Wix MSI installer for KFW 3.0 Beta 3

Add operating system version check to ensure it is not
installed on Windows 95, 98, ME or NT 4.0

Break out the license text into its own file

Restructure the installer to allow either NetIdMgr or Leash
to be selected (by transform only) as the credentials manager.
The default is to use NetIdMgr.

ticket: new
component: windows
status: resolved
target_version: 1.4.4
tags: pullup 

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17533 dc483132-0cff-0310-8789-dd5450dbe970

10 files changed, 242 insertions, 96 deletions

diff --git a/src/windows/installer/wix/config.wxi b/src/windows/installer/wix/config.wxi
index 8c361eb1f0..fa756bbb2a 100644
--- a/src/windows/installer/wix/config.wxi
+++ b/src/windows/installer/wix/config.wxi
@@ -151,4 +151,11 @@
     <?ifndef Krb5PreserveIdentity?>
         <?define Krb5PreserveIdentity="1"?>
     <?endif?>
+
+    <!-- If neither NetIDMgr or Leash is specified, we default to NetIDMgr -->
+    <?ifndef UseNetIDMgr?>
+        <?ifndef UseLeash?>
+             <?define UseNetIDMgr="1"?>
+        <?endif?>
+    <?endif?>
 </Include>
\ No newline at end of file
diff --git a/src/windows/installer/wix/custom/custom.cpp b/src/windows/installer/wix/custom/custom.cpp
index dd1fb9c5d0..fdf4bbbd25 100644
--- a/src/windows/installer/wix/custom/custom.cpp
+++ b/src/windows/installer/wix/custom/custom.cpp
@@ -436,16 +436,25 @@ UINT KillRunningProcessesSlave( MSIHANDLE hInstall, BOOL bKill )
                     // try to kill the process
                     HANDLE hProcess = NULL;
 
+                    // If we encounter an error, instead of bailing
+                    // out, we continue on to the next process.  We
+                    // may not have permission to kill all the
+                    // processes we want to kill anyway.  If there are
+                    // any files that we want to replace that is in
+                    // use, Windows Installer will schedule a reboot.
+                    // Also, it's not like we have an exhaustive list
+                    // of all the programs that use Kerberos anyway.
+
                     hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pe.th32ProcessID);
                     if(hProcess == NULL) {
                         rv = GetLastError();
-                        goto _cleanup;
+                        break;
                     }
 
                     if(!TerminateProcess(hProcess, 0)) {
                         rv = GetLastError();
                         CloseHandle(hProcess);
-                        goto _cleanup;
+                        break;
                     }
 
                     CloseHandle(hProcess);
@@ -729,4 +738,4 @@ MSIDLLEXPORT UninstallNetProvider( MSIHANDLE hInstall) {
 #endif
 #ifdef __NMAKE__
 !ENDIF
-#endif
\ No newline at end of file
+#endif
diff --git a/src/windows/installer/wix/custom/custom.h b/src/windows/installer/wix/custom/custom.h
index 9fcc61e65e..2e66671a1a 100644
--- a/src/windows/installer/wix/custom/custom.h
+++ b/src/windows/installer/wix/custom/custom.h
@@ -75,7 +75,7 @@ MSIDLLEXPORT UninstallNetProvider ( MSIHANDLE );
 
 /* Custom errors */
 #define ERR_CUSTACTDATA 4001
-#define ERR_NSS_FAILED 4003
-#define ERR_ABORT 4004
-#define ERR_PROC_LIST 4006
-#define ERR_NPI_FAILED 4007
+#define ERR_NSS_FAILED  4003
+#define ERR_ABORT       4004
+#define ERR_PROC_LIST   4006
+#define ERR_NPI_FAILED  4007
diff --git a/src/windows/installer/wix/features.wxi b/src/windows/installer/wix/features.wxi
index 22630053d7..56dba608e0 100644
--- a/src/windows/installer/wix/features.wxi
+++ b/src/windows/installer/wix/features.wxi
@@ -40,7 +40,7 @@
             InstallDefault="local"
             Title="$(loc.KerberosClientTitle)"
             Level="30">
-            
+
             <?ifdef DebugSyms?>
 	    	<Feature 
                     Id="feaKfwClientDebug" 
@@ -55,16 +55,8 @@
 	        </Feature>
 	    <?endif?>
 
-	    <Feature
-		Id="feaKfwLeashExe"
-		AllowAdvertise="no"
-		Description="$(loc.StrLeashExeDesc)"
-		Display="expand"
-		InstallDefault="local"
-		Level="130"
-		Title="$(loc.StrLeashExeTitle)">
-	            <ComponentRef Id="cmf_leash32_exe" />
-	    </Feature>
+            <ComponentRef Id="cmf_leash32_exe" />
+            <ComponentRef Id="csc_leash32_exe" />
 
             <ComponentRef Id="cmf_aklog_exe" />
             <ComponentRef Id="cmf_comerr32_dll" />
@@ -94,8 +86,9 @@
             <ComponentRef Id="cmf_krb4cred_dll" />
             <ComponentRef Id="cmf_krb4cred_en_us_dll" />
             <ComponentRef Id="cmf_netidmgr_exe" />
+
 	    <ComponentRef Id="cmf_kfwlogon_DLL" />
-            
+            <ComponentRef Id="cmf_kfwcpcc_EXE" />
             <!-- Kerberos IV options -->
             <ComponentRef Id="rcm_krb4_1" />
             <ComponentRef Id="rcm_krb4_2" />
@@ -228,7 +221,8 @@
             
             <Feature Id="feaKfwLeashStartup" AllowAdvertise="no" Display="hidden" Level="130">
                 <Condition Level="30">LEASHAUTOSTART = 1</Condition>
-                <ComponentRef Id="csc_leashStartup"/>
+                <ComponentRef Id="csc_NetIDMgrStartup" />
+                <ComponentRef Id="csc_LeashStartup" />
             </Feature>
 
         </Feature> <!-- /feaKfwClient -->
diff --git a/src/windows/installer/wix/files.wxi b/src/windows/installer/wix/files.wxi
index 07c307b90c..c276c77e90 100644
--- a/src/windows/installer/wix/files.wxi
+++ b/src/windows/installer/wix/files.wxi
@@ -27,9 +27,8 @@
 <Include xmlns="http://schemas.microsoft.com/wix/2003/01/wi">
 <Directory Id="TARGETDIR" Name="SourceDir">
     <Directory Id="SystemFolder" SourceName="System">
-        <Component Id="cmf_kfwlogon_DLL" Guid="F9094A4C-A0CF-4E24-940D-150ABC27F80F">
+        <Component Id="cmf_kfwlogon_DLL" Guid="2F104FEB-2D61-458A-BAE3-B153F151E728">
              <File Id="filekfwlogon_DLL" Name="kfwlogon.dll" LongName="kfwlogon.dll" KeyPath="yes" DiskId="1" src="$(var.BinDir)kfwlogon.dll" />
-             <File Id="filekfwcpcc_EXE"  Name="kfwcpcc.exe"  LongName="kfwcpcc.exe"  DiskId="1" src="$(var.BinDir)kfwcpcc.exe" />
              <Registry Id="reg_kfwlogon01" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