krb5_error_code kdb_samba_db_get_principal(krb5_context context,
					   krb5_const_principal princ,
					   unsigned int kflags,
					   krb5_db_entry **kentry)
{
	struct mit_samba_context *mit_ctx;
	krb5_error_code code;

	mit_ctx = ks_get_context(context);
	if (mit_ctx == NULL) {
		return KRB5_KDB_DBNOTINITED;
	}

	if (ks_is_master_key_principal(context, princ)) {
		return ks_get_master_key_principal(context, princ, kentry);
	}

	/*
	 * Fake a kadmin/admin and kadmin/history principal so that kadmindd can
	 * start
	 */
	if (ks_is_kadmin_admin(context, princ) ||
	    ks_is_kadmin_history(context, princ)) {
		return ks_get_admin_principal(context, princ, kentry);
	}

	code = ks_get_principal(context, princ, kflags, kentry);

	/*
	 * This restricts the changepw account so it isn't able to request a
	 * service ticket. It also marks the principal as the changepw service.
	 */
	if (ks_is_kadmin_changepw(context, princ)) {
		/* FIXME: shouldn't we also set KRB5_KDB_DISALLOW_TGT_BASED ?
		 * testing showed that setpw kpasswd command fails then on the
		 * server though... */
		(*kentry)->attributes |= KRB5_KDB_PWCHANGE_SERVICE;
		(*kentry)->max_life = CHANGEPW_LIFETIME;
	}

	return code;
}
krb5_error_code kdb_samba_db_get_principal(krb5_context context,
					   krb5_const_principal princ,
					   unsigned int kflags,
					   krb5_db_entry **kentry)
{
	struct mit_samba_context *mit_ctx;
	krb5_error_code code;

	mit_ctx = ks_get_context(context);
	if (mit_ctx == NULL) {
		return KRB5_KDB_DBNOTINITED;
	}

	if (ks_is_master_key_principal(context, princ)) {
		return ks_get_master_key_principal(context, princ, kentry);
	}

	 
	if (ks_is_kadmin_admin(context, princ) ||
	    ks_is_kadmin_history(context, princ)) {
		return ks_get_admin_principal(context, princ, kentry);
	}

	code = ks_get_principal(context, princ, kflags, kentry);

	 
	if (ks_is_kadmin_changepw(context, princ)) {
		 
		(*kentry)->attributes |= KRB5_KDB_PWCHANGE_SERVICE;
		(*kentry)->max_life = CHANGEPW_LIFETIME;
	}

	return code;
}