Regenerate man pages

Catch up to the RST content updates.

Lots of .sp vertical space macros are removed, and the output engine
spelles "restructuredText" correctly, now.

1 files changed, 148 insertions, 196 deletions

diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index 9cbf09bc81..c82119032e 100644
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.\" Man page generated from reStructeredText.
+.\" Man page generated from reStructuredText.
 .
 .sp
 The kdc.conf file supplements \fIkrb5.conf(5)\fP for programs which
@@ -39,6 +39,9 @@ Relations documented here may also be specified in krb5.conf.
 Normally, the kdc.conf file is found in the KDC state directory,
 \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP.  You can override the default location by setting the
 environment variable \fBKRB5_KDC_PROFILE\fP.
+.sp
+Please note that you need to restart the KDC daemon for any configuration
+changes to take effect.
 .SH STRUCTURE
 .sp
 The kdc.conf file is set up in the same format as the
@@ -63,12 +66,6 @@ Realm\-specific database configuration and settings
 T}
 _
 T{
-\fI\%[logging]\fP
-T}	T{
-Controls how Kerberos daemons perform logging
-T}
-_
-T{
 \fI\%[dbdefaults]\fP
 T}	T{
 Default database settings
@@ -80,6 +77,12 @@ T}	T{
 Per\-database settings
 T}
 _
+T{
+\fI\%[logging]\fP
+T}	T{
+Controls how Kerberos daemons perform logging
+T}
+_
 .TE
 .SS [kdcdefaults]
 .sp
@@ -89,53 +92,44 @@ subsection does not contain a relation for the tag.  See the
 \fI\%[realms]\fP section for the definitions of these relations.
 .INDENT 0.0
 .IP \(bu 2
-.
 \fBhost_based_services\fP
 .IP \(bu 2
-.
 \fBkdc_ports\fP
 .IP \(bu 2
-.
 \fBkdc_tcp_ports\fP
 .IP \(bu 2
-.
 \fBno_host_referral\fP
 .IP \(bu 2
-.
 \fBrestrict_anonymous_to_tgt\fP
 .UNINDENT
 .INDENT 0.0
 .TP
 .B \fBkdc_max_dgram_reply_size\fP
-.sp
 Specifies the maximum packet size that can be sent over UDP.  The
 default value is 4096 bytes.
 .UNINDENT
 .SS [realms]
 .sp
-Each tag in the [realms] section of the file names a Kerberos realm.
-The value of the tag is a subsection where the relations in that
-subsection define KDC parameters for that particular realm.
+Each tag in the [realms] section is the name of a Kerberos realm.
+The value of the tag is a subsection where the relations define KDC
+parameters for that particular realm.
 .sp
-For each realm, the following tags may be specified in the [realms]
-subsection:
+For each realm, the following tags may be specified:
 .INDENT 0.0
 .TP
 .B \fBacl_file\fP
-.sp
 (String.)  Location of the access control list file that
 \fIkadmind(8)\fP uses to determine which principals are allowed
-which permissions on the database.  The default value is
-\fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kadm5.acl\fP.
+which permissions on the Kerberos database.  The default value is
+\fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kadm5.acl\fP.  For more information on Kerberos ACL
+file see \fIkadm5.acl(5)\fP.
 .TP
 .B \fBdatabase_module\fP
-.sp
 This relation indicates the name of the configuration section
 under \fI\%[dbmodules]\fP for database specific parameters used by
 the loadable database library.
 .TP
 .B \fBdatabase_name\fP
-.sp
 (String.)  This string specifies the location of the Kerberos
 database for this realm, if the DB2 back\-end is being used.  If a
 \fBdatabase_module\fP is specified for the realm and the
@@ -144,13 +138,11 @@ value will take precedence over this one.  The default value is
 \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/principal\fP.
 .TP
 .B \fBdefault_principal_expiration\fP
-.sp
-(Absolute time string.)  Specifies the default expiration date of
+(\fIabstime\fP string.)  Specifies the default expiration date of
 principals created in this realm.  The default value is 0, which
 means no expiration date.
 .TP
 .B \fBdefault_principal_flags\fP
-.sp
 (Flag string.)  Specifies the default attributes of principals
 created in this realm.  The format for this string is a
 comma\-separated list of flags, with \(aq+\(aq before each flag that
@@ -163,69 +155,57 @@ There are a number of possible flags:
 .INDENT 7.0
 .TP
 .B \fBallow\-tickets\fP
-.sp
 Enabling this flag means that the KDC will issue tickets for
 this principal.  Disabling this flag essentially deactivates
 the principal within this realm.
