
+    return path;
+}
+
+
+/*
+ * Free a path returned from test_tmpdir() and attempt to remove the
+ * directory.  If we can't delete the directory, don't worry; something else
+ * that hasn't yet cleaned up may still be using it.
+ */
+void
+test_tmpdir_free(char *path)
+{
+    if (path != NULL)
+        rmdir(path);
+    free(path);
+}
+
+static void
+register_cleanup(test_cleanup_func func,
+                 test_cleanup_func_with_data func_with_data, void *data)
+{
+    struct cleanup_func *cleanup, **last;
+
+    cleanup = bcalloc_type(1, struct cleanup_func);
+    cleanup->func = func;
+    cleanup->func_with_data = func_with_data;
+    cleanup->data = data;
+    cleanup->next = NULL;
+    last = &cleanup_funcs;
+    while (*last != NULL)
+        last = &(*last)->next;
+    *last = cleanup;
+}
+
+/*
+ * Register a cleanup function that is called when testing ends.  All such
+ * registered functions will be run by finish.
+ */
+void
+test_cleanup_register(test_cleanup_func func)
+{
+    register_cleanup(func, NULL, NULL);
+}
+
+/*
+ * Same as above, but also allows an opaque pointer to be passed to the cleanup
+ * function.
+ */
+void
+test_cleanup_register_with_data(test_cleanup_func_with_data func, void *data)
+{
+    register_cleanup(NULL, func, data);
+}
diff --git a/tests/tap/basic.h b/tests/tap/basic.h
new file mode 100644
index 000000000000..45f15f2892a7
--- /dev/null
+++ b/tests/tap/basic.h
@@ -0,0 +1,192 @@
+/*
+ * Basic utility routines for the TAP protocol.
+ *
+ * This file is part of C TAP Harness.  The current version plus supporting
+ * documentation is at <https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2009-2019 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2001-2002, 2004-2008, 2011-2012, 2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TAP_BASIC_H
+#define TAP_BASIC_H 1
+
+#include <stdarg.h> /* va_list */
+#include <stddef.h> /* size_t */
+#include <tests/tap/macros.h>
+
+/*
+ * Used for iterating through arrays.  ARRAY_SIZE returns the number of
+ * elements in the array (useful for a < upper bound in a for loop) and
+ * ARRAY_END returns a pointer to the element past the end (ISO C99 makes it
+ * legal to refer to such a pointer as long as it's never dereferenced).
+ */
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
+#define ARRAY_END(array)  (&(array)[ARRAY_SIZE(array)])
+
+BEGIN_DECLS
+
+/*
+ * The test count.  Always contains the number that will be used for the next
+ * test status.
+ */
+extern unsigned long testnum;
+
+/* Print out the number of tests and set standard output to line buffered. */
+void plan(unsigned long count);
+
+/*
+ * Prepare for lazy planning, in which the plan will be printed automatically
+ * at the end of the test program.
+ */
+void plan_lazy(void);
+
+/* Skip the entire test suite.  Call instead of plan. */
+void skip_all(const char *format, ...)
+    __attribute__((__noreturn__, __format__(printf, 1, 2)));
+
+/*
+ * Basic reporting functions.  The okv() function is the same as ok() but
+ * takes the test description as a va_list to make it easier to reuse the
+ * reporting infrastructure when writing new tests.  ok() and okv() return the
+ * value of the success argument.
+ */
+int ok(int success, const char *format, ...)
+    __attribute__((__format__(printf, 2, 3)));
+int okv(int success, const char *format, va_list args)
+    __attribute__((__format__(printf, 2, 0)));
+void skip(const char *reason, ...) __attribute__((__format__(printf, 1, 2)));
+
+/*
+ * Report the same status on, or skip, the next count tests.  ok_block()
+ * returns the value of the success argument.
+ */
+int ok_block(unsigned long count, int success, const char *format, ...)
+    __attribute__((__format__(printf, 3, 4)));
+void skip_block(unsigned long count, const char *reason, ...)
+    __attribute__((__format__(printf, 2, 3)));
+
+/*
+ * Compare two values.  Returns true if the test passes and false if it fails.
+ * is_bool takes an int since the bool type isn't fully portable yet, but
+ * interprets both arguments for their truth value, not for their numeric
+ * value.
+ */
+int is_bool(int, int, const char *format, ...)
+    __attribute__((__format__(printf, 3, 4)));
+int is_int(long, long, const char *format, ...)
+    __attribute__((__format__(printf, 3, 4)));
+int is_string(const char *, const char *, const char *format, ...)
+    __attribute__((__format__(printf, 3, 4)));
+int is_hex(unsigned long, unsigned long, const char *format, ...)
+    __attribute__((__format__(printf, 3, 4)));
+int is_blob(const void *, const void *, size_t, const char *format, ...)
+    __attribute__((__format__(printf, 4, 5)));
+
+/* Bail out with an error.  sysbail appends strerror(errno). */
+void bail(const char *format, ...)
+    __attribute__((__noreturn__, __nonnull__, __format__(printf, 1, 2)));
+void sysbail(const char *format, ...)
+    __attribute__((__noreturn__, __nonnull__, __format__(printf, 1, 2)));
+
+/* Report a diagnostic to stderr prefixed with #. */
+int diag(const char *format, ...)
+    __attribute__((__nonnull__, __format__(printf, 1, 2)));
+int sysdiag(const char *format, ...)
+    __attribute__((__nonnull__, __format__(printf, 1, 2)));
+
+/*
+ * Register or unregister a file that contains supplementary diagnostics.
+ * Before any other output, all registered files will be read, line by line,
+ * and each line will be reported as a diagnostic as if it were passed to
+ * diag().  Nul characters are not supported in these files and will result in
+ * truncated output.
+ */
+void diag_file_add(const char *file) __attribute__((__nonnull__));
+void diag_file_remove(const char *file) __attribute__((__nonnull__));
+
+/* Allocate memory, reporting a fatal error with bail on failure. */
+void *bcalloc(size_t, size_t)
+    __attribute__((__alloc_size__(1, 2), __malloc__, __warn_unused_result__));
+void *bmalloc(size_t)
+    __attribute__((__alloc_size__(1), __malloc__, __warn_unused_result__));
+void *breallocarray(void *, size_t, size_t)
+    __attribute__((__alloc_size__(2, 3), __malloc__, __warn_unused_result__));
+void *brealloc(void *, size_t)
+    __attribute__((__alloc_size__(2), __malloc__, __warn_unused_result__));
+char *bstrdup(const char *)
+    __attribute__((__malloc__, __nonnull__, __warn_unused_result__));
+char *bstrndup(const char *, size_t)
+    __attribute__((__malloc__, __nonnull__, __warn_unused_result__));
+
+/*
+ * Macros that cast the return value from b* memory functions, making them
+ * usable in C++ code and providing some additional type safety.
+ */
+#define bcalloc_type(n, type) ((type *) bcalloc((n), sizeof(type)))
+#define breallocarray_type(p, n, type) \
+    ((type *) breallocarray((p), (n), sizeof(type)))
+
+/*
+ * Find a test file under C_TAP_BUILD or C_TAP_SOURCE, returning the full
+ * path.  The returned path should be freed with test_file_path_free().
+ */
+char *test_file_path(const char *file)
+    __attribute__((__malloc__, __nonnull__, __warn_unused_result__));
+void test_file_path_free(char *path);
+
+/*
+ * Create a temporary directory relative to C_TAP_BUILD and return the path.
+ * The returned path should be freed with test_tmpdir_free().
+ */
+char *test_tmpdir(void) __attribute__((__malloc__, __warn_unused_result__));
+void test_tmpdir_free(char *path);
+
+/*
+ * Register a cleanup function that is called when testing ends.  All such
+ * registered functions will be run during atexit handling (and are therefore
+ * subject to all the same constraints and caveats as atexit functions).
+ *
+ * The function must return void and will be passed two arguments: an int that
+ * will be true if the test completed successfully and false otherwise, and an
+ * int that will be true if the cleanup function is run in the primary process
+ * (the one that called plan or plan_lazy) and false otherwise.  If
+ * test_cleanup_register_with_data is used instead, a generic pointer can be
+ * provided and will be passed to the cleanup function as a third argument.
+ *
+ * test_cleanup_register_with_data is the better API and should have been the
+ * only API.  test_cleanup_register was an API error preserved for backward
+ * cmpatibility.
+ */
+typedef void (*test_cleanup_func)(int, int);
+typedef void (*test_cleanup_func_with_data)(int, int, void *);
+
+void test_cleanup_register(test_cleanup_func) __attribute__((__nonnull__));
+void test_cleanup_register_with_data(test_cleanup_func_with_data, void *)
+    __attribute__((__nonnull__));
+
+END_DECLS
+
+#endif /* TAP_BASIC_H */
diff --git a/tests/tap/kadmin.c b/tests/tap/kadmin.c
new file mode 100644
index 000000000000..8e70f9d0ec27
--- /dev/null
+++ b/tests/tap/kadmin.c
@@ -0,0 +1,138 @@
+/*
+ * Kerberos test setup requiring the kadmin API.
+ *
+ * This file collects Kerberos test setup functions that use the kadmin API to
+ * put principals into particular configurations for testing.  Currently, the
+ * only implemented functionality is to mark a password as expired.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#ifdef HAVE_KADM5CLNT
+#    include <portable/kadmin.h>
+#    include <portable/krb5.h>
+#endif
+#include <portable/system.h>
+
+#include <time.h>
+
+#include <tests/tap/basic.h>
+#include <tests/tap/kadmin.h>
+#include <tests/tap/kerberos.h>
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+
+/*
+ * Given the principal to set an expiration on, set that principal to have an
+ * expired password.  This requires that the realm admin server be configured
+ * either in DNS (with SRV records) or in krb5.conf (possibly the one
+ * KRB5_CONFIG is pointing to).  Authentication is done using the keytab
+ * stored in config/admin-keytab.
+ *
+ * Returns true on success.  Returns false if necessary configuration is
+ * missing so that the caller can choose whether to call bail or skip_all.  If
+ * the configuration is present but the operation fails, bails.
+ */
+#ifdef HAVE_KADM5CLNT
+bool
+kerberos_expire_password(const char *principal, time_t expires)
+{
+    char *path, *user;
+    const char *realm;
+    krb5_context ctx;
+    krb5_principal admin = NULL;
+    krb5_principal princ = NULL;
+    kadm5_ret_t code;
+    kadm5_config_params params;
+    kadm5_principal_ent_rec ent;
+    void *handle;
+    bool okay = false;
+
+    /* Set up for making our call. */
+    path = test_file_path("config/admin-keytab");
+    if (path == NULL)
+        return false;
+    code = krb5_init_context(&ctx);
+    if (code != 0)
+        bail_krb5(ctx, code, "error initializing Kerberos");
+    admin = kerberos_keytab_principal(ctx, path);
+    realm = krb5_principal_get_realm(ctx, admin);
+    code = krb5_set_default_realm(ctx, realm);
+    if (code != 0)
+        bail_krb5(ctx, code, "cannot set default realm");
+    code = krb5_unparse_name(ctx, admin, &user);
+    if (code != 0)
+        bail_krb5(ctx, code, "cannot unparse admin principal");
+    code = krb5_parse_name(ctx, principal, &princ);
+    if (code != 0)
+        bail_krb5(ctx, code, "cannot parse principal %s", principal);
+
+    /*
+     * If the actual kadmin calls fail, we may be built with MIT Kerberos
+     * against a Heimdal server or vice versa.  Return false to skip the
+     * tests.
+     */
+    memset(&params, 0, sizeof(params));
+    params.realm = (char *) realm;
+    params.mask = KADM5_CONFIG_REALM;
+    code = kadm5_init_with_skey_ctx(ctx, user, path, KADM5_ADMIN_SERVICE,
+                                    &params, KADM5_STRUCT_VERSION,
+                                    KADM5_API_VERSION, &handle);
+    if (code != 0) {
+        diag_krb5(ctx, code, "error initializing kadmin");
+        goto done;
+    }
+    memset(&ent, 0, sizeof(ent));
+    ent.principal = princ;
+    ent.pw_expiration = (krb5_timestamp) expires;
+    code = kadm5_modify_principal(handle, &ent, KADM5_PW_EXPIRATION);
+    if (code == 0)
+        okay = true;
+    else
+        diag_krb5(ctx, code, "error setting password expiration");
+
+done:
+    kadm5_destroy(handle);
+    krb5_free_unparsed_name(ctx, user);
+    krb5_free_principal(ctx, admin);
+    krb5_free_principal(ctx, princ);
+    krb5_free_context(ctx);
+    test_file_path_free(path);
+    return okay;
+}
+#else  /* !HAVE_KADM5CLNT */
+bool
+kerberos_expire_password(const char *principal UNUSED, time_t expires UNUSED)
+{
+    return false;
+}
+#endif /* !HAVE_KADM5CLNT */
diff --git a/tests/tap/kadmin.h b/tests/tap/kadmin.h
new file mode 100644
index 000000000000..c4dc657237da
--- /dev/null
+++ b/tests/tap/kadmin.h
@@ -0,0 +1,58 @@
+/*
+ * Utility functions for tests needing Kerberos admin actions.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2011, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TAP_KADMIN_H
+#define TAP_KADMIN_H 1
+
+#include <config.h>
+#include <portable/stdbool.h>
+
+#include <time.h>
+
+#include <tests/tap/macros.h>
+
+BEGIN_DECLS
+
+/*
+ * Given the principal to set an expiration on and the expiration time, set
+ * that principal's key to expire at that time.  Authentication is done using
+ * the keytab stored in config/admin-keytab.
