As raised in #174, ldap_bind_as_user cannot be used if this module is
set to get YubiKey+OTP because the initial ldap lookup fails (since the
password is not set yet). `always_prompt` will stil the initial lookup,
meaning that the user will be given the chance to enter their password.
This adds support for using a client cert/key to authenticate to an LDAP
server. It is separate from binding with a username and password and
can either be used alongside it or with an anonymous bind to the server.
This allows using the authenticating user's username and password to
bind to the LDAP server. This is desirable because it allows for
looking up the yubikey attributes without needing to create a service
account.
Certain phrases (Challenge-response) were not spelled consistently
throughout the project. This commit adjusts for that and fixes a
couple of typos along the way and uses the base form of verbs in
case of error messages.
