krb5 commit [krb5-1.11]: Document preauth flags for service principals

[Tom Yu]

https://github.com/krb5/krb5/commit/a1faf888a98ea215c6a8589769f43ed024c6597f
commit a1faf888a98ea215c6a8589769f43ed024c6597f
Author: Ben Kaduk <kaduk at mit.edu>
Date:   Thu May 30 18:49:36 2013 -0400

    Document preauth flags for service principals
    
    These flags are overloaded to mean different things for clients and
    servers; previously we only documented the client behavior.
    
    (cherry picked from commit 7425e9b69566c241c54eb2686fb37f216122423f)
    
    ticket: 7653
    version_fixed: 1.11.3
    status: resolved

 doc/admin/admin_commands/kadmin_local.rst |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/doc/admin/admin_commands/kadmin_local.rst b/doc/admin/admin_commands/kadmin_local.rst
index 6fee616..bbfb023 100644
--- a/doc/admin/admin_commands/kadmin_local.rst
+++ b/doc/admin/admin_commands/kadmin_local.rst
@@ -237,12 +237,18 @@ Options:
 {-\|+}\ **requires_preauth**
     **+requires_preauth** requires this principal to preauthenticate
     before being allowed to kinit.  **-requires_preauth** clears this
-    flag.
+    flag.  When **+requires_preauth** is set on a service principal,
+    the KDC will only issue service tickets for that service principal
+    if the client's initial authentication was performed using
+    preauthentication.
 
 {-\|+}\ **requires_hwauth**
     **+requires_hwauth** requires this principal to preauthenticate
     using a hardware device before being allowed to kinit.
-    **-requires_hwauth** clears this flag.
+    **-requires_hwauth** clears this flag.  When **+requires_hwauth** is
+    set on a service principal, the KDC will only issue service tickets
+    for that service principal if the client's initial authentication was
+    performed using a hardware device to preauthenticate.
 
 {-\|+}\ **ok_as_delegate**
     **+ok_as_delegate** sets the **okay as delegate** flag on tickets