+ *
+ * Returns true on success.  Returns false if necessary configuration is
+ * missing so that the caller can choose whether to call bail or skip_all.  If
+ * the configuration is present but the operation fails, bails.
+ */
+bool kerberos_expire_password(const char *, time_t)
+    __attribute__((__nonnull__));
+
+END_DECLS
+
+#endif /* !TAP_KADMIN_H */
diff --git a/tests/tap/kerberos.c b/tests/tap/kerberos.c
new file mode 100644
index 000000000000..765d80290a64
--- /dev/null
+++ b/tests/tap/kerberos.c
@@ -0,0 +1,544 @@
+/*
+ * Utility functions for tests that use Kerberos.
+ *
+ * The core function is kerberos_setup, which loads Kerberos test
+ * configuration and returns a struct of information.  It also supports
+ * obtaining initial tickets from the configured keytab and setting up
+ * KRB5CCNAME and KRB5_KTNAME if a Kerberos keytab is present.  Also included
+ * are utility functions for setting up a krb5.conf file and reporting
+ * Kerberos errors or warnings during testing.
+ *
+ * Some of the functionality here is only available if the Kerberos libraries
+ * are available.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2007, 2009-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+#include <portable/system.h>
+
+#include <sys/stat.h>
+
+#include <tests/tap/basic.h>
+#include <tests/tap/kerberos.h>
+#include <tests/tap/macros.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+/*
+ * Disable the requirement that format strings be literals, since it's easier
+ * to handle the possible patterns for kinit commands as an array.
+ */
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ > 2) || defined(__clang__)
+#    pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
+
+
+/*
+ * These variables hold the allocated configuration struct, the environment to
+ * point to a different Kerberos ticket cache, keytab, and configuration file,
+ * and the temporary directories used.  We store them so that we can free them
+ * on exit for cleaner valgrind output, making it easier to find real memory
+ * leaks in the tested programs.
+ */
+static struct kerberos_config *config = NULL;
+static char *krb5ccname = NULL;
+static char *krb5_ktname = NULL;
+static char *krb5_config = NULL;
+static char *tmpdir_ticket = NULL;
+static char *tmpdir_conf = NULL;
+
+
+/*
+ * Obtain Kerberos tickets and fill in the principal config entry.
+ *
+ * There are two implementations of this function, one if we have native
+ * Kerberos libraries available and one if we don't.  Uses keytab to obtain
+ * credentials, and fills in the cache member of the provided config struct.
+ */
+#ifdef HAVE_KRB5
+
+static void
+kerberos_kinit(void)
+{
+    char *name, *krbtgt;
+    krb5_error_code code;
+    krb5_context ctx;
+    krb5_ccache ccache;
+    krb5_principal kprinc;
+    krb5_keytab keytab;
+    krb5_get_init_creds_opt *opts;
+    krb5_creds creds;
+    const char *realm;
+
+    /*
+     * Determine the principal corresponding to that keytab.  We copy the
+     * memory to ensure that it's allocated in the right memory domain on
+     * systems where that may matter (like Windows).
+     */
+    code = krb5_init_context(&ctx);
+    if (code != 0)
+        bail_krb5(ctx, code, "error initializing Kerberos");
+    kprinc = kerberos_keytab_principal(ctx, config->keytab);
+    code = krb5_unparse_name(ctx, kprinc, &name);
+    if (code != 0)
+        bail_krb5(ctx, code, "error unparsing name");
+    krb5_free_principal(ctx, kprinc);
+    config->principal = bstrdup(name);
+    krb5_free_unparsed_name(ctx, name);
+
+    /* Now do the Kerberos initialization. */
+    code = krb5_cc_default(ctx, &ccache);
+    if (code != 0)
+        bail_krb5(ctx, code, "error setting ticket cache");
+    code = krb5_parse_name(ctx, config->principal, &kprinc);
+    if (code != 0)
+        bail_krb5(ctx, code, "error parsing principal %s", config->principal);
+    realm = krb5_principal_get_realm(ctx, kprinc);
+    basprintf(&krbtgt, "krbtgt/%s@%s", realm, realm);
+    code = krb5_kt_resolve(ctx, config->keytab, &keytab);
+    if (code != 0)
+        bail_krb5(ctx, code, "cannot open keytab %s", config->keytab);
+    code = krb5_get_init_creds_opt_alloc(ctx, &opts);
+    if (code != 0)
+        bail_krb5(ctx, code, "cannot allocate credential options");
+    krb5_get_init_creds_opt_set_default_flags(ctx, NULL, realm, opts);
+    krb5_get_init_creds_opt_set_forwardable(opts, 0);
+    krb5_get_init_creds_opt_set_proxiable(opts, 0);
+    code = krb5_get_init_creds_keytab(ctx, &creds, kprinc, keytab, 0, krbtgt,
+                                      opts);
+    if (code != 0)
+        bail_krb5(ctx, code, "cannot get Kerberos tickets");
+    code = krb5_cc_initialize(ctx, ccache, kprinc);
+    if (code != 0)
+        bail_krb5(ctx, code, "error initializing ticket cache");
+    code = krb5_cc_store_cred(ctx, ccache, &creds);
+    if (code != 0)
+        bail_krb5(ctx, code, "error storing credentials");
+    krb5_cc_close(ctx, ccache);
+    krb5_free_cred_contents(ctx, &creds);
+    krb5_kt_close(ctx, keytab);
+    krb5_free_principal(ctx, kprinc);
+    krb5_get_init_creds_opt_free(ctx, opts);
+    krb5_free_context(ctx);
+    free(krbtgt);
+}
+
+#else /* !HAVE_KRB5 */
+
+static void
+kerberos_kinit(void)
+{
+    static const char *const format[] = {
+        "kinit --no-afslog -k -t %s %s >/dev/null 2>&1 </dev/null",
+        "kinit -k -t %s %s >/dev/null 2>&1 </dev/null",
+        "kinit -t %s %s >/dev/null 2>&1 </dev/null",
+        "kinit -k -K %s %s >/dev/null 2>&1 </dev/null"};
+    FILE *file;
+    char *path;
+    char principal[BUFSIZ], *command;
+    size_t i;
+    int status;
+
+    /* Read the principal corresponding to the keytab. */
+    path = test_file_path("config/principal");
+    if (path == NULL) {
+        test_file_path_free(config->keytab);
+        config->keytab = NULL;
+        return;
+    }
+    file = fopen(path, "r");
+    if (file == NULL) {
+        test_file_path_free(path);
+        return;
+    }
+    test_file_path_free(path);
+    if (fgets(principal, sizeof(principal), file) == NULL)
+        bail("cannot read %s", path);
+    fclose(file);
+    if (principal[strlen(principal) - 1] != '\n')
+        bail("no newline in %s", path);
+    principal[strlen(principal) - 1] = '\0';
+    config->principal = bstrdup(principal);
+
+    /* Now do the Kerberos initialization. */
+    for (i = 0; i < ARRAY_SIZE(format); i++) {
+        basprintf(&command, format[i], config->keytab, principal);
+        status = system(command);
+        free(command);
+        if (status != -1 && WEXITSTATUS(status) == 0)
+            break;
+    }
+    if (status == -1 || WEXITSTATUS(status) != 0)
+        bail("cannot get Kerberos tickets");
+}
+
+#endif /* !HAVE_KRB5 */
+
+
+/*
+ * Free all the memory associated with our Kerberos setup, but don't remove
+ * the ticket cache.  This is used when cleaning up on exit from a non-primary
+ * process so that test programs that fork don't remove the ticket cache still
+ * used by the main program.
+ */
+static void
+kerberos_free(void)
+{
+    test_tmpdir_free(tmpdir_ticket);
+    tmpdir_ticket = NULL;
+    if (config != NULL) {
+        test_file_path_free(config->keytab);
+        free(config->principal);
+        free(config->cache);
+        free(config->userprinc);
+        free(config->username);
+        free(config->password);
+        free(config->pkinit_principal);
+        free(config->pkinit_cert);
+        free(config);
+        config = NULL;
+    }
+    if (krb5ccname != NULL) {
+        putenv((char *) "KRB5CCNAME=");
+        free(krb5ccname);
+        krb5ccname = NULL;
+    }
+    if (krb5_ktname != NULL) {
+        putenv((char *) "KRB5_KTNAME=");
+        free(krb5_ktname);
+        krb5_ktname = NULL;
+    }
+}
+
+
+/*
+ * Clean up at the end of a test.  This removes the ticket cache and resets
+ * and frees the memory allocated for the environment variables so that
+ * valgrind output on test suites is cleaner.  Most of the work is done by
+ * kerberos_free, but this function also deletes the ticket cache.
+ */
+void
+kerberos_cleanup(void)
+{
+    char *path;
+
+    if (tmpdir_ticket != NULL) {
+        basprintf(&path, "%s/krb5cc_test", tmpdir_ticket);
+        unlink(path);
+        free(path);
+    }
+    kerberos_free();
+}
+
+
+/*
+ * The cleanup handler for the TAP framework.  Call kerberos_cleanup if we're
+ * in the primary process and kerberos_free if not.  The first argument, which
+ * indicates whether the test succeeded or not, is ignored, since we need to
+ * do the same thing either way.
+ */
+static void
+kerberos_cleanup_handler(int success UNUSED, int primary)
+{
+    if (primary)
+        kerberos_cleanup();
+    else
+        kerberos_free();
+}
+
+
+/*
+ * Obtain Kerberos tickets for the principal specified in config/principal
+ * using the keytab specified in config/keytab, both of which are presumed to
+ * be in tests in either the build or the source tree.  Also sets KRB5_KTNAME
+ * and KRB5CCNAME.
+ *
+ * Returns the contents of config/principal in newly allocated memory or NULL
+ * if Kerberos tests are apparently not configured.  If Kerberos tests are
+ * configured but something else fails, calls bail.
+ */
+struct kerberos_config *
+kerberos_setup(enum kerberos_needs needs)
+{
+    char *path;
+    char buffer[BUFSIZ];
+    FILE *file = NULL;
+
+    /* If we were called before, clean up after the previous run. */
+    if (config != NULL)
+        kerberos_cleanup();
+    config = bcalloc(1, sizeof(struct kerberos_config));
+
+    /*
+     * If we have a config/keytab file, set the KRB5CCNAME and KRB5_KTNAME
+     * environment variables and obtain initial tickets.
+     */
+    config->keytab = test_file_path("config/keytab");
+    if (config->keytab == NULL) {
+        if (needs == TAP_KRB_NEEDS_KEYTAB || needs == TAP_KRB_NEEDS_BOTH)
+            skip_all("Kerberos tests not configured");
+    } else {
+        tmpdir_ticket = test_tmpdir();
+        basprintf(&config->cache, "%s/krb5cc_test", tmpdir_ticket);
+        basprintf(&krb5ccname, "KRB5CCNAME=%s/krb5cc_test", tmpdir_ticket);
+        basprintf(&krb5_ktname, "KRB5_KTNAME=%s", config->keytab);
+        putenv(krb5ccname);
+        putenv(krb5_ktname);
+        kerberos_kinit();
+    }
+
+    /*
+     * If we have a config/password file, read it and fill out the relevant
+     * members of our config struct.
+     */
+    path = test_file_path("config/password");
+    if (path != NULL)
+        file = fopen(path, "r");
+    if (file == NULL) {
+        if (needs == TAP_KRB_NEEDS_PASSWORD || needs == TAP_KRB_NEEDS_BOTH)
+            skip_all("Kerberos tests not configured");
+    } else {
+        if (fgets(buffer, sizeof(buffer), file) == NULL)
+            bail("cannot read %s", path);
+        if (buffer[strlen(buffer) - 1] != '\n')
+            bail("no newline in %s", path);
+        buffer[strlen(buffer) - 1] = '\0';
+        config->userprinc = bstrdup(buffer);
+        if (fgets(buffer, sizeof(buffer), file) == NULL)
+            bail("cannot read password from %s", path);
+        fclose(file);
+        if (buffer[strlen(buffer) - 1] != '\n')
+            bail("password too long in %s", path);
+        buffer[strlen(buffer) - 1] = '\0';
+        config->password = bstrdup(buffer);
+
+        /*
+         * Strip the realm from the principal and set realm and username.
+         * This is not strictly correct; it doesn't cope with escaped @-signs
+         * or enterprise names.
+         */
+        config->username = bstrdup(config->userprinc);
+        config->realm = strchr(config->username, '@');
+        if (config->realm == NULL)
+            bail("test principal has no realm");
+        *config->realm = '\0';
+        config->realm++;
+    }
+    test_file_path_free(path);
+
+    /*
+     * If we have PKINIT configuration, read it and fill out the relevant
+     * members of our config struct.
+     */
+    path = test_file_path("config/pkinit-principal");
+    if (path != NULL)
+        file = fopen(path, "r");
+    if (path != NULL && file != NULL) {
+        if (fgets(buffer, sizeof(buffer), file) == NULL)
+            bail("cannot read %s", path);
+        if (buffer[strlen(buffer) - 1] != '\n')
+            bail("no newline in %s", path);
+        buffer[strlen(buffer) - 1] = '\0';
+        fclose(file);
+        test_file_path_free(path);
+        path = test_file_path("config/pkinit-cert");
+        if (path != NULL) {
+            config->pkinit_principal = bstrdup(buffer);
+            config->pkinit_cert = bstrdup(path);
+        }
+    }
+    test_file_path_free(path);
+    if (config->pkinit_cert == NULL && (needs & TAP_KRB_NEEDS_PKINIT) != 0)
+        skip_all("PKINIT tests not configured");
+
+    /*
+     * Register the cleanup function so that the caller doesn't have to do
+     * explicit cleanup.