 .TP
 .B \fBdup\-skey\fP
-.sp
 Enabling this flag allows the principal to obtain a session
 key for another user, permitting user\-to\-user authentication
 for this principal.
 .TP
 .B \fBforwardable\fP
-.sp
 Enabling this flag allows the principal to obtain forwardable
 tickets.
 .TP
 .B \fBhwauth\fP
-.sp
 If this flag is enabled, then the principal is required to
 preauthenticate using a hardware device before receiving any
 tickets.
 .TP
 .B \fBno\-auth\-data\-required\fP
-.sp
-Enabling this flag prvents PAC data from being added to the
-service tickets.
+Enabling this flag prevents PAC data from being added to
+service tickets for the principal.
 .TP
 .B \fBok\-as\-delegate\fP
-.sp
 If this flag is enabled, it hints the client that credentials
 can and should be delegated when authenticating to the
 service.
 .TP
 .B \fBok\-to\-auth\-as\-delegate\fP
-.sp
-Enabling this flag allows the principal to use S4USelf ticket.
+Enabling this flag allows the principal to use S4USelf tickets.
 .TP
 .B \fBpostdateable\fP
-.sp
 Enabling this flag allows the principal to obtain postdateable
 tickets.
 .TP
 .B \fBpreauth\fP
-.sp
 If this flag is enabled on a client principal, then that
 principal is required to preauthenticate to the KDC before
 receiving any tickets.  On a service principal, enabling this
 flag means that service tickets for this principal will only
 be issued to clients with a TGT that has the preauthenticated
-ticket set.
+bit set.
 .TP
 .B \fBproxiable\fP
-.sp
 Enabling this flag allows the principal to obtain proxy
 tickets.
 .TP
 .B \fBpwchange\fP
-.sp
 Enabling this flag forces a password change for this
 principal.
 .TP
 .B \fBpwservice\fP
-.sp
 If this flag is enabled, it marks this principal as a password
 change service.  This should only be used in special cases,
 for example, if a user\(aqs password has expired, then the user
@@ -234,60 +214,56 @@ the normal password authentication in order to be able to
 change the password.
 .TP
 .B \fBrenewable\fP
-.sp
 Enabling this flag allows the principal to obtain renewable
 tickets.
 .TP
 .B \fBservice\fP
-.sp
 Enabling this flag allows the the KDC to issue service tickets
 for this principal.
 .TP
 .B \fBtgt\-based\fP
-.sp
 Enabling this flag allows a principal to obtain tickets based
 on a ticket\-granting\-ticket, rather than repeating the
 authentication process that was used to obtain the TGT.
 .UNINDENT
 .TP
 .B \fBdict_file\fP
-.sp
 (String.)  Location of the dictionary file containing strings that
 are not allowed as passwords.  If none is specified or if there is
 no policy assigned to the principal, no dictionary checks of
 passwords will be performed.
 .TP
 .B \fBhost_based_services\fP
-.sp
 (Whitespace\- or comma\-separated list.)  Lists services which will
 get host\-based referral processing even if the server principal is
 not marked as host\-based by the client.
 .TP
 .B \fBiprop_enable\fP
-.sp
 (Boolean value.)  Specifies whether incremental database
 propagation is enabled.  The default value is false.
 .TP
 .B \fBiprop_master_ulogsize\fP
-.sp
 (Integer.)  Specifies the maximum number of log entries to be
 retained for incremental propagation.  The maximum value is 2500;
 the default value is 1000.
 .TP
 .B \fBiprop_slave_poll\fP
-.sp
 (Delta time string.)  Specifies how often the slave KDC polls for
 new updates from the master.  The default value is \fB2m\fP (that
 is, two minutes).
 .TP
 .B \fBiprop_port\fP
-.sp
 (Port number.)  Specifies the port number to be used for
 incremental propagation.  This is required in both master and
 slave configuration files.
 .TP
+.B \fBiprop_resync_timeout\fP
+(Delta time string.)  Specifies the amount of time to wait for a
+full propagation to complete.  This is optional in configuration
+files, and is used by slave KDCs only.  The default value is 5
+minutes (\fB5m\fP).
