Using a master key and principal name to derive password for principal

[Coe Ts7]

> get the impression that you are interested in using PKI for clients
> who will use PKINIT to obtain a TGT.  In this case, is there any
> reason that you need to know the client's key or password?  If you
> never need to know a key or a password, then just randomise the
> key and forget it on the creation of the client principal.

Thanks for the reply.
The reason why I need the keys to be predictable is that I don't want kerberos to store anything,
to make kerberos stateless. And a stateless server is more friendly to achieve a goal of High Availability architecture.
For master-slave architecture of krb5, manual slave to master promotion and traffic redirection must be made
if the old master instance down. But if I make kerberos fully stateless(store nothing), then multi kdc instances and
simple retry strategy on client-side will achieve fully high availability.

Now I'm planing to use krb5_c_string_to_key(https://github.com/krb5/krb5/blob/master/src/lib/crypto/krb/string_to_key.c#L31)
with master_secret_key as the password argument and principal_realm_name as the salt argument.
It seems that if a function is a PRF(pseudorandom function), then the function is safe to generate password.