+     */
+    test_cleanup_register(kerberos_cleanup_handler);
+
+    /* Return the configuration. */
+    return config;
+}
+
+
+/*
+ * Clean up the krb5.conf file generated by kerberos_generate_conf and free
+ * the memory used to set the environment variable.  This doesn't fail if the
+ * file and variable are already gone, allowing it to be harmlessly run
+ * multiple times.
+ *
+ * Normally called via an atexit handler.
+ */
+void
+kerberos_cleanup_conf(void)
+{
+    char *path;
+
+    if (tmpdir_conf != NULL) {
+        basprintf(&path, "%s/krb5.conf", tmpdir_conf);
+        unlink(path);
+        free(path);
+        test_tmpdir_free(tmpdir_conf);
+        tmpdir_conf = NULL;
+    }
+    putenv((char *) "KRB5_CONFIG=");
+    free(krb5_config);
+    krb5_config = NULL;
+}
+
+
+/*
+ * Generate a krb5.conf file for testing and set KRB5_CONFIG to point to it.
+ * The [appdefaults] section will be stripped out and the default realm will
+ * be set to the realm specified, if not NULL.  This will use config/krb5.conf
+ * in preference, so users can configure the tests by creating that file if
+ * the system file isn't suitable.
+ *
+ * Depends on data/generate-krb5-conf being present in the test suite.
+ */
+void
+kerberos_generate_conf(const char *realm)
+{
+    char *path;
+    const char *argv[3];
+
+    if (tmpdir_conf != NULL)
+        kerberos_cleanup_conf();
+    path = test_file_path("data/generate-krb5-conf");
+    if (path == NULL)
+        bail("cannot find generate-krb5-conf");
+    argv[0] = path;
+    argv[1] = realm;
+    argv[2] = NULL;
+    run_setup(argv);
+    test_file_path_free(path);
+    tmpdir_conf = test_tmpdir();
+    basprintf(&krb5_config, "KRB5_CONFIG=%s/krb5.conf", tmpdir_conf);
+    putenv(krb5_config);
+    if (atexit(kerberos_cleanup_conf) != 0)
+        sysdiag("cannot register cleanup function");
+}
+
+
+/*
+ * The remaining functions in this file are only available if Kerberos
+ * libraries are available.
+ */
+#ifdef HAVE_KRB5
+
+
+/*
+ * Report a Kerberos error and bail out.  Takes a long instead of a
+ * krb5_error_code because it can also handle a kadm5_ret_t (which may be a
+ * different size).
+ */
+void
+bail_krb5(krb5_context ctx, long code, const char *format, ...)
+{
+    const char *k5_msg = NULL;
+    char *message;
+    va_list args;
+
+    if (ctx != NULL)
+        k5_msg = krb5_get_error_message(ctx, (krb5_error_code) code);
+    va_start(args, format);
+    bvasprintf(&message, format, args);
+    va_end(args);
+    if (k5_msg == NULL)
+        bail("%s", message);
+    else
+        bail("%s: %s", message, k5_msg);
+}
+
+
+/*
+ * Report a Kerberos error as a diagnostic to stderr.  Takes a long instead of
+ * a krb5_error_code because it can also handle a kadm5_ret_t (which may be a
+ * different size).
+ */
+void
+diag_krb5(krb5_context ctx, long code, const char *format, ...)
+{
+    const char *k5_msg = NULL;
+    char *message;
+    va_list args;
+
+    if (ctx != NULL)
+        k5_msg = krb5_get_error_message(ctx, (krb5_error_code) code);
+    va_start(args, format);
+    bvasprintf(&message, format, args);
+    va_end(args);
+    if (k5_msg == NULL)
+        diag("%s", message);
+    else
+        diag("%s: %s", message, k5_msg);
+    free(message);
+    if (k5_msg != NULL)
+        krb5_free_error_message(ctx, k5_msg);
+}
+
+
+/*
+ * Find the principal of the first entry of a keytab and return it.  The
+ * caller is responsible for freeing the result with krb5_free_principal.
+ * Exit on error.
+ */
+krb5_principal
+kerberos_keytab_principal(krb5_context ctx, const char *path)
+{
+    krb5_keytab keytab;
+    krb5_kt_cursor cursor;
+    krb5_keytab_entry entry;
+    krb5_principal princ;
+    krb5_error_code status;
+
+    status = krb5_kt_resolve(ctx, path, &keytab);
+    if (status != 0)
+        bail_krb5(ctx, status, "error opening %s", path);
+    status = krb5_kt_start_seq_get(ctx, keytab, &cursor);
+    if (status != 0)
+        bail_krb5(ctx, status, "error reading %s", path);
+    status = krb5_kt_next_entry(ctx, keytab, &entry, &cursor);
+    if (status != 0)
+        bail("no principal found in keytab file %s", path);
+    status = krb5_copy_principal(ctx, entry.principal, &princ);
+    if (status != 0)
+        bail_krb5(ctx, status, "error copying principal from %s", path);
+    krb5_kt_free_entry(ctx, &entry);
+    krb5_kt_end_seq_get(ctx, keytab, &cursor);
+    krb5_kt_close(ctx, keytab);
+    return princ;
+}
+
+#endif /* HAVE_KRB5 */
diff --git a/tests/tap/kerberos.h b/tests/tap/kerberos.h
new file mode 100644
index 000000000000..53dd09619c96
--- /dev/null
+++ b/tests/tap/kerberos.h
@@ -0,0 +1,135 @@
+/*
+ * Utility functions for tests that use Kerberos.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2017, 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2007, 2009, 2011-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TAP_KERBEROS_H
+#define TAP_KERBEROS_H 1
+
+#include <config.h>
+#include <tests/tap/macros.h>
+
+#ifdef HAVE_KRB5
+#    include <portable/krb5.h>
+#endif
+
+/* Holds the information parsed from the Kerberos test configuration. */
+struct kerberos_config {
+    char *keytab;           /* Path to the keytab. */
+    char *principal;        /* Principal whose keys are in the keytab. */
+    char *cache;            /* Path to the Kerberos ticket cache. */
+    char *userprinc;        /* The fully-qualified principal. */
+    char *username;         /* The local (non-realm) part of principal. */
+    char *realm;            /* The realm part of the principal. */
+    char *password;         /* The password. */
+    char *pkinit_principal; /* Principal for PKINIT authentication. */
+    char *pkinit_cert;      /* Path to certificates for PKINIT. */
+};
+
+/*
+ * Whether to skip all tests (by calling skip_all) in kerberos_setup if
+ * certain configuration information isn't available.  "_BOTH" means that the
+ * tests require both keytab and password, but PKINIT is not required.
+ */
+enum kerberos_needs
+{
+    /* clang-format off */
+    TAP_KRB_NEEDS_NONE     = 0x00,
+    TAP_KRB_NEEDS_KEYTAB   = 0x01,
+    TAP_KRB_NEEDS_PASSWORD = 0x02,
+    TAP_KRB_NEEDS_BOTH     = 0x01 | 0x02,
+    TAP_KRB_NEEDS_PKINIT   = 0x04
+    /* clang-format on */
+};
+
+BEGIN_DECLS
+
+/*
+ * Set up Kerberos, returning the test configuration information.  This
+ * obtains Kerberos tickets from config/keytab, if one is present, and stores
+ * them in a Kerberos ticket cache, sets KRB5_KTNAME and KRB5CCNAME.  It also
+ * loads the principal and password from config/password, if it exists, and
+ * stores the principal, password, username, and realm in the returned struct.
+ *
+ * If there is no config/keytab file, KRB5_KTNAME and KRB5CCNAME won't be set
+ * and the keytab field will be NULL.  If there is no config/password file,
+ * the principal field will be NULL.  If the files exist but loading them
+ * fails, or authentication fails, kerberos_setup calls bail.
+ *
+ * kerberos_cleanup will be run as a cleanup function normally, freeing all
+ * resources and cleaning up temporary files on process exit.  It can,
+ * however, be called directly if for some reason the caller needs to delete
+ * the Kerberos environment again.  However, normally the caller can just call
+ * kerberos_setup again.
+ */
+struct kerberos_config *kerberos_setup(enum kerberos_needs)
+    __attribute__((__malloc__));
+void kerberos_cleanup(void);
+
+/*
+ * Generate a krb5.conf file for testing and set KRB5_CONFIG to point to it.
+ * The [appdefaults] section will be stripped out and the default realm will
+ * be set to the realm specified, if not NULL.  This will use config/krb5.conf
+ * in preference, so users can configure the tests by creating that file if
+ * the system file isn't suitable.
+ *
+ * Depends on data/generate-krb5-conf being present in the test suite.
+ *
+ * kerberos_cleanup_conf will clean up after this function, but usually
+ * doesn't need to be called directly since it's registered as an atexit
+ * handler.
+ */
+void kerberos_generate_conf(const char *realm);
+void kerberos_cleanup_conf(void);
+
+/* These interfaces are only available with native Kerberos support. */
+#ifdef HAVE_KRB5
+
+/* Bail out with an error, appending the Kerberos error message. */
+void bail_krb5(krb5_context, long, const char *format, ...)
+    __attribute__((__noreturn__, __nonnull__(3), __format__(printf, 3, 4)));
+
+/* Report a diagnostic with Kerberos error to stderr prefixed with #. */
+void diag_krb5(krb5_context, long, const char *format, ...)
+    __attribute__((__nonnull__(3), __format__(printf, 3, 4)));
+
+/*
+ * Given a Kerberos context and the path to a keytab, retrieve the principal
+ * for the first entry in the keytab and return it.  Calls bail on failure.
+ * The returned principal should be freed with krb5_free_principal.
+ */
+krb5_principal kerberos_keytab_principal(krb5_context, const char *path)
+    __attribute__((__nonnull__));
+
+#endif /* HAVE_KRB5 */
+
+END_DECLS
+
+#endif /* !TAP_MESSAGES_H */
diff --git a/tests/tap/libtap.sh b/tests/tap/libtap.sh
new file mode 100644
index 000000000000..1827a689e380
--- /dev/null
+++ b/tests/tap/libtap.sh
@@ -0,0 +1,248 @@
+# Shell function library for test cases.
+#
+# Note that while many of the functions in this library could benefit from
+# using "local" to avoid possibly hammering global variables, Solaris /bin/sh
+# doesn't support local and this library aspires to be portable to Solaris
+# Bourne shell.  Instead, all private variables are prefixed with "tap_".
+#
+# This file provides a TAP-compatible shell function library useful for
+# writing test cases.  It is part of C TAP Harness, which can be found at
+# <https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2009-2012, 2016 Russ Allbery <eagle@eyrie.org>
+# Copyright 2006-2008, 2013
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+# IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+# Print out the number of test cases we expect to run.
+plan () {
+    count=1
+    planned="$1"
+    failed=0
+    echo "1..$1"
+    trap finish 0
+}
+
+# Prepare for lazy planning.
+plan_lazy () {
+    count=1
+    planned=0
+    failed=0
+    trap finish 0
+}
+
+# Report the test status on exit.
+finish () {
+    tap_highest=`expr "$count" - 1`
+    if [ "$planned" = 0 ] ; then
+        echo "1..$tap_highest"
+        planned="$tap_highest"
+    fi
+    tap_looks='# Looks like you'
+    if [ "$planned" -gt 0 ] ; then
+        if [ "$planned" -gt "$tap_highest" ] ; then
+            if [ "$planned" -gt 1 ] ; then
+                echo "$tap_looks planned $planned tests but only ran" \
+                    "$tap_highest"
+            else
+                echo "$tap_looks planned $planned test but only ran" \
+                    "$tap_highest"
+            fi
+        elif [ "$planned" -lt "$tap_highest" ] ; then
+            tap_extra=`expr "$tap_highest" - "$planned"`
+            if [ "$planned" -gt 1 ] ; then
+                echo "$tap_looks planned $planned tests but ran" \
+                    "$tap_extra extra"
+            else
+                echo "$tap_looks planned $planned test but ran" \
+                    "$tap_extra extra"
+            fi
+        elif [ "$failed" -gt 0 ] ; then
+            if [ "$failed" -gt 1 ] ; then
+                echo "$tap_looks failed $failed tests of $planned"
+            else
+                echo "$tap_looks failed $failed test of $planned"
+            fi
+        elif [ "$planned" -gt 1 ] ; then
+            echo "# All $planned tests successful or skipped"
+        else
+            echo "# $planned test successful or skipped"
+        fi
+    fi
+}
+
+# Skip the entire test suite.  Should be run instead of plan.
+skip_all () {
+    tap_desc="$1"
+    if [ -n "$tap_desc" ] ; then
+        echo "1..0 # skip $tap_desc"
+    else
+        echo "1..0 # skip"
+    fi
+    exit 0
+}
+
+# ok takes a test description and a command to run and prints success if that
+# command is successful, false otherwise.  The count starts at 1 and is
+# updated each time ok is printed.