+.TP
 .B \fBiprop_logfile\fP
-.sp
 (File name.)  Specifies where the update log file for the realm
 database is to be stored.  The default is to use the
 \fBdatabase_name\fP entry from the realms section of the krb5 config
@@ -299,18 +275,15 @@ back end is being used, or the file name is specified in the
 default value will not use values from the [dbmodules] section.)
 .TP
 .B \fBkadmind_port\fP
-.sp
 (Port number.)  Specifies the port on which the \fIkadmind(8)\fP
 daemon is to listen for this realm.  The assigned port for kadmind
-is 749.
+is 749, which is used by default.
 .TP
 .B \fBkey_stash_file\fP
-.sp
 (String.)  Specifies the location where the master key has been
 stored (via kdb5_util stash).  The default is \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/.k5.REALM\fP, where \fIREALM\fP is the Kerberos realm.
 .TP
 .B \fBkdc_ports\fP
-.sp
 (Whitespace\- or comma\-separated list.)  Lists the ports on which
 the Kerberos server should listen for UDP requests, as a
 comma\-separated list of integers.  The default value is
@@ -318,7 +291,6 @@ comma\-separated list of integers.  The default value is
 historically used by Kerberos V4.
 .TP
 .B \fBkdc_tcp_ports\fP
-.sp
 (Whitespace\- or comma\-separated list.)  Lists the ports on which
 the Kerberos server should listen for TCP connections, as a
 comma\-separated list of integers.  If this relation is not
@@ -330,38 +302,39 @@ has little protection against denial\-of\-service attacks), the
 standard port number assigned for Kerberos TCP traffic is port 88.
 .TP
 .B \fBmaster_key_name\fP
-.sp
 (String.)  Specifies the name of the principal associated with the
 master key.  The default is \fBK/M\fP.
 .TP
 .B \fBmaster_key_type\fP
-.sp
 (Key type string.)  Specifies the master key\(aqs key type.  The
 default value for this is \fBaes256\-cts\-hmac\-sha1\-96\fP.  For a list of all possible
 values, see \fI\%Encryption and salt types\fP.
 .TP
 .B \fBmax_life\fP
-.sp
-(Delta time string.)  Specifies the maximum time period for which
-a ticket may be valid in this realm.  The default value is 24
-hours.
+(\fIduration\fP string.)  Specifies the maximum time period for
+which a ticket may be valid in this realm.  The default value is
+24 hours.
 .TP
 .B \fBmax_renewable_life\fP
-.sp
-(Delta time string.)  Specifies the maximum time period during
-which a valid ticket may be renewed in this realm.  The default
-value is 0.
+(\fIduration\fP string.)  Specifies the maximum time period
+during which a valid ticket may be renewed in this realm.
+The default value is 0.
 .TP
 .B \fBno_host_referral\fP
-.sp
 (Whitespace\- or comma\-separated list.)  Lists services to block
 from getting host\-based referral processing, even if the client
 marks the server principal as host\-based or the service is also
 listed in \fBhost_based_services\fP.  \fBno_host_referral = *\fP will
 disable referral processing altogether.
 .TP
+.B \fBdes_crc_session_supported\fP
+(Boolean value).  If set to true, the KDC will assume that service
+principals support des\-cbc\-crc for session key enctype negotiation
+purposes.  If \fBallow_weak_crypto\fP in \fIlibdefaults\fP is
+false, or if des\-cbc\-crc is not a permitted enctype, then this
+variable has no effect.  Defaults to true.
+.TP
 .B \fBreject_bad_transit\fP
-.sp
 (Boolean value.)  If set to true, the KDC will check the list of
 transited realms for cross\-realm tickets against the transit path
 computed from the realm names and the capaths section of its
@@ -383,7 +356,6 @@ only to TGS requests.
 The default value is true.
 .TP
 .B \fBrestrict_anonymous_to_tgt\fP
-.sp
 (Boolean value.)  If set to true, the KDC will reject ticket
 requests from anonymous principals to service principals other
 than the realm\(aqs ticket\-granting service.  This option allows
@@ -392,97 +364,12 @@ without allowing anonymous authentication to services.  The
 default value is false.
 .TP
 .B \fBsupported_enctypes\fP
-.sp
 (List of \fIkey\fP:\fIsalt\fP strings.)  Specifies the default key/salt
 combinations of principals for this realm.  Any principals created
 through \fIkadmin(1)\fP will have keys of these types.  The
 default value for this tag is \fBaes256\-cts\-hmac\-sha1\-96:normal aes128\-cts\-hmac\-sha1\-96:normal des3\-cbc\-sha1:normal arcfour\-hmac\-md5:normal\fP.  For lists of
 possible values, see \fI\%Encryption and salt types\fP.
