Extensible kadm5 policies

[Roland C. Dowdeswell]

On Tue, Nov 01, 2011 at 10:03:19AM -0700, Russ Allbery wrote:
>

> I would love to be able to set some principal flags via a policy as well.
> Things like disallow-forwardable and disallow-proxiable, for example, for
> root instance principals.

I agree with this.  Another flag that would be quite nice to put
into policies would be -allow_srv which should be set on all
principals which have passwds to prevent dictionary attacks against
vended service tickets.

--
    Roland Dowdeswell                      http://Imrryr.ORG/~elric/