+ok () {
+    tap_desc="$1"
+    if [ -n "$tap_desc" ] ; then
+        tap_desc=" - $tap_desc"
+    fi
+    shift
+    if "$@" ; then
+        echo ok "$count$tap_desc"
+    else
+        echo not ok "$count$tap_desc"
+        failed=`expr $failed + 1`
+    fi
+    count=`expr $count + 1`
+}
+
+# Skip the next test.  Takes the reason why the test is skipped.
+skip () {
+    echo "ok $count # skip $*"
+    count=`expr $count + 1`
+}
+
+# Report the same status on a whole set of tests.  Takes the count of tests,
+# the description, and then the command to run to determine the status.
+ok_block () {
+    tap_i=$count
+    tap_end=`expr $count + $1`
+    shift
+    while [ "$tap_i" -lt "$tap_end" ] ; do
+        ok "$@"
+        tap_i=`expr $tap_i + 1`
+    done
+}
+
+# Skip a whole set of tests.  Takes the count and then the reason for skipping
+# the test.
+skip_block () {
+    tap_i=$count
+    tap_end=`expr $count + $1`
+    shift
+    while [ "$tap_i" -lt "$tap_end" ] ; do
+        skip "$@"
+        tap_i=`expr $tap_i + 1`
+    done
+}
+
+# Portable variant of printf '%s\n' "$*".  In the majority of cases, this
+# function is slower than printf, because the latter is often implemented
+# as a builtin command.  The value of the variable IFS is ignored.
+#
+# This macro must not be called via backticks inside double quotes, since this
+# will result in bizarre escaping behavior and lots of extra backslashes on
+# Solaris.
+puts () {
+    cat << EOH
+$@
+EOH
+}
+
+# Run a program expected to succeed, and print ok if it does and produces the
+# correct output.  Takes the description, expected exit status, the expected
+# output, the command to run, and then any arguments for that command.
+# Standard output and standard error are combined when analyzing the output of
+# the command.
+#
+# If the command may contain system-specific error messages in its output,
+# add strip_colon_error before the command to post-process its output.
+ok_program () {
+    tap_desc="$1"
+    shift
+    tap_w_status="$1"
+    shift
+    tap_w_output="$1"
+    shift
+    tap_output=`"$@" 2>&1`
+    tap_status=$?
+    if [ $tap_status = $tap_w_status ] \
+        && [ x"$tap_output" = x"$tap_w_output" ] ; then
+        ok "$tap_desc" true
+    else
+        echo "#  saw: ($tap_status) $tap_output"
+        echo "#  not: ($tap_w_status) $tap_w_output"
+        ok "$tap_desc" false
+    fi
+}
+
+# Strip a colon and everything after it off the output of a command, as long
+# as that colon comes after at least one whitespace character.  (This is done
+# to avoid stripping the name of the program from the start of an error
+# message.)  This is used to remove system-specific error messages (coming
+# from strerror, for example).
+strip_colon_error() {
+    tap_output=`"$@" 2>&1`
+    tap_status=$?
+    tap_output=`puts "$tap_output" | sed 's/^\([^ ]* [^:]*\):.*/\1/'`
+    puts "$tap_output"
+    return $tap_status
+}
+
+# Bail out with an error message.
+bail () {
+    echo 'Bail out!' "$@"
+    exit 255
+}
+
+# Output a diagnostic on standard error, preceded by the required # mark.
+diag () {
+    echo '#' "$@"
+}
+
+# Search for the given file first in $C_TAP_BUILD and then in $C_TAP_SOURCE
+# and echo the path where the file was found, or the empty string if the file
+# wasn't found.
+#
+# This macro uses puts, so don't run it using backticks inside double quotes
+# or bizarre quoting behavior will happen with Solaris sh.
+test_file_path () {
+    if [ -n "$C_TAP_BUILD" ] && [ -f "$C_TAP_BUILD/$1" ] ; then
+        puts "$C_TAP_BUILD/$1"
+    elif [ -n "$C_TAP_SOURCE" ] && [ -f "$C_TAP_SOURCE/$1" ] ; then
+        puts "$C_TAP_SOURCE/$1"
+    else
+        echo ''
+    fi
+}
+
+# Create $C_TAP_BUILD/tmp for use by tests for storing temporary files and
+# return the path (via standard output).
+#
+# This macro uses puts, so don't run it using backticks inside double quotes
+# or bizarre quoting behavior will happen with Solaris sh.
+test_tmpdir () {
+    if [ -z "$C_TAP_BUILD" ] ; then
+        tap_tmpdir="./tmp"
+    else
+        tap_tmpdir="$C_TAP_BUILD"/tmp
+    fi
+    if [ ! -d "$tap_tmpdir" ] ; then
+        mkdir "$tap_tmpdir" || bail "Error creating $tap_tmpdir"
+    fi
+    puts "$tap_tmpdir"
+}
diff --git a/tests/tap/macros.h b/tests/tap/macros.h
new file mode 100644
index 000000000000..c2c8b5c7315d
--- /dev/null
+++ b/tests/tap/macros.h
@@ -0,0 +1,99 @@
+/*
+ * Helpful macros for TAP header files.
+ *
+ * This is not, strictly speaking, related to TAP, but any TAP add-on is
+ * probably going to need these macros, so define them in one place so that
+ * everyone can pull them in.
+ *
+ * This file is part of C TAP Harness.  The current version plus supporting
+ * documentation is at <https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+ *
+ * Copyright 2008, 2012-2013, 2015 Russ Allbery <eagle@eyrie.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TAP_MACROS_H
+#define TAP_MACROS_H 1
+
+/*
+ * __attribute__ is available in gcc 2.5 and later, but only with gcc 2.7
+ * could you use the __format__ form of the attributes, which is what we use
+ * (to avoid confusion with other macros), and only with gcc 2.96 can you use
+ * the attribute __malloc__.  2.96 is very old, so don't bother trying to get
+ * the other attributes to work with GCC versions between 2.7 and 2.96.
+ */
+#ifndef __attribute__
+#    if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 96)
+#        define __attribute__(spec) /* empty */
+#    endif
+#endif
+
+/*
+ * We use __alloc_size__, but it was only available in fairly recent versions
+ * of GCC.  Suppress warnings about the unknown attribute if GCC is too old.
+ * We know that we're GCC at this point, so we can use the GCC variadic macro
+ * extension, which will still work with versions of GCC too old to have C99
+ * variadic macro support.
+ */
+#if !defined(__attribute__) && !defined(__alloc_size__)
+#    if defined(__GNUC__) && !defined(__clang__)
+#        if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 3)
+#            define __alloc_size__(spec, args...) /* empty */
+#        endif
+#    endif
+#endif
+
+/* Suppress __warn_unused_result__ if gcc is too old. */
+#if !defined(__attribute__) && !defined(__warn_unused_result__)
+#    if __GNUC__ < 3 || (__GNUC__ == 3 && __GNUC_MINOR__ < 4)
+#        define __warn_unused_result__ /* empty */
+#    endif
+#endif
+
+/*
+ * LLVM and Clang pretend to be GCC but don't support all of the __attribute__
+ * settings that GCC does.  For them, suppress warnings about unknown
+ * attributes on declarations.  This unfortunately will affect the entire
+ * compilation context, but there's no push and pop available.
+ */
+#if !defined(__attribute__) && (defined(__llvm__) || defined(__clang__))
+#    pragma GCC diagnostic ignored "-Wattributes"
+#endif
+
+/* Used for unused parameters to silence gcc warnings. */
+#define UNUSED __attribute__((__unused__))
+
+/*
+ * BEGIN_DECLS is used at the beginning of declarations so that C++
+ * compilers don't mangle their names.  END_DECLS is used at the end.
+ */
+#undef BEGIN_DECLS
+#undef END_DECLS
+#ifdef __cplusplus
+#    define BEGIN_DECLS extern "C" {
+#    define END_DECLS   }
+#else
+#    define BEGIN_DECLS /* empty */
+#    define END_DECLS   /* empty */
+#endif
+
+#endif /* TAP_MACROS_H */
diff --git a/tests/tap/perl/Test/RRA.pm b/tests/tap/perl/Test/RRA.pm
new file mode 100644
index 000000000000..6ea65c5701c3
--- /dev/null
+++ b/tests/tap/perl/Test/RRA.pm
@@ -0,0 +1,324 @@
+# Helper functions for test programs written in Perl.
+#
+# This module provides a collection of helper functions used by test programs
+# written in Perl.  This is a general collection of functions that can be used
+# by both C packages with Automake and by stand-alone Perl modules.  See
+# Test::RRA::Automake for additional functions specifically for C Automake
+# distributions.
+#
+# SPDX-License-Identifier: MIT
+
+package Test::RRA;
+
+use 5.010;
+use base qw(Exporter);
+use strict;
+use warnings;
+
+use Carp qw(croak);
+use File::Temp;
+
+# Abort if Test::More was loaded before Test::RRA to be sure that we get the
+# benefits of the Test::More probing below.
+if ($INC{'Test/More.pm'}) {
+    croak('Test::More loaded before Test::RRA');
+}
+
+# Red Hat's base perl package doesn't include Test::More (one has to install
+# the perl-core package in addition).  Try to detect this and skip any Perl
+# tests if Test::More is not present.  This relies on Test::RRA being included
+# before Test::More.
+eval {
+    require Test::More;
+    Test::More->import();
+};
+if ($@) {
+    print "1..0 # SKIP Test::More required for test\n"
+      or croak('Cannot write to stdout');
+    exit 0;
+}
+
+# Declare variables that should be set in BEGIN for robustness.
+our (@EXPORT_OK, $VERSION);
+
+# Set $VERSION and everything export-related in a BEGIN block for robustness
+# against circular module loading (not that we load any modules, but
+# consistency is good).
+BEGIN {
+    @EXPORT_OK = qw(
+        is_file_contents skip_unless_author skip_unless_automated use_prereq
+    );
+
+    # This version should match the corresponding rra-c-util release, but with
+    # two digits for the minor version, including a leading zero if necessary,
+    # so that it will sort properly.
+    $VERSION = '10.00';
+}
+
+# Compare a string to the contents of a file, similar to the standard is()
+# function, but to show the line-based unified diff between them if they
+# differ.
+#
+# $got      - The output that we received
+# $expected - The path to the file containing the expected output
+# $message  - The message to use when reporting the test results
+#
+# Returns: undef
+#  Throws: Exception on failure to read or write files or run diff
+sub is_file_contents {
+    my ($got, $expected, $message) = @_;
+
+    # If they're equal, this is simple.
+    open(my $fh, '<', $expected) or BAIL_OUT("Cannot open $expected: $!\n");
+    my $data = do { local $/ = undef; <$fh> };
+    close($fh) or BAIL_OUT("Cannot close $expected: $!\n");
+    if ($got eq $data) {
+        is($got, $data, $message);
+        return;
+    }
+
+    # Otherwise, we show a diff, but only if we have IPC::System::Simple and
+    # diff succeeds.  Otherwise, we fall back on showing the full expected and
+    # seen output.
+    eval {
+        require IPC::System::Simple;
+
+        my $tmp     = File::Temp->new();
+        my $tmpname = $tmp->filename;
+        print {$tmp} $got or BAIL_OUT("Cannot write to $tmpname: $!\n");
+        my @command = ('diff', '-u', $expected, $tmpname);
+        my $diff    = IPC::System::Simple::capturex([0 .. 1], @command);
+        diag($diff);
+    };
+    if ($@) {
+        diag('Expected:');
+        diag($expected);
+        diag('Seen:');
+        diag($data);
+    }
+
+    # Report failure.
+    ok(0, $message);
+    return;
+}
+
+# Skip this test unless author tests are requested.  Takes a short description
+# of what tests this script would perform, which is used in the skip message.
+# Calls plan skip_all, which will terminate the program.
+#
+# $description - Short description of the tests
+#
+# Returns: undef
+sub skip_unless_author {
+    my ($description) = @_;
+    if (!$ENV{AUTHOR_TESTING}) {
+        plan(skip_all => "$description only run for author");
+    }
+    return;
+}
+
+# Skip this test unless doing automated testing or release testing.  This is
+# used for tests that should be run by CPAN smoke testing or during releases,
+# but not for manual installs by end users.  Takes a short description of what
+# tests this script would perform, which is used in the skip message.  Calls
+# plan skip_all, which will terminate the program.
+#
+# $description - Short description of the tests
+#
+# Returns: undef
+sub skip_unless_automated {
+    my ($description) = @_;
+    for my $env (qw(AUTOMATED_TESTING RELEASE_TESTING AUTHOR_TESTING)) {
+        return if $ENV{$env};
+    }
+    plan(skip_all => "$description normally skipped");
+    return;
+}
+
+# Attempt to load a module and skip the test if the module could not be
+# loaded.  If the module could be loaded, call its import function manually.
+# If the module could not be loaded, calls plan skip_all, which will terminate
+# the program.
+#
+# The special logic here is based on Test::More and is required to get the
+# imports to happen in the caller's namespace.
+#
+# $module  - Name of the module to load
+# @imports - Any arguments to import, possibly including a version
+#
+# Returns: undef
+sub use_prereq {
+    my ($module, @imports) = @_;
+
+    # If the first import looks like a version, pass it as a bare string.
+    my $version = q{};
+    if (@imports >= 1 && $imports[0] =~ m{ \A \d+ (?: [.][\d_]+ )* \z }xms) {
+        $version = shift(@imports);
+    }
+
+    # Get caller information to put imports in the correct package.
+    my ($package) = caller;
+
+    # Do the import with eval, and try to isolate it from the surrounding
+    # context as much as possible.  Based heavily on Test::More::_eval.