 .UNINDENT
-.SS [logging]
-.sp
-The [logging] section indicates how \fIkrb5kdc(8)\fP and
-\fIkadmind(8)\fP perform logging.  The keys in this section are
-daemon names, which may be one of:
-.INDENT 0.0
-.TP
-.B \fBadmin_server\fP
-.sp
-Specifies how \fIkadmind(8)\fP performs logging.
-.TP
-.B \fBkdc\fP
-.sp
-Specifies how \fIkrb5kdc(8)\fP performs logging.
-.TP
-.B \fBdefault\fP
-.sp
-Specifies how either daemon performs logging in the absence of
-relations specific to the daemon.
-.UNINDENT
-.sp
-Values are of the following forms:
-.INDENT 0.0
-.TP
-.B \fBFILE=\fP\fIfilename\fP or \fBFILE:\fP\fIfilename\fP
-.sp
-This value causes the daemon\(aqs logging messages to go to the
-\fIfilename\fP.  If the \fB=\fP form is used, the file is overwritten.
-If the \fB:\fP form is used, the file is appended to.
-.TP
-.B \fBSTDERR\fP
-.sp
-This value causes the daemon\(aqs logging messages to go to its
-standard error stream.
-.TP
-.B \fBCONSOLE\fP
-.sp
-This value causes the daemon\(aqs logging messages to go to the
-console, if the system supports it.
-.TP
-.B \fBDEVICE=\fP\fI<devicename>\fP
-.sp
-This causes the daemon\(aqs logging messages to go to the specified
-device.
-.TP
-.B \fBSYSLOG\fP[\fB:\fP\fIseverity\fP[\fB:\fP\fIfacility\fP]]
-.sp
-This causes the daemon\(aqs logging messages to go to the system log.
-.sp
-The severity argument specifies the default severity of system log
-messages.  This may be any of the following severities supported
-by the syslog(3) call, minus the \fBLOG_\fP prefix: \fBEMERG\fP,
-\fBALERT\fP, \fBCRIT\fP, \fBERR\fP, \fBWARNING\fP, \fBNOTICE\fP, \fBINFO\fP,
-and \fBDEBUG\fP.
-.sp
-The facility argument specifies the facility under which the
-messages are logged.  This may be any of the following facilities
-supported by the syslog(3) call minus the LOG_ prefix: \fBKERN\fP,
-\fBUSER\fP, \fBMAIL\fP, \fBDAEMON\fP, \fBAUTH\fP, \fBLPR\fP, \fBNEWS\fP,
-\fBUUCP\fP, \fBCRON\fP, and \fBLOCAL0\fP through \fBLOCAL7\fP.
-.sp
-If no severity is specified, the default is \fBERR\fP.  If no
-facility is specified, the default is \fBAUTH\fP.
-.UNINDENT
-.sp
-In the following example, the logging messages from the KDC will go to
-the console and to the system log under the facility LOG_DAEMON with
-default severity of LOG_INFO; and the logging messages from the
-administrative server will be appended to the file
-\fB/var/adm/kadmin.log\fP and sent to the device \fB/dev/tty04\fP.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-[logging]
-    kdc = CONSOLE
-    kdc = SYSLOG:INFO:DAEMON
-    admin_server = FILE:/var/adm/kadmin.log
-    admin_server = DEVICE=/dev/tty04
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
 .SS [dbdefaults]
 .sp
 The [dbdefaults] section specifies default values for some database
@@ -491,33 +378,27 @@ a relation for the tag.  See the \fI\%[dbmodules]\fP section for the
 definitions of these relations.
 .INDENT 0.0
 .IP \(bu 2
-.
 \fBldap_kerberos_container_dn\fP
 .IP \(bu 2
-.
 \fBldap_kdc_dn\fP
 .IP \(bu 2
-.
 \fBldap_kadmind_dn\fP
 .IP \(bu 2
-.
 \fBldap_service_password_file\fP
 .IP \(bu 2
-.
 \fBldap_servers\fP
 .IP \(bu 2
-.
