Document the disable_last_success and disable_lockout variables in

krb5.conf.M.  Also document database_name in krb5.conf.M and slightly
adjust the wording in admin.texinfo.

ticket: 6719

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24078 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/doc/admin.texinfo b/doc/admin.texinfo
index ad122a7eba3ae04271ad340de03f341488d0880e..5da912768df86466590a20e80e944c58bdc0c5ce 100644 (file)
--- a/doc/admin.texinfo
+++ b/doc/admin.texinfo
@@ -1054,8 +1054,8 @@ For each section, the following tags may be specified in the subsection:
 This tag indicates the name of the loadable database library. The value should be @samp{db2} for DB2 database and @samp{kldap} for LDAP database.
 
 @itemx database_name
-This DB2-specific tag indicates the location of the database.  The
-default is @* @code{@value{DefaultDatabaseName}}.
+This DB2-specific tag indicates the location of the database in the
+filesystem.  The default is @* @code{@value{DefaultDatabaseName}}.
 
 @itemx disable_last_success
 If set to @code{true}, suppresses KDC updates to the ``Last successful

diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M
index 412156bdfade9292742f7aabc9710a8f4bbc5fae..5ecfd426c70ce04837fecd1eee93ed7dcaecf4ae 100644 (file)
--- a/src/config-files/krb5.conf.M
+++ b/src/config-files/krb5.conf.M
@@ -585,6 +585,23 @@ The following tags are used in this section:
 This relation indicates the name of the configuration section under dbmodules
 for database specific parameters used by the loadable database library.
 
+.IP database_name
+This DB2-specific tag indicates the location of the database in the
+filesystem.
+
+.IP disable_last_success
+If set to true, suppresses KDC updates to the "Last successful
+authentication" field of principal entries requiring
+preauthentication.  Setting this flag may improve performance.
+(Principal entries which do not require preauthentication never update
+the "Last successful authentication" field.)
+
+.IP disable_lockout
+If set to true, suppresses KDC updates to the "Last failed
+authentication" and "Failed password attempts" fields of principal
+entries requiring preauthentication.  Setting this flag may improve
+performance, but also disables account lockout.
+
 .IP ldap_kerberos_container_dn 
 This LDAP specific tag indicates the DN of the container object where the realm
 objects will be located. This value is used if no object DN is mentioned in the