+    ## no critic (BuiltinFunctions::ProhibitStringyEval)
+    ## no critic (ValuesAndExpressions::ProhibitImplicitNewlines)
+    my ($result, $error, $sigdie);
+    {
+        local $@            = undef;
+        local $!            = undef;
+        local $SIG{__DIE__} = undef;
+        $result = eval qq{
+            package $package;
+            use $module $version \@imports;
+            1;
+        };
+        $error  = $@;
+        $sigdie = $SIG{__DIE__} || undef;
+    }
+
+    # If the use failed for any reason, skip the test.
+    if (!$result || $error) {
+        my $name = length($version) > 0 ? "$module $version" : $module;
+        plan(skip_all => "$name required for test");
+    }
+
+    # If the module set $SIG{__DIE__}, we cleared that via local.  Restore it.
+    ## no critic (Variables::RequireLocalizedPunctuationVars)
+    if (defined($sigdie)) {
+        $SIG{__DIE__} = $sigdie;
+    }
+    return;
+}
+
+1;
+__END__
+
+=for stopwords
+Allbery Allbery's DESC bareword sublicense MERCHANTABILITY NONINFRINGEMENT
+rra-c-util CPAN diff
+
+=head1 NAME
+
+Test::RRA - Support functions for Perl tests
+
+=head1 SYNOPSIS
+
+    use Test::RRA
+      qw(skip_unless_author skip_unless_automated use_prereq);
+
+    # Skip this test unless author tests are requested.
+    skip_unless_author('Coding style tests');
+
+    # Skip this test unless doing automated or release testing.
+    skip_unless_automated('POD syntax tests');
+
+    # Load modules, skipping the test if they're not available.
+    use_prereq('Perl6::Slurp', 'slurp');
+    use_prereq('Test::Script::Run', '0.04');
+
+=head1 DESCRIPTION
+
+This module collects utility functions that are useful for Perl test scripts.
+It assumes Russ Allbery's Perl module layout and test conventions and will
+only be useful for other people if they use the same conventions.
+
+This module B<must> be loaded before Test::More or it will abort during
+import.  It will skip the test (by printing a skip message to standard output
+and exiting with status 0, equivalent to C<plan skip_all>) during import if
+Test::More is not available.  This allows tests written in Perl using this
+module to be skipped if run on a system with Perl but not Test::More, such as
+Red Hat systems with the C<perl> package but not the C<perl-core> package
+installed.
+
+=head1 FUNCTIONS
+
+None of these functions are imported by default.  The ones used by a script
+should be explicitly imported.
+
+=over 4
+
+=item is_file_contents(GOT, EXPECTED, MESSAGE)
+
+Check a string against the contents of a file, showing the differences if any
+using diff (if IPC::System::Simple and diff are available).  GOT is the output
+the test received.  EXPECTED is the path to a file containing the expected
+output (not the output itself).  MESSAGE is a message to display alongside the
+test results.
+
+=item skip_unless_author(DESC)
+
+Checks whether AUTHOR_TESTING is set in the environment and skips the whole
+test (by calling C<plan skip_all> from Test::More) if it is not.  DESC is a
+description of the tests being skipped.  A space and C<only run for author>
+will be appended to it and used as the skip reason.
+
+=item skip_unless_automated(DESC)
+
+Checks whether AUTHOR_TESTING, AUTOMATED_TESTING, or RELEASE_TESTING are set
+in the environment and skips the whole test (by calling C<plan skip_all> from
+Test::More) if they are not.  This should be used by tests that should not run
+during end-user installs of the module, but which should run as part of CPAN
+smoke testing and release testing.
+
+DESC is a description of the tests being skipped.  A space and C<normally
+skipped> will be appended to it and used as the skip reason.
+
+=item use_prereq(MODULE[, VERSION][, IMPORT ...])
+
+Attempts to load MODULE with the given VERSION and import arguments.  If this
+fails for any reason, the test will be skipped (by calling C<plan skip_all>
+from Test::More) with a skip reason saying that MODULE is required for the
+test.
+
+VERSION will be passed to C<use> as a version bareword if it looks like a
+version number.  The remaining IMPORT arguments will be passed as the value of
+an array.
+
+=back
+
+=head1 AUTHOR
+
+Russ Allbery <eagle@eyrie.org>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright 2016, 2018-2019, 2021 Russ Allbery <eagle@eyrie.org>
+
+Copyright 2013-2014 The Board of Trustees of the Leland Stanford Junior
+University
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=head1 SEE ALSO
+
+Test::More(3), Test::RRA::Automake(3), Test::RRA::Config(3)
+
+This module is maintained in the rra-c-util package.  The current version is
+available from L<https://www.eyrie.org/~eagle/software/rra-c-util/>.
+
+The functions to control when tests are run use environment variables defined
+by the L<Lancaster
+Consensus|https://github.com/Perl-Toolchain-Gang/toolchain-site/blob/master/lancaster-consensus.md>.
+
+=cut
+
+# Local Variables:
+# copyright-at-end-flag: t
+# End:
diff --git a/tests/tap/perl/Test/RRA/Automake.pm b/tests/tap/perl/Test/RRA/Automake.pm
new file mode 100644
index 000000000000..261feab81e27
--- /dev/null
+++ b/tests/tap/perl/Test/RRA/Automake.pm
@@ -0,0 +1,487 @@
+# Helper functions for Perl test programs in Automake distributions.
+#
+# This module provides a collection of helper functions used by test programs
+# written in Perl and included in C source distributions that use Automake.
+# They embed knowledge of how I lay out my source trees and test suites with
+# Autoconf and Automake.  They may be usable by others, but doing so will
+# require closely following the conventions implemented by the rra-c-util
+# utility collection.
+#
+# All the functions here assume that C_TAP_BUILD and C_TAP_SOURCE are set in
+# the environment.  This is normally done via the C TAP Harness runtests
+# wrapper.
+#
+# SPDX-License-Identifier: MIT
+
+package Test::RRA::Automake;
+
+use 5.010;
+use base qw(Exporter);
+use strict;
+use warnings;
+
+use Exporter;
+use File::Find qw(find);
+use File::Spec;
+use Test::More;
+use Test::RRA::Config qw($LIBRARY_PATH);
+
+# Used below for use lib calls.
+my ($PERL_BLIB_ARCH, $PERL_BLIB_LIB);
+
+# Determine the path to the build tree of any embedded Perl module package in
+# this source package.  We do this in a BEGIN block because we're going to use
+# the results in a use lib command below.
+BEGIN {
+    $PERL_BLIB_ARCH = File::Spec->catdir(qw(perl blib arch));
+    $PERL_BLIB_LIB  = File::Spec->catdir(qw(perl blib lib));
+
+    # If C_TAP_BUILD is set, we can come up with better values.
+    if (defined($ENV{C_TAP_BUILD})) {
+        my ($vol, $dirs) = File::Spec->splitpath($ENV{C_TAP_BUILD}, 1);
+        my @dirs = File::Spec->splitdir($dirs);
+        pop(@dirs);
+        $PERL_BLIB_ARCH = File::Spec->catdir(@dirs, qw(perl blib arch));
+        $PERL_BLIB_LIB  = File::Spec->catdir(@dirs, qw(perl blib lib));
+    }
+}
+
+# Prefer the modules built as part of our source package.  Otherwise, we may
+# not find Perl modules while testing, or find the wrong versions.
+use lib $PERL_BLIB_ARCH;
+use lib $PERL_BLIB_LIB;
+
+# Declare variables that should be set in BEGIN for robustness.
+our (@EXPORT_OK, $VERSION);
+
+# Set $VERSION and everything export-related in a BEGIN block for robustness
+# against circular module loading (not that we load any modules, but
+# consistency is good).
+BEGIN {
+    @EXPORT_OK = qw(
+        all_files automake_setup perl_dirs test_file_path test_tmpdir
+    );
+
+    # This version should match the corresponding rra-c-util release, but with
+    # two digits for the minor version, including a leading zero if necessary,
+    # so that it will sort properly.
+    $VERSION = '10.00';
+}
+
+# Directories to skip globally when looking for all files, or for directories
+# that could contain Perl files.
+my @GLOBAL_SKIP = qw(
+    .git .pc _build autom4te.cache build-aux perl/_build perl/blib
+);
+
+# Additional paths to skip when building a list of all files in the
+# distribution.  This primarily skips build artifacts that aren't interesting
+# to any of the tests.  These match any path component.
+my @FILES_SKIP = qw(
+    .deps .dirstamp .libs aclocal.m4 config.h config.h.in config.h.in~
+    config.log config.status configure configure~
+);
+
+# The temporary directory created by test_tmpdir, if any.  If this is set,
+# attempt to remove the directory stored here on program exit (but ignore
+# failure to do so).
+my $TMPDIR;
+
+# Returns a list of all files in the distribution.
+#
+# Returns: List of files
+sub all_files {
+    my @files;
+
+    # Turn the skip lists into hashes for ease of querying.
+    my %skip       = map { $_ => 1 } @GLOBAL_SKIP;
+    my %files_skip = map { $_ => 1 } @FILES_SKIP;
+
+    # Wanted function for find.  Prune anything matching either of the skip
+    # lists, or *.lo files, and then add all regular files to the list.
+    my $wanted = sub {
+        my $file = $_;
+        my $path = $File::Find::name;
+        $path =~ s{ \A [.]/ }{}xms;
+        if ($skip{$path} || $files_skip{$file} || $file =~ m{ [.]lo\z }xms) {
+            $File::Find::prune = 1;
+            return;
+        }
+        if (!-d $file) {
+            push(@files, $path);
+        }
+    };
+
+    # Do the recursive search and return the results.
+    find($wanted, q{.});
+    return @files;
+}
+
+# Perform initial test setup for running a Perl test in an Automake package.
+# This verifies that C_TAP_BUILD and C_TAP_SOURCE are set and then changes
+# directory to the C_TAP_SOURCE directory by default.  Sets LD_LIBRARY_PATH if
+# the $LIBRARY_PATH configuration option is set.  Calls BAIL_OUT if
+# C_TAP_BUILD or C_TAP_SOURCE are missing or if anything else fails.
+#
+# $args_ref - Reference to a hash of arguments to configure behavior:
+#   chdir_build - If set to a true value, changes to C_TAP_BUILD instead of
+#                 C_TAP_SOURCE
+#
+# Returns: undef
+sub automake_setup {
+    my ($args_ref) = @_;
+
+    # Bail if C_TAP_BUILD or C_TAP_SOURCE are not set.
+    if (!$ENV{C_TAP_BUILD}) {
+        BAIL_OUT('C_TAP_BUILD not defined (run under runtests)');
+    }
+    if (!$ENV{C_TAP_SOURCE}) {
+        BAIL_OUT('C_TAP_SOURCE not defined (run under runtests)');
+    }
+
+    # C_TAP_BUILD or C_TAP_SOURCE will be the test directory.  Change to the
+    # parent.
+    my $start;
+    if ($args_ref->{chdir_build}) {
+        $start = $ENV{C_TAP_BUILD};
+    } else {
+        $start = $ENV{C_TAP_SOURCE};
+    }
+    my ($vol, $dirs) = File::Spec->splitpath($start, 1);
+    my @dirs = File::Spec->splitdir($dirs);
+    pop(@dirs);
+
+    # Simplify relative paths at the end of the directory.
+    my $ups = 0;
+    my $i   = $#dirs;
+    while ($i > 2 && $dirs[$i] eq File::Spec->updir) {
+        $ups++;
+        $i--;
+    }
+    for (1 .. $ups) {
+        pop(@dirs);
+        pop(@dirs);
+    }
+    my $root = File::Spec->catpath($vol, File::Spec->catdir(@dirs), q{});
+    chdir($root) or BAIL_OUT("cannot chdir to $root: $!");
+
+    # If C_TAP_BUILD is a subdirectory of C_TAP_SOURCE, add it to the global
+    # ignore list.
+    my ($buildvol, $builddirs) = File::Spec->splitpath($ENV{C_TAP_BUILD}, 1);
+    my @builddirs = File::Spec->splitdir($builddirs);
+    pop(@builddirs);
+    if ($buildvol eq $vol && @builddirs == @dirs + 1) {
+        while (@dirs && $builddirs[0] eq $dirs[0]) {
+            shift(@builddirs);
+            shift(@dirs);
+        }
+        if (@builddirs == 1) {
+            push(@GLOBAL_SKIP, $builddirs[0]);
+        }
+    }
+
+    # Set LD_LIBRARY_PATH if the $LIBRARY_PATH configuration option is set.
+    ## no critic (Variables::RequireLocalizedPunctuationVars)
+    if (defined($LIBRARY_PATH)) {
+        @builddirs = File::Spec->splitdir($builddirs);
+        pop(@builddirs);
+        my $libdir = File::Spec->catdir(@builddirs, $LIBRARY_PATH);
+        my $path   = File::Spec->catpath($buildvol, $libdir, q{});
+        if (-d "$path/.libs") {
+            $path .= '/.libs';
+        }
+        if ($ENV{LD_LIBRARY_PATH}) {
+            $ENV{LD_LIBRARY_PATH} .= ":$path";
+        } else {
+            $ENV{LD_LIBRARY_PATH} = $path;
+        }
+    }
+    return;
+}
+
+# Returns a list of directories that may contain Perl scripts and that should
+# be passed to Perl test infrastructure that expects a list of directories to
+# recursively check.  The list will be all eligible top-level directories in
+# the package except for the tests directory, which is broken out to one
+# additional level.  Calls BAIL_OUT on any problems
+#
+# $args_ref - Reference to a hash of arguments to configure behavior:
+#   skip - A reference to an array of directories to skip
+#
+# Returns: List of directories possibly containing Perl scripts to test
+sub perl_dirs {
+    my ($args_ref) = @_;
+
+    # Add the global skip list.  We also ignore the perl directory if it
+    # exists since, in my packages, it is treated as a Perl module
+    # distribution and has its own standalone test suite.