 \fBldap_conns_per_server\fP
 .UNINDENT
 .SS [dbmodules]
 .sp
 The [dbmodules] section contains parameters used by the KDC database
-library and database modules.  The following tag may be specified
-in the [dbmodules] section:
+library and database modules.
+.sp
+The following tag may be specified in the [dbmodules] section:
 .INDENT 0.0
 .TP
 .B \fBdb_module_dir\fP
-.sp
 This tag controls where the plugin system looks for modules.  The
 value should be an absolute path.
 .UNINDENT
@@ -529,45 +410,40 @@ the subsection:
 .INDENT 0.0
 .TP
 .B \fBdatabase_name\fP
-.sp
 This DB2\-specific tag indicates the location of the database in
 the filesystem.  The default is \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/principal\fP.
 .TP
 .B \fBdb_library\fP
-.sp
 This tag indicates the name of the loadable database module.  The
 value should be \fBdb2\fP for the DB2 module and \fBkldap\fP for the
 LDAP module.
 .TP
 .B \fBdisable_last_success\fP
-.sp
 If set to \fBtrue\fP, suppresses KDC updates to the "Last successful
 authentication" field of principal entries requiring
 preauthentication.  Setting this flag may improve performance.
 (Principal entries which do not require preauthentication never
-update the "Last successful authentication" field.).
+update the "Last successful authentication" field.).  First
+introduced in version 1.9.
 .TP
 .B \fBdisable_lockout\fP
-.sp
 If set to \fBtrue\fP, suppresses KDC updates to the "Last failed
 authentication" and "Failed password attempts" fields of principal
 entries requiring preauthentication.  Setting this flag may
-improve performance, but also disables account lockout.
+improve performance, but also disables account lockout.  First
+introduced in version 1.9.
 .TP
 .B \fBldap_conns_per_server\fP
-.sp
 This LDAP\-specific tag indicates the number of connections to be
 maintained per LDAP server.
 .TP
 .B \fBldap_kadmind_dn\fP
-.sp
 This LDAP\-specific tag indicates the default bind DN for the
 \fIkadmind(8)\fP daemon.  kadmind does a login to the directory
 as this object.  This object should have the rights to read and
 write the Kerberos data in the LDAP database.
 .TP
 .B \fBldap_kdc_dn\fP
-.sp
 This LDAP\-specific tag indicates the default bind DN for the
 \fIkrb5kdc(8)\fP daemon.  The KDC does a login to the directory
 as this object.  This object should have the rights to read the
@@ -575,12 +451,10 @@ Kerberos data in the LDAP database, and to write data unless
 \fBdisable_lockout\fP and \fBdisable_last_success\fP are true.
 .TP
 .B \fBldap_kerberos_container_dn\fP
-.sp
 This LDAP\-specific tag indicates the DN of the container object
 where the realm objects will be located.
 .TP
 .B \fBldap_servers\fP
-.sp
 This LDAP\-specific tag indicates the list of LDAP servers that the
 Kerberos servers can connect to.  The list of LDAP servers is
 whitespace\-separated.  The LDAP server is specified by a LDAP URI.
@@ -588,15 +462,89 @@ It is recommended to use \fBldapi:\fP or \fBldaps:\fP URLs to connect
 to the LDAP server.
 .TP
 .B \fBldap_service_password_file\fP
-.sp
 This LDAP\-specific tag indicates the file containing the stashed
 passwords (created by \fBkdb5_ldap_util stashsrvpw\fP) for the
 \fBldap_kadmind_dn\fP and \fBldap_kdc_dn\fP objects.  This file must
 be kept secure.
 .UNINDENT
+.SS [logging]
+.sp
+The [logging] section indicates how \fIkrb5kdc(8)\fP and
+\fIkadmind(8)\fP perform logging.  The keys in this section are
+daemon names, which may be one of:
+.INDENT 0.0
+.TP
+.B \fBadmin_server\fP
+Specifies how \fIkadmind(8)\fP performs logging.
+.TP
+.B \fBkdc\fP
+Specifies how \fIkrb5kdc(8)\fP performs logging.
+.TP
+.B \fBdefault\fP
+Specifies how either daemon performs logging in the absence of
+relations specific to the daemon.
+.UNINDENT
+.sp
+Values are of the following forms:
+.INDENT 0.0
+.TP
+.B \fBFILE=\fP\fIfilename\fP or \fBFILE:\fP\fIfilename\fP
+This value causes the daemon\(aqs logging messages to go to the
+\fIfilename\fP.  If the \fB=\fP form is used, the file is overwritten.
