Improve principal creation attributes for Heimdal

In the Heimdal backend, don't set KADM5_POLICY_NORMAL_MASK or
KADM5_POLICY_CLR as attributes when creating a new principal.  These
are not valid attribute values and end up setting or clearing large
numbers of other attributes.

In the Heimdal backend, don't unconditionally set the preauth required
attribute on newly created principals.  This should be handled using
the "default" principal in Heimdal to configure the desired default
principal lifetime and attributes.

diff --git a/NEWS b/NEWS
index a4404ef8f2b0e88d5417c8c68776dd893c5a32a9..d76d193891be97c9e43fbd177d05c021b3ea41fd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,16 @@
 
 kadmin-remctl 3.1 (unreleased)
 
+    In the Heimdal backend, don't set KADM5_POLICY_NORMAL_MASK or
+    KADM5_POLICY_CLR as attributes when creating a new principal.  These
+    are not valid attribute values and end up setting or clearing large
+    numbers of other attributes.
+
+    In the Heimdal backend, don't unconditionally set the preauth required
+    attribute on newly created principals.  This should be handled using
+    the "default" principal in Heimdal to configure the desired default
+    principal lifetime and attributes.
+
     kadmin-backend for an MIT Kerberos server no longer has the boolean
     checking configuration parameter, which said whether to do password
     checking.  Instead, there is a new policy configuration parameter

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index db9c82e9a7d25be9b439fb75772e92265e5a3fc8..217bce7d42ebcc6b8d1603573cefbd3d632f1082 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -246,12 +246,6 @@ sub kadmin_create {
     my $princdata = eval { $kadmin->makePrincipal ($principal) };
 
     my $attrs = $princdata->getAttributes;
-    $attrs |= KRB5_KDB_REQUIRES_PRE_AUTH;
-    if ($CONFIG{$instance}{checking}) {
-       $attrs |= KADM5_POLICY_NORMAL_MASK;
-    } else {
-       $attrs |= KADM5_POLICY_CLR;
-    }
     if ($status ne 'enabled') {
        $attrs |= KRB5_KDB_DISALLOW_ALL_TIX;
     } else {