Allow principals to refer to nonexistent policies

Stop using and maintaining the policy_refcnt field, and do not try to
prevent deletion of a policy which is still referenced by principals.
Instead, allow principals to refer to policy names which do not exist
as policy objects; treat those principals as having no associated
policy.

In the kadmin client, warn if addprinc or modprinc tries to reference
a policy which doesn't exist, since the server will no longer error
out in this case.

ticket: 7385

1 files changed, 1 insertions, 2 deletions

diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp
index 1822bc38a8..c62e183e75 100644
--- a/src/tests/dejagnu/krb-standalone/kadmin.exp
+++ b/src/tests/dejagnu/krb-standalone/kadmin.exp
@@ -711,7 +711,6 @@ proc kadmin_addpol { pname } {
     expect "Minimum number of password character classes:" {
         verbose "got min pw character classes" }
     expect "Number of old keys kept:" { verbose "got num old keys kept" }
-    expect "Reference count:" { verbose "got refcount" }
     expect "kadmin.local: " { send "q\r" }
 
     expect_after
@@ -924,7 +923,7 @@ proc kadmin_showpol { pname } {
     }
     expect -re "assword\[^\r\n\]*: *"
     send "adminpass$KEY\r"
-    expect -re "\r.*Policy: $pname.*Number of old keys kept: .*Reference count: .*\r"
+    expect -re "\r.*Policy: $pname.*Number of old keys kept: .*\r"
     expect_after
     expect eof
     set k_stat [wait -i $spawn_id]