From c13bbdeb7a8492250d5e6308aadb2b593cc6a124 Mon Sep 17 00:00:00 2001
From: Simo Sorce <ssorce@redhat.com>
Date: Wed, 8 Aug 2007 22:19:03 -0400
Subject: [PATCH] set preauth on kadmin/changepw otherwise the kpasswd can't
 acquire a ticket

---
 ipa-server/ipaserver/krbinstance.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/ipa-server/ipaserver/krbinstance.py b/ipa-server/ipaserver/krbinstance.py
index 5a43617bc..9d9d69be9 100644
--- a/ipa-server/ipaserver/krbinstance.py
+++ b/ipa-server/ipaserver/krbinstance.py
@@ -175,3 +175,11 @@ class KrbInstance:
         cfg_fd.close()
 	pent = pwd.getpwnam(self.ds_user)
         os.chown("/etc/sysconfig/fedora-ds", pent.pw_uid, pent.pw_gid)
+
+    def __set_kadmin_changepw_preauth(self):
+        (kwrite, kread, kerr) = os.popen3("/usr/kerberos/sbin/kadmin.local")
+        kwrite.write("modprinc +requires_preauth kadmin/changepw\n")
+        kwrite.flush()
+        kwrite.close()
+        kread.close()
+        kerr.close()