+If the \fB:\fP form is used, the file is appended to.
+.TP
+.B \fBSTDERR\fP
+This value causes the daemon\(aqs logging messages to go to its
+standard error stream.
+.TP
+.B \fBCONSOLE\fP
+This value causes the daemon\(aqs logging messages to go to the
+console, if the system supports it.
+.TP
+.B \fBDEVICE=\fP\fI<devicename>\fP
+This causes the daemon\(aqs logging messages to go to the specified
+device.
+.TP
+.B \fBSYSLOG\fP[\fB:\fP\fIseverity\fP[\fB:\fP\fIfacility\fP]]
+This causes the daemon\(aqs logging messages to go to the system log.
+.sp
+The severity argument specifies the default severity of system log
+messages.  This may be any of the following severities supported
+by the syslog(3) call, minus the \fBLOG_\fP prefix: \fBEMERG\fP,
+\fBALERT\fP, \fBCRIT\fP, \fBERR\fP, \fBWARNING\fP, \fBNOTICE\fP, \fBINFO\fP,
+and \fBDEBUG\fP.
+.sp
+The facility argument specifies the facility under which the
+messages are logged.  This may be any of the following facilities
+supported by the syslog(3) call minus the LOG_ prefix: \fBKERN\fP,
+\fBUSER\fP, \fBMAIL\fP, \fBDAEMON\fP, \fBAUTH\fP, \fBLPR\fP, \fBNEWS\fP,
+\fBUUCP\fP, \fBCRON\fP, and \fBLOCAL0\fP through \fBLOCAL7\fP.
+.sp
+If no severity is specified, the default is \fBERR\fP.  If no
+facility is specified, the default is \fBAUTH\fP.
+.UNINDENT
+.sp
+In the following example, the logging messages from the KDC will go to
+the console and to the system log under the facility LOG_DAEMON with
+default severity of LOG_INFO; and the logging messages from the
+administrative server will be appended to the file
+\fB/var/adm/kadmin.log\fP and sent to the device \fB/dev/tty04\fP.
+.INDENT 0.0
+.INDENT 3.5
+.sp
+.nf
+.ft C
+[logging]
+    kdc = CONSOLE
+    kdc = SYSLOG:INFO:DAEMON
+    admin_server = FILE:/var/adm/kadmin.log
+    admin_server = DEVICE=/dev/tty04
+.ft P
+.fi
+.UNINDENT
+.UNINDENT
 .SH PKINIT OPTIONS
 .IP Note
-.
 The following are pkinit\-specific options.  These values may
 be specified in [kdcdefaults] as global defaults, or within
 a realm\-specific subsection of [realms].  Also note that a
@@ -605,7 +553,6 @@ realm\-specific value over\-rides, does not add to, a generic
 .RE
 .INDENT 0.0
 .IP 1. 3
-.
 realm\-specific subsection of [realms],
 .INDENT 3.0
 .INDENT 3.5
@@ -614,14 +561,13 @@ realm\-specific subsection of [realms],
 .ft C
 [realms]
     EXAMPLE.COM = {
-        pkinit_anchors = FILE\e:/usr/local/example.com.crt
+        pkinit_anchors = FILE:/usr/local/example.com.crt
     }
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .IP 2. 3
-.
 generic value in the [kdcdefaults] section.
 .INDENT 3.0
 .INDENT 3.5
@@ -629,7 +575,7 @@ generic value in the [kdcdefaults] section.
 .nf
 .ft C
 [kdcdefaults]
-    pkinit_anchors = DIR\e:/usr/local/generic_trusted_cas/
+    pkinit_anchors = DIR:/usr/local/generic_trusted_cas/
 .ft P
 .fi
 .UNINDENT
@@ -642,19 +588,16 @@ For information about the syntax of some of these options, see
 .INDENT 0.0
 .TP
 .B \fBpkinit_anchors\fP
-.sp
 Specifies the location of trusted anchor (root) certificates which
 the KDC trusts to sign client certificates.  This option is
 required if pkinit is to be supported by the KDC.  This option may
 be specified multiple times.
 .TP
 .B \fBpkinit_dh_min_bits\fP
-.sp
 Specifies the minimum number of bits the KDC is willing to accept
 for a client\(aqs Diffie\-Hellman key.  The default is 2048.
