                            kstart To-Do List

k5start:

 * Attempt to renew the ticket before prompting the user for a new
   password when run with the -H flag with a ticket that will be expiring.

 * Provide a flag like -H that checks the status of the ticket but
   just exits with a zero or non-zero exit status instead of prompting.

 * Add a flag saying to start a command in a PAG and with tokens and then
   keep running even if the command exits.  This would be useful to spawn
   a long-running daemon inside a PAG and then maintain its tokens, even
   if k5start and the daemon then become detached and have to be stopped
   separately.

 * Relax the requirement to use keytabs when running a command and support
   prompting for the authentication password before starting the command.
   In this case, there's no reason for k5start to keep running once the
   command has been started, so it can simply exit after spawning the
   command.

 * Add a flag to keep reprompting for the password until authentication
   succeeds.

 * Use krb5_get_init_creds_opt_set_out_ccache to store the ticket cache
   instead of writing the credentials ourselves, since this will store MIT
   Kerberos configuration information in the cache.

 * Support obtaining new credentials in a DIR cache or another cache type
   that supports multiple principals without destroying the existing
   cache.

 * Add a kinstance command to run a command with a particular default
   principal instead of the default for the cache collection (assuming
   this is even possible).

 * Determine the actual ticket lifetime from the Kerberos ticket cache and
   use that to set the wakeup time if -K was not provided, rather than
   always using a default of one hour.

 * Add anonymous authentication support.

 * Add a mode of operation that only runs the aklog program and doesn't
   attempt to refresh the ticket cache unless it's about to expire.  This
   would allow multiple k5start daemons to use the same ticket cache
   without putting a lot of load on the Kerberos KDC for constant renewals
   from each daemon.

krenew:

 * Add an option to send SIGHUP to the child process when krenew exits
   because the ticket is no longer renewable.

Documentation:

 * Document how to start Apache with tickets and AFS tokens, either using
   k5start in the init script or the non-PAG method we use at Stanford.
   Probably take some information from the Stanford web page documenting
   using tokens with servers.

 * Document when various flags and features were added.

Test suite:

 * Test more of krenew's basic functionality, preferrably by parsing klist
   output more thoroughly (or using a Perl module that can parse the
   ticket cache directly) and seeing if tickets really were renewed.

 * Test that -K and running a command wakes up periodically and renews
   tickets for both krenew and k5start.

 * Add tests for k5start password prompting, either from standard input or
   from a TTY.

 * Move tests/libtest.pl into rra-c-util and break it apart into
   functionality groups.

 * Refactor all test cases to reduce copy-and-paste code and use more
   helper functions.