+    my @skip = $args_ref->{skip} ? @{ $args_ref->{skip} } : ();
+    push(@skip, @GLOBAL_SKIP, 'perl');
+
+    # Separate directories to skip under tests from top-level directories.
+    my @skip_tests = grep { m{ \A tests/ }xms } @skip;
+    @skip = grep { !m{ \A tests }xms } @skip;
+    for my $skip_dir (@skip_tests) {
+        $skip_dir =~ s{ \A tests/ }{}xms;
+    }
+
+    # Convert the skip lists into hashes for convenience.
+    my %skip       = map { $_ => 1 } @skip, 'tests';
+    my %skip_tests = map { $_ => 1 } @skip_tests;
+
+    # Build the list of top-level directories to test.
+    opendir(my $rootdir, q{.}) or BAIL_OUT("cannot open .: $!");
+    my @dirs = grep { -d && !$skip{$_} } readdir($rootdir);
+    closedir($rootdir);
+    @dirs = File::Spec->no_upwards(@dirs);
+
+    # Add the list of subdirectories of the tests directory.
+    if (-d 'tests') {
+        opendir(my $testsdir, q{tests}) or BAIL_OUT("cannot open tests: $!");
+
+        # Skip if found in %skip_tests or if not a directory.
+        my $is_skipped = sub {
+            my ($dir) = @_;
+            return 1 if $skip_tests{$dir};
+            $dir = File::Spec->catdir('tests', $dir);
+            return -d $dir ? 0 : 1;
+        };
+
+        # Build the filtered list of subdirectories of tests.
+        my @test_dirs = grep { !$is_skipped->($_) } readdir($testsdir);
+        closedir($testsdir);
+        @test_dirs = File::Spec->no_upwards(@test_dirs);
+
+        # Add the tests directory to the start of the directory name.
+        push(@dirs, map { File::Spec->catdir('tests', $_) } @test_dirs);
+    }
+    return @dirs;
+}
+
+# Find a configuration file for the test suite.  Searches relative to
+# C_TAP_BUILD first and then C_TAP_SOURCE and returns whichever is found
+# first.  Calls BAIL_OUT if the file could not be found.
+#
+# $file - Partial path to the file
+#
+# Returns: Full path to the file
+sub test_file_path {
+    my ($file) = @_;
+  BASE:
+    for my $base ($ENV{C_TAP_BUILD}, $ENV{C_TAP_SOURCE}) {
+        next if !defined($base);
+        if (-e "$base/$file") {
+            return "$base/$file";
+        }
+    }
+    BAIL_OUT("cannot find $file");
+    return;
+}
+
+# Create a temporary directory for tests to use for transient files and return
+# the path to that directory.  The directory is automatically removed on
+# program exit.  The directory permissions use the current umask.  Calls
+# BAIL_OUT if the directory could not be created.
+#
+# Returns: Path to a writable temporary directory
+sub test_tmpdir {
+    my $path;
+
+    # If we already figured out what directory to use, reuse the same path.
+    # Otherwise, create a directory relative to C_TAP_BUILD if set.
+    if (defined($TMPDIR)) {
+        $path = $TMPDIR;
+    } else {
+        my $base;
+        if (defined($ENV{C_TAP_BUILD})) {
+            $base = $ENV{C_TAP_BUILD};
+        } else {
+            $base = File::Spec->curdir;
+        }
+        $path = File::Spec->catdir($base, 'tmp');
+    }
+
+    # Create the directory if it doesn't exist.
+    if (!-d $path) {
+        if (!mkdir($path, 0777)) {
+            BAIL_OUT("cannot create directory $path: $!");
+        }
+    }
+
+    # Store the directory name for cleanup and return it.
+    $TMPDIR = $path;
+    return $path;
+}
+
+# On program exit, remove $TMPDIR if set and if possible.  Report errors with
+# diag but otherwise ignore them.
+END {
+    if (defined($TMPDIR) && -d $TMPDIR) {
+        local $! = undef;
+        if (!rmdir($TMPDIR)) {
+            diag("cannot remove temporary directory $TMPDIR: $!");
+        }
+    }
+}
+
+1;
+__END__
+
+=for stopwords
+Allbery Automake Automake-aware Automake-based rra-c-util ARGS subdirectories
+sublicense MERCHANTABILITY NONINFRINGEMENT umask
+
+=head1 NAME
+
+Test::RRA::Automake - Automake-aware support functions for Perl tests
+
+=head1 SYNOPSIS
+
+    use Test::RRA::Automake qw(automake_setup perl_dirs test_file_path);
+    automake_setup({ chdir_build => 1 });
+
+    # Paths to directories that may contain Perl scripts.
+    my @dirs = perl_dirs({ skip => [qw(lib)] });
+
+    # Configuration for Kerberos tests.
+    my $keytab = test_file_path('config/keytab');
+
+=head1 DESCRIPTION
+
+This module collects utility functions that are useful for test scripts
+written in Perl and included in a C Automake-based package.  They assume the
+layout of a package that uses rra-c-util and C TAP Harness for the test
+structure.
+
+Loading this module will also add the directories C<perl/blib/arch> and
+C<perl/blib/lib> to the Perl library search path, relative to C_TAP_BUILD if
+that environment variable is set.  This is harmless for C Automake projects
+that don't contain an embedded Perl module, and for those projects that do,
+this will allow subsequent C<use> calls to find modules that are built as part
+of the package build process.
+
+The automake_setup() function should be called before calling any other
+functions provided by this module.
+
+=head1 FUNCTIONS
+
+None of these functions are imported by default.  The ones used by a script
+should be explicitly imported.  On failure, all of these functions call
+BAIL_OUT (from Test::More).
+
+=over 4
+
+=item all_files()
+
+Returns a list of all "interesting" files in the distribution that a test
+suite may want to look at.  This excludes various products of the build system,
+the build directory if it's under the source directory, and a few other
+uninteresting directories like F<.git>.  The returned paths will be paths
+relative to the root of the package.
+
+=item automake_setup([ARGS])
+
+Verifies that the C_TAP_BUILD and C_TAP_SOURCE environment variables are set
+and then changes directory to the top of the source tree (which is one
+directory up from the C_TAP_SOURCE path, since C_TAP_SOURCE points to the top
+of the tests directory).
+
+If ARGS is given, it should be a reference to a hash of configuration options.
+Only one option is supported: C<chdir_build>.  If it is set to a true value,
+automake_setup() changes directories to the top of the build tree instead.
+
+=item perl_dirs([ARGS])
+
+Returns a list of directories that may contain Perl scripts that should be
+tested by test scripts that test all Perl in the source tree (such as syntax
+or coding style checks).  The paths will be simple directory names relative to
+the current directory or two-part directory names under the F<tests>
+directory.  (Directories under F<tests> are broken out separately since it's
+common to want to apply different policies to different subdirectories of
+F<tests>.)
+
+If ARGS is given, it should be a reference to a hash of configuration options.
+Only one option is supported: C<skip>, whose value should be a reference to an
+array of additional top-level directories or directories starting with
+C<tests/> that should be skipped.
+
+=item test_file_path(FILE)
+
+Given FILE, which should be a relative path, locates that file relative to the
+test directory in either the source or build tree.  FILE will be checked for
+relative to the environment variable C_TAP_BUILD first, and then relative to
+C_TAP_SOURCE.  test_file_path() returns the full path to FILE or calls
+BAIL_OUT if FILE could not be found.
+
+=item test_tmpdir()
+
+Create a temporary directory for tests to use for transient files and return
+the path to that directory.  The directory is created relative to the
+C_TAP_BUILD environment variable, which must be set.  Permissions on the
+directory are set using the current umask.  test_tmpdir() returns the full
+path to the temporary directory or calls BAIL_OUT if it could not be created.
+
+The directory is automatically removed if possible on program exit.  Failure
+to remove the directory on exit is reported with diag() and otherwise ignored.
+
+=back
+
+=head1 ENVIRONMENT
+
+=over 4
+
+=item C_TAP_BUILD
+
+The root of the tests directory in Automake build directory for this package,
+used to find files as documented above.
+
+=item C_TAP_SOURCE
+
+The root of the tests directory in the source tree for this package, used to
+find files as documented above.
+
+=back
+
+=head1 AUTHOR
+
+Russ Allbery <eagle@eyrie.org>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright 2014-2015, 2018-2021 Russ Allbery <eagle@eyrie.org>
+
+Copyright 2013 The Board of Trustees of the Leland Stanford Junior University
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=head1 SEE ALSO
+
+Test::More(3), Test::RRA(3), Test::RRA::Config(3)
+
+This module is maintained in the rra-c-util package.  The current version is
+available from L<https://www.eyrie.org/~eagle/software/rra-c-util/>.
+
+The C TAP Harness test driver and libraries for TAP-based C testing are
+available from L<https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+
+=cut
+
+# Local Variables:
+# copyright-at-end-flag: t
+# End:
diff --git a/tests/tap/perl/Test/RRA/Config.pm b/tests/tap/perl/Test/RRA/Config.pm
new file mode 100644
index 000000000000..77f967e35b52
--- /dev/null
+++ b/tests/tap/perl/Test/RRA/Config.pm
@@ -0,0 +1,224 @@
+# Configuration for Perl test cases.
+#
+# In order to reuse the same Perl test cases in multiple packages, I use a
+# configuration file to store some package-specific data.  This module loads
+# that configuration and provides the namespace for the configuration
+# settings.
+#
+# SPDX-License-Identifier: MIT
+
+package Test::RRA::Config;
+
+use 5.010;
+use base qw(Exporter);
+use strict;
+use warnings;
+
+use Test::More;
+
+# Declare variables that should be set in BEGIN for robustness.
+our (@EXPORT_OK, $VERSION);
+
+# Set $VERSION and everything export-related in a BEGIN block for robustness
+# against circular module loading (not that we load any modules, but
+# consistency is good).
+BEGIN {
+    @EXPORT_OK = qw(
+        $COVERAGE_LEVEL @COVERAGE_SKIP_TESTS @CRITIC_IGNORE $LIBRARY_PATH
+        $MINIMUM_VERSION %MINIMUM_VERSION @MODULE_VERSION_IGNORE
+        @POD_COVERAGE_EXCLUDE @STRICT_IGNORE @STRICT_PREREQ
+    );
+
+    # This version should match the corresponding rra-c-util release, but with
+    # two digits for the minor version, including a leading zero if necessary,
+    # so that it will sort properly.
+    $VERSION = '10.00';
+}
+
+# If C_TAP_BUILD or C_TAP_SOURCE are set in the environment, look for
+# data/perl.conf under those paths for a C Automake package.  Otherwise, look
+# in t/data/perl.conf for a standalone Perl module or tests/data/perl.conf for
+# Perl tests embedded in a larger distribution.  Don't use Test::RRA::Automake
+# since it may not exist.
+our $PATH;
+for my $base ($ENV{C_TAP_BUILD}, $ENV{C_TAP_SOURCE}, './t', './tests') {
+    next if !defined($base);
+    my $path = "$base/data/perl.conf";
+    if (-r $path) {
+        $PATH = $path;
+        last;
+    }
+}
+if (!defined($PATH)) {
+    BAIL_OUT('cannot find data/perl.conf');
+}
+
+# Pre-declare all of our variables and set any defaults.
+our $COVERAGE_LEVEL = 100;
+our @COVERAGE_SKIP_TESTS;
+our @CRITIC_IGNORE;
+our $LIBRARY_PATH;
+our $MINIMUM_VERSION = '5.010';
+our %MINIMUM_VERSION;
+our @MODULE_VERSION_IGNORE;
+our @POD_COVERAGE_EXCLUDE;
+our @STRICT_IGNORE;
+our @STRICT_PREREQ;
+
+# Load the configuration.
+if (!do($PATH)) {
+    my $error = $@ || $! || 'loading file did not return true';
+    BAIL_OUT("cannot load $PATH: $error");
+}
+
+1;
+__END__
+
+=for stopwords
+Allbery rra-c-util Automake perlcritic .libs namespace subdirectory sublicense
+MERCHANTABILITY NONINFRINGEMENT regexes
+
+=head1 NAME
+
+Test::RRA::Config - Perl test configuration
+
+=head1 SYNOPSIS
+
+    use Test::RRA::Config qw($MINIMUM_VERSION);
+    print "Required Perl version is $MINIMUM_VERSION\n";
+
+=head1 DESCRIPTION
+
+Test::RRA::Config encapsulates per-package configuration for generic Perl test
+programs that are shared between multiple packages using the rra-c-util
+infrastructure.  It handles locating and loading the test configuration file
+for both C Automake packages and stand-alone Perl modules.
+
+Test::RRA::Config looks for a file named F<data/perl.conf> relative to the
+root of the test directory.  That root is taken from the environment variables
+C_TAP_BUILD or C_TAP_SOURCE (in that order) if set, which will be the case for
+C Automake packages using C TAP Harness.  If neither is set, it expects the
+root of the test directory to be a directory named F<t> relative to the
+current directory, which will be the case for stand-alone Perl modules.
+
+The following variables are supported:
+
+=over 4
+
+=item $COVERAGE_LEVEL
+
+The coverage level achieved by the test suite for Perl test coverage testing
+using Test::Strict, as a percentage.  The test will fail if test coverage less
+than this percentage is achieved.  If not given, defaults to 100.
+
+=item @COVERAGE_SKIP_TESTS
+
+Directories under F<t> whose tests should be skipped when doing coverage
+testing.  This can be tests that won't contribute to coverage or tests that
+don't run properly under Devel::Cover for some reason (such as ones that use
+taint checking).  F<docs> and F<style> will always be skipped regardless of
+this setting.
+
+=item @CRITIC_IGNORE
+
+Additional files or directories to ignore when doing recursive perlcritic
+testing.  To ignore files that will be installed, the path should start with
+F<blib>.
+
+=item $LIBRARY_PATH
+
+Add this directory (or a F<.libs> subdirectory) relative to the top of the
+source tree to LD_LIBRARY_PATH when checking the syntax of Perl modules.  This
+may be required to pick up libraries that are used by in-tree Perl modules so
+that Perl scripts can pass a syntax check.
+
+=item $MINIMUM_VERSION
+
+Default minimum version requirement for included Perl scripts.  If not given,
+defaults to 5.010.
+
+=item %MINIMUM_VERSION
+
+Minimum version exceptions for specific directories.  The keys should be
+minimum versions of Perl to enforce.  The value for each key should be a
+reference to an array of either top-level directory names or directory names
+starting with F<tests/>.  All files in those directories will have that
+minimum Perl version constraint imposed instead of $MINIMUM_VERSION.
+
+=item @MODULE_VERSION_IGNORE
+
+File names to ignore when checking that all modules in a distribution have the
+same version.  Sometimes, some specific modules need separate, special version
+handling, such as modules defining database schemata for DBIx::Class, and
+can't follow the version of the larger package.
+
+=item @POD_COVERAGE_EXCLUDE
+
+Regexes that match method names that should be excluded from POD coverage
+testing.  Normally, all methods have to be documented in the POD for a Perl
+module, but methods matching any of these regexes will be considered private
+and won't require documentation.
+
+=item @STRICT_IGNORE
+
+Additional directories to ignore when doing recursive Test::Strict testing for
+C<use strict> and C<use warnings>.  The contents of this directory must be
+either top-level directory names or directory names starting with F<tests/>.
+
+=item @STRICT_PREREQ
+
+A list of Perl modules that have to be available in order to do meaningful
+Test::Strict testing.  If any of the modules cannot be loaded via C<use>,
+Test::Strict checking will be skipped.  There is currently no way to require
+specific versions of the modules.
+
+=back
+
+No variables are exported by default, but the variables can be imported into
+the local namespace to avoid long variable names.
+
+=head1 AUTHOR
+
+Russ Allbery <eagle@eyrie.org>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright 2015-2016, 2019, 2021 Russ Allbery <eagle@eyrie.org>
+
+Copyright 2013-2014 The Board of Trustees of the Leland Stanford Junior
+University
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=head1 SEE ALSO
+
+perlcritic(1), Test::MinimumVersion(3), Test::RRA(3), Test::RRA::Automake(3),
+Test::Strict(3)
+
+This module is maintained in the rra-c-util package.  The current version is
+available from L<https://www.eyrie.org/~eagle/software/rra-c-util/>.
+
+The C TAP Harness test driver and libraries for TAP-based C testing are
+available from L<https://www.eyrie.org/~eagle/software/c-tap-harness/>.
+
+=cut
+
+# Local Variables:
+# copyright-at-end-flag: t
+# End:
diff --git a/tests/tap/process.c b/tests/tap/process.c
new file mode 100644
index 000000000000..2f797f8f7567
--- /dev/null
+++ b/tests/tap/process.c
@@ -0,0 +1,532 @@
+/*
+ * Utility functions for tests that use subprocesses.
+ *
+ * Provides utility functions for subprocess manipulation.  Specifically,
+ * provides a function, run_setup, which runs a command and bails if it fails,
+ * using its error message as the bail output, and is_function_output, which
+ * runs a function in a subprocess and checks its output and exit status
+ * against expected values.
+ *
+ * Requires an Autoconf probe for sys/select.h and a replacement for a missing
+ * mkstemp.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2002, 2004-2005, 2013, 2016-2017 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2009-2011, 2013-2014
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#ifdef HAVE_SYS_SELECT_H
+#    include <sys/select.h>
+#endif
+#include <sys/stat.h>
+#ifdef HAVE_SYS_TIME_H
+#    include <sys/time.h>
+#endif
+#include <sys/wait.h>
+#include <time.h>
+
+#include <tests/tap/basic.h>
+#include <tests/tap/process.h>
+#include <tests/tap/string.h>
+
+/* May be defined by the build system. */
+#ifndef PATH_FAKEROOT
+#    define PATH_FAKEROOT ""
+#endif
+
+/* How long to wait for the process to start in seconds. */
+#define PROCESS_WAIT 10
+
+/*
+ * Used to store information about a background process.  This contains
+ * everything required to stop the process and clean up after it.
+ */
+struct process {
+    pid_t pid;            /* PID of child process */
+    char *pidfile;        /* PID file to delete on process stop */
+    char *tmpdir;         /* Temporary directory for log file */
+    char *logfile;        /* Log file of process output */
+    bool is_child;        /* Whether we can waitpid for process */
+    struct process *next; /* Next process in global list */
+};
+
+/*
+ * Global list of started processes, which will be cleaned up automatically on
+ * program exit if they haven't been explicitly stopped with process_stop
+ * prior to that point.
+ */
+static struct process *processes = NULL;
+
+
+/*
+ * Given a function, an expected exit status, and expected output, runs that
+ * function in a subprocess, capturing stdout and stderr via a pipe, and
+ * returns the function output in newly allocated memory.  Also captures the
+ * process exit status.
+ */
+static void
+run_child_function(test_function_type function, void *data, int *status,
+                   char **output)
+{
+    int fds[2];
+    pid_t child;
+    char *buf;
+    ssize_t count, ret, buflen;
+    int rval;
+
+    /* Flush stdout before we start to avoid odd forking issues. */
+    fflush(stdout);
+
+    /* Set up the pipe and call the function, collecting its output. */
+    if (pipe(fds) == -1)
+        sysbail("can't create pipe");
+    child = fork();
+    if (child == (pid_t) -1) {
+        sysbail("can't fork");
+    } else if (child == 0) {
+        /* In child.  Set up our stdout and stderr. */
+        close(fds[0]);
+        if (dup2(fds[1], 1) == -1)
+            _exit(255);
+        if (dup2(fds[1], 2) == -1)
+            _exit(255);
+
+        /* Now, run the function and exit successfully if it returns. */
+        (*function)(data);
+        fflush(stdout);
+        _exit(0);
+    } else {
+        /*
+         * In the parent; close the extra file descriptor, read the output if
+         * any, and then collect the exit status.
+         */
+        close(fds[1]);
+        buflen = BUFSIZ;
+        buf = bmalloc(buflen);
+        count = 0;
+        do {
+            ret = read(fds[0], buf + count, buflen - count - 1);
+            if (SSIZE_MAX - count <= ret)
+                bail("maximum output size exceeded in run_child_function");
+            if (ret > 0)
+                count += ret;
+            if (count >= buflen - 1) {
+                buflen += BUFSIZ;
+                buf = brealloc(buf, buflen);
+            }
+        } while (ret > 0);
+        buf[count] = '\0';
+        if (waitpid(child, &rval, 0) == (pid_t) -1)
+            sysbail("waitpid failed");
+        close(fds[0]);
+    }
+
+    /* Store the output and return. */
+    *status = rval;
+    *output = buf;
+}
+
+
+/*
+ * Given a function, data to pass to that function, an expected exit status,
+ * and expected output, runs that function in a subprocess, capturing stdout
+ * and stderr via a pipe, and compare the combination of stdout and stderr
+ * with the expected output and the exit status with the expected status.
+ * Expects the function to always exit (not die from a signal).
+ */
+void
+is_function_output(test_function_type function, void *data, int status,
+                   const char *output, const char *format, ...)
+{
+    char *buf, *msg;
+    int rval;
+    va_list args;
+
+    run_child_function(function, data, &rval, &buf);
+
+    /* Now, check the results against what we expected. */
+    va_start(args, format);
+    bvasprintf(&msg, format, args);
+    va_end(args);
+    ok(WIFEXITED(rval), "%s (exited)", msg);
+    is_int(status, WEXITSTATUS(rval), "%s (status)", msg);
+    is_string(output, buf, "%s (output)", msg);
+    free(buf);
+    free(msg);
+}
+
+
+/*
+ * A helper function for run_setup.  This is a function to run an external
+ * command, suitable for passing into run_child_function.  The expected
+ * argument must be an argv array, with argv[0] being the command to run.
+ */
+static void
+exec_command(void *data)
+{
+    char *const *argv = data;
+
+    execvp(argv[0], argv);
+}
+
+
+/*
+ * Given a command expressed as an argv struct, with argv[0] the name or path
+ * to the command, run that command.  If it exits with a non-zero status, use
+ * the part of its output up to the first newline as the error message when
+ * calling bail.
+ */
+void
+run_setup(const char *const argv[])
+{
+    char *output, *p;
+    int status;
+
+    run_child_function(exec_command, (void *) argv, &status, &output);
+    if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
+        p = strchr(output, '\n');
+        if (p != NULL)
+            *p = '\0';
+        if (output[0] != '\0')
+            bail("%s", output);
+        else
+            bail("setup command failed with no output");
+    }
+    free(output);
+}
+
+
+/*
+ * Free the resources associated with tracking a process, without doing
+ * anything to the process.  This is kept separate so that we can free
+ * resources during shutdown in a non-primary process.
+ */
+static void
+process_free(struct process *process)
+{
+    struct process **prev;
+
+    /* Do nothing if called with a NULL argument. */
+    if (process == NULL)
+        return;
+
+    /* Remove the process from the global list. */
+    prev = &processes;
+    while (*prev != NULL && *prev != process)
+        prev = &(*prev)->next;
+    if (*prev == process)
+        *prev = process->next;
+
+    /* Free resources. */
+    free(process->pidfile);
+    free(process->logfile);
+    test_tmpdir_free(process->tmpdir);
+    free(process);
+}
+
+
+/*
+ * Kill a process and wait for it to exit.  Returns the status of the process.
+ * Calls bail on a system failure or a failure of the process to exit.
+ *
+ * We are quite aggressive with error reporting here because child processes
+ * that don't exit or that don't exist often indicate some form of test
+ * failure.
+ */
+static int
+process_kill(struct process *process)
+{
+    int result, i;
+    int status = -1;
+    struct timeval tv;
+    unsigned long pid = process->pid;
+
+    /* If the process is not a child, just kill it and hope. */
+    if (!process->is_child) {
+        if (kill(process->pid, SIGTERM) < 0 && errno != ESRCH)
+            sysbail("cannot send SIGTERM to process %lu", pid);
+        return 0;
+    }
+
+    /* Check if the process has already exited. */
+    result = waitpid(process->pid, &status, WNOHANG);
+    if (result < 0)
+        sysbail("cannot wait for child process %lu", pid);
+    else if (result > 0)
+        return status;
+
+    /*
+     * Kill the process and wait for it to exit.  I don't want to go to the
+     * work of setting up a SIGCHLD handler or a full event loop here, so we
+     * effectively poll every tenth of a second for process exit (and
+     * hopefully faster when it does since the SIGCHLD may interrupt our
+     * select, although we're racing with it.
+     */
+    if (kill(process->pid, SIGTERM) < 0 && errno != ESRCH)
+        sysbail("cannot send SIGTERM to child process %lu", pid);
+    for (i = 0; i < PROCESS_WAIT * 10; i++) {
+        tv.tv_sec = 0;
+        tv.tv_usec = 100000;
+        select(0, NULL, NULL, NULL, &tv);
+        result = waitpid(process->pid, &status, WNOHANG);
+        if (result < 0)
+            sysbail("cannot wait for child process %lu", pid);
+        else if (result > 0)
+            return status;
+    }
+
+    /* The process still hasn't exited.  Bail. */
+    bail("child process %lu did not exit on SIGTERM", pid);
+
+    /* Not reached, but some compilers may get confused. */
+    return status;
+}
+
+
+/*
+ * Stop a particular process given its process struct.  This kills the
+ * process, waits for it to exit if possible (giving it at most five seconds),
+ * and then removes it from the global processes struct so that it isn't
+ * stopped again during global shutdown.
+ */
+void
+process_stop(struct process *process)
+{
+    int status;
+    unsigned long pid = process->pid;
+
+    /* Stop the process. */
+    status = process_kill(process);
+
+    /* Call diag to flush logs as well as provide exit status. */
+    if (process->is_child)
+        diag("stopped process %lu (exit status %d)", pid, status);
+    else
+        diag("stopped process %lu", pid);
+
+    /* Remove the log and PID file. */
+    diag_file_remove(process->logfile);
+    unlink(process->pidfile);
+    unlink(process->logfile);
+
+    /* Free resources. */
+    process_free(process);
+}
+
+
+/*
+ * Stop all running processes.  This is called as a cleanup handler during
+ * process shutdown.  The first argument, which says whether the test was
+ * successful, is ignored, since the same actions should be performed
+ * regardless.  The second argument says whether this is the primary process,
+ * in which case we do the full shutdown.  Otherwise, we only free resources
+ * but don't stop the process.