 .TP
 .B \fBpkinit_allow_upn\fP
-.sp
 Specifies that the KDC is willing to accept client certificates
 with the Microsoft UserPrincipalName (UPN) Subject Alternative
 Name (SAN).  This means the KDC accepts the binding of the UPN in
@@ -666,60 +609,50 @@ the id\-pkinit\-san as defined in \fI\%RFC 4556\fP.  There is currently
 no option to disable SAN checking in the KDC.
 .TP
 .B \fBpkinit_eku_checking\fP
-.sp
 This option specifies what Extended Key Usage (EKU) values the KDC
 is willing to accept in client certificates.  The values
 recognized in the kdc.conf file are:
 .INDENT 7.0
 .TP
 .B \fBkpClientAuth\fP
-.sp
 This is the default value and specifies that client
 certificates must have the id\-pkinit\-KPClientAuth EKU as
 defined in \fI\%RFC 4556\fP.
 .TP
 .B \fBscLogin\fP
-.sp
 If scLogin is specified, client certificates with the
 Microsoft Smart Card Login EKU (id\-ms\-kp\-sc\-logon) will be
 accepted.
 .TP
 .B \fBnone\fP
-.sp
 If none is specified, then client certificates will not be
 checked to verify they have an acceptable EKU.  The use of
 this option is not recommended.
 .UNINDENT
 .TP
 .B \fBpkinit_identity\fP
-.sp
 Specifies the location of the KDC\(aqs X.509 identity information.
 This option is required if pkinit is to be supported by the KDC.
 .TP
 .B \fBpkinit_kdc_ocsp\fP
-.sp
 Specifies the location of the KDC\(aqs OCSP.
 .TP
 .B \fBpkinit_mapping_file\fP
-.sp
 Specifies the name of the ACL pkinit mapping file.  This file maps
 principals to the certificates that they can use.
 .TP
 .B \fBpkinit_pool\fP
-.sp
 Specifies the location of intermediate certificates which may be
 used by the KDC to complete the trust chain between a client\(aqs
 certificate and a trusted anchor.  This option may be specified
 multiple times.
 .TP
 .B \fBpkinit_revoke\fP
-.sp
 Specifies the location of Certificate Revocation List (CRL)
 information to be used by the KDC when verifying the validity of
 client certificates.  This option may be specified multiple times.
 .TP
 .B \fBpkinit_require_crl_checking\fP
-.sp
 The default certificate verification process will always check the
 available revocation information to see if a certificate has been
 revoked.  If a match is found for the certificate in a CRL,
@@ -916,11 +849,30 @@ Here\(aqs an example of a kdc.conf file:
         max_renewable_life = 7d 0h 0m 0s
         master_key_type = des3\-hmac\-sha1
         supported_enctypes = des3\-hmac\-sha1:normal des\-cbc\-crc:normal des\-cbc\-crc:v4
+        database_module = openldap_ldapconf
     }
 
 [logging]
     kdc = FILE:/usr/local/var/krb5kdc/kdc.log
     admin_server = FILE:/usr/local/var/krb5kdc/kadmin.log
+
+[dbdefaults]
+    ldap_kerberos_container_dn = cn=krbcontainer,dc=mit,dc=edu
+
+[dbmodules]
+    openldap_ldapconf = {
+        db_library = kldap
+        disable_last_success = true
+        ldap_kdc_dn = "cn=krbadmin,dc=mit,dc=edu"
+            # this object needs to have read rights on
+            # the realm container and principal subtrees
+        ldap_kadmind_dn = "cn=krbadmin,dc=mit,dc=edu"
+            # this object needs to have read and write rights on
+            # the realm container and principal subtrees
+        ldap_service_password_file = /etc/kerberos/service.keyfile
+        ldap_servers = ldaps://kerberos.mit.edu
+        ldap_conns_per_server = 5
+    }
 .ft P
 .fi
 .UNINDENT
@@ -930,10 +882,10 @@ Here\(aqs an example of a kdc.conf file:
 \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kdc.conf\fP
 .SH SEE ALSO
 .sp
-\fIkrb5.conf(5)\fP, \fIkrb5kdc(8)\fP
+\fIkrb5.conf(5)\fP, \fIkrb5kdc(8)\fP, \fIkadm5.acl(5)\fP
 .SH AUTHOR
 MIT
 .SH COPYRIGHT
-2011, MIT
+2012, MIT
 .\" Generated by docutils manpage writer.
 .