+ */
+static void
+process_stop_all(int success UNUSED, int primary)
+{
+    while (processes != NULL) {
+        if (primary)
+            process_stop(processes);
+        else
+            process_free(processes);
+    }
+}
+
+
+/*
+ * Read the PID of a process from a file.  This is necessary when running
+ * under fakeroot to get the actual PID of the remctld process.
+ */
+static pid_t
+read_pidfile(const char *path)
+{
+    FILE *file;
+    char buffer[BUFSIZ];
+    long pid;
+
+    file = fopen(path, "r");
+    if (file == NULL)
+        sysbail("cannot open %s", path);
+    if (fgets(buffer, sizeof(buffer), file) == NULL)
+        sysbail("cannot read from %s", path);
+    fclose(file);
+    pid = strtol(buffer, NULL, 10);
+    if (pid <= 0)
+        bail("cannot read PID from %s", path);
+    return (pid_t) pid;
+}
+
+
+/*
+ * Start a process and return its status information.  The status information
+ * is also stored in the global processes linked list so that it can be
+ * stopped automatically on program exit.
+ *
+ * The boolean argument says whether to start the process under fakeroot.  If
+ * true, PATH_FAKEROOT must be defined, generally by Autoconf.  If it's not
+ * found, call skip_all.
+ *
+ * This is a helper function for process_start and process_start_fakeroot.
+ */
+static struct process *
+process_start_internal(const char *const argv[], const char *pidfile,
+                       bool fakeroot)
+{
+    size_t i;
+    int log_fd;
+    const char *name;
+    struct timeval tv;
+    struct process *process;
+    const char **fakeroot_argv = NULL;
+    const char *path_fakeroot = PATH_FAKEROOT;
+
+    /* Check prerequisites. */
+    if (fakeroot && path_fakeroot[0] == '\0')
+        skip_all("fakeroot not found");
+
+    /* Create the process struct and log file. */
+    process = bcalloc(1, sizeof(struct process));
+    process->pidfile = bstrdup(pidfile);
+    process->tmpdir = test_tmpdir();
+    name = strrchr(argv[0], '/');
+    if (name != NULL)
+        name++;
+    else
+        name = argv[0];
+    basprintf(&process->logfile, "%s/%s.log.XXXXXX", process->tmpdir, name);
+    log_fd = mkstemp(process->logfile);
+    if (log_fd < 0)
+        sysbail("cannot create log file for %s", argv[0]);
+
+    /* If using fakeroot, rewrite argv accordingly. */
+    if (fakeroot) {
+        for (i = 0; argv[i] != NULL; i++)
+            ;
+        fakeroot_argv = bcalloc(2 + i + 1, sizeof(const char *));
+        fakeroot_argv[0] = path_fakeroot;
+        fakeroot_argv[1] = "--";
+        for (i = 0; argv[i] != NULL; i++)
+            fakeroot_argv[i + 2] = argv[i];
+        fakeroot_argv[i + 2] = NULL;
+        argv = fakeroot_argv;
+    }
+
+    /*
+     * Fork off the child process, redirect its standard output and standard
+     * error to the log file, and then exec the program.
+     */
+    process->pid = fork();
+    if (process->pid < 0)
+        sysbail("fork failed");
+    else if (process->pid == 0) {
+        if (dup2(log_fd, STDOUT_FILENO) < 0)
+            sysbail("cannot redirect standard output");
+        if (dup2(log_fd, STDERR_FILENO) < 0)
+            sysbail("cannot redirect standard error");
+        close(log_fd);
+        if (execv(argv[0], (char *const *) argv) < 0)
+            sysbail("exec of %s failed", argv[0]);
+    }
+    close(log_fd);
+    free(fakeroot_argv);
+
+    /*
+     * In the parent.  Wait for the child to start by watching for the PID
+     * file to appear in 100ms intervals.
+     */
+    for (i = 0; i < PROCESS_WAIT * 10 && access(pidfile, F_OK) != 0; i++) {
+        tv.tv_sec = 0;
+        tv.tv_usec = 100000;
+        select(0, NULL, NULL, NULL, &tv);
+    }
+
+    /*
+     * If the PID file still hasn't appeared after ten seconds, attempt to
+     * kill the process and then bail.
+     */
+    if (access(pidfile, F_OK) != 0) {
+        kill(process->pid, SIGTERM);
+        alarm(5);
+        waitpid(process->pid, NULL, 0);
+        alarm(0);
+        bail("cannot start %s", argv[0]);
+    }
+
+    /*
+     * Read the PID back from the PID file.  This usually isn't necessary for
+     * non-forking daemons, but always doing this makes this function general,
+     * and it's required when running under fakeroot.
+     */
+    if (fakeroot)
+        process->pid = read_pidfile(pidfile);
+    process->is_child = !fakeroot;
+
+    /* Register the log file as a source of diag messages. */
+    diag_file_add(process->logfile);
+
+    /*
+     * Add the process to our global list and set our cleanup handler if this
+     * is the first process we started.
+     */
+    if (processes == NULL)
+        test_cleanup_register(process_stop_all);
+    process->next = processes;
+    processes = process;
+
+    /* All done. */
+    return process;
+}
+
+
+/*
+ * Start a process and return the opaque process struct.  The process must
+ * create pidfile with its PID when startup is complete.
+ */
+struct process *
+process_start(const char *const argv[], const char *pidfile)
+{
+    return process_start_internal(argv, pidfile, false);
+}
+
+
+/*
+ * Start a process under fakeroot and return the opaque process struct.  If
+ * fakeroot is not available, calls skip_all.  The process must create pidfile
+ * with its PID when startup is complete.
+ */
+struct process *
+process_start_fakeroot(const char *const argv[], const char *pidfile)
+{
+    return process_start_internal(argv, pidfile, true);
+}
diff --git a/tests/tap/process.h b/tests/tap/process.h
new file mode 100644
index 000000000000..4210c209ed0b
--- /dev/null
+++ b/tests/tap/process.h
@@ -0,0 +1,95 @@
+/*
+ * Utility functions for tests that use subprocesses.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2009-2010, 2013
+ *     The Board of Trustees of the Leland Stanford Junior University
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TAP_PROCESS_H
+#define TAP_PROCESS_H 1
+
+#include <config.h>
+#include <tests/tap/macros.h>
+
+/* Opaque data type for process_start and friends. */
+struct process;
+
+BEGIN_DECLS
+
+/*
+ * Run a function in a subprocess and check the exit status and expected
+ * output (stdout and stderr combined) against the provided values.  Expects
+ * the function to always exit (not die from a signal).  data is optional data
+ * that's passed into the function as its only argument.
+ *
+ * This reports as three separate tests: whether the function exited rather
+ * than was killed, whether the exit status was correct, and whether the
+ * output was correct.
+ */
+typedef void (*test_function_type)(void *);
+void is_function_output(test_function_type, void *data, int status,
+                        const char *output, const char *format, ...)
+    __attribute__((__format__(printf, 5, 6), __nonnull__(1)));
+
+/*
+ * Run a setup program.  Takes the program to run and its arguments as an argv
+ * vector, where argv[0] must be either the full path to the program or the
+ * program name if the PATH should be searched.  If the program does not exit
+ * successfully, call bail, with the error message being the output from the
+ * program.
+ */
+void run_setup(const char *const argv[]) __attribute__((__nonnull__));
+
+/*
+ * process_start starts a process in the background, returning an opaque data
+ * struct that can be used to stop the process later.  The standard output and
+ * standard error of the process will be sent to a log file registered with
+ * diag_file_add, so its output will be properly interleaved with the test
+ * case output.
+ *
+ * The process should create a PID file in the path given as the second
+ * argument when it's finished initialization.
+ *
+ * process_start_fakeroot is the same but starts the process under fakeroot.
+ * PATH_FAKEROOT must be defined (generally by Autoconf).  If fakeroot is not
+ * found, process_start_fakeroot will call skip_all, so be sure to call this
+ * function before plan.
+ *
+ * process_stop can be called to explicitly stop the process.  If it isn't
+ * called by the test program, it will be called automatically when the
+ * program exits.
+ */
+struct process *process_start(const char *const argv[], const char *pidfile)
+    __attribute__((__nonnull__));
+struct process *process_start_fakeroot(const char *const argv[],
+                                       const char *pidfile)
+    __attribute__((__nonnull__));
+void process_stop(struct process *);
+
+END_DECLS
+
+#endif /* TAP_PROCESS_H */
diff --git a/tests/tap/string.c b/tests/tap/string.c
new file mode 100644
index 000000000000..71cf571e6f03
--- /dev/null
+++ b/tests/tap/string.c
@@ -0,0 +1,67 @@
+/*
+ * String utilities for the TAP protocol.
+ *
+ * Additional string utilities that can't be included with C TAP Harness
+ * because they rely on additional portability code from rra-c-util.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Copyright 2011-2012 Russ Allbery <eagle@eyrie.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include <config.h>
+#include <portable/system.h>
+
+#include <tests/tap/basic.h>
+#include <tests/tap/string.h>
+
+
+/*
+ * vsprintf into a newly allocated string, reporting a fatal error with bail
+ * on failure.
+ */
+void
+bvasprintf(char **strp, const char *fmt, va_list args)
+{
+    int status;
+
+    status = vasprintf(strp, fmt, args);
+    if (status < 0)
+        sysbail("failed to allocate memory for vasprintf");
+}
+
+
+/*
+ * sprintf into a newly allocated string, reporting a fatal error with bail on
+ * failure.
+ */
+void
+basprintf(char **strp, const char *fmt, ...)
+{
+    va_list args;
+
+    va_start(args, fmt);
+    bvasprintf(strp, fmt, args);
+    va_end(args);
+}
diff --git a/tests/tap/string.h b/tests/tap/string.h
new file mode 100644
index 000000000000..651c38a26f06
--- /dev/null
+++ b/tests/tap/string.h
@@ -0,0 +1,51 @@
+/*
+ * String utilities for the TAP protocol.
+ *
+ * Additional string utilities that can't be included with C TAP Harness
+ * because they rely on additional portability code from rra-c-util.
+ *
+ * The canonical version of this file is maintained in the rra-c-util package,
+ * which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+ *
+ * Copyright 2011-2012 Russ Allbery <eagle@eyrie.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef TAP_STRING_H
+#define TAP_STRING_H 1
+
+#include <config.h>
+#include <tests/tap/macros.h>
+
+#include <stdarg.h> /* va_list */
+
+BEGIN_DECLS
+
+/* sprintf into an allocated string, calling bail on any failure. */
+void basprintf(char **, const char *, ...)
+    __attribute__((__nonnull__, __format__(printf, 2, 3)));
+void bvasprintf(char **, const char *, va_list)
+    __attribute__((__nonnull__, __format__(printf, 2, 0)));
+
+END_DECLS
+
+#endif /* !TAP_STRING_H */
diff --git a/tests/valgrind/logs-t b/tests/valgrind/logs-t
new file mode 100755
index 000000000000..5444d00a5730
--- /dev/null
+++ b/tests/valgrind/logs-t
@@ -0,0 +1,83 @@
+#!/usr/bin/perl
+#
+# Check for errors in valgrind logs.
+#
+# The canonical version of this file is maintained in the rra-c-util package,
+# which can be found at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
+#
+# Copyright 2018-2019, 2021 Russ Allbery <eagle@eyrie.org>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# SPDX-License-Identifier: MIT
+
+use 5.010;
+use strict;
+use warnings;
+
+use lib "$ENV{C_TAP_SOURCE}/tap/perl";
+
+use Test::RRA;
+use Test::RRA::Automake qw(automake_setup);
+
+use File::Spec;
+use Test::More;
+
+# Skip this test if C_TAP_VALGRIND was not set.
+if (!exists $ENV{C_TAP_VALGRIND}) {
+    plan skip_all => 'Not testing under valgrind';
+}
+
+# Set up Automake testing.
+automake_setup({ chdir_build => 1 });
+
+# Gather the list of valgrind logs (and skip this test if there are none).
+opendir(my $logdir, File::Spec->catfile('tests', 'tmp', 'valgrind'))
+  or plan skip_all => 'No valgrind logs in tests/tmp/valgrind';
+my @logs = grep { m{ \A log [.] }xms } readdir $logdir;
+closedir($logdir) or BAIL_OUT("cannot close directory: $!");
+
+# Check each log file.
+plan tests => scalar(@logs);
+for my $file (@logs) {
+    my $path = File::Spec->catfile('tests', 'tmp', 'valgrind', $file);
+    open(my $log, '<', $path) or BAIL_OUT("cannot open $path: $!");
+    my $okay = 1;
+    my @log;
+    while (defined(my $line = <$log>)) {
+        push(@log, $line);
+        if ($line =~ m{ ERROR [ ] SUMMARY: [ ] (\d+) [ ] errors }xms) {
+            $okay = ($1 == 0);
+        }
+    }
+    close($log) or BAIL_OUT("cannot close $path: $!");
+    if ($okay) {
+        unlink($path);
+    } else {
+        for my $line (@log) {
+            print '# ', $line
+              or BAIL_OUT("cannot print to standard output: $!");
+        }
+    }
+    ok($okay, $path);
+}
+
+# Remove tests/tmp/valgrind if it's now empty.
+rmdir(File::Spec->catfile('tests', 'tmp', 'valgrind'));
+rmdir(File::Spec->catfile('tests', 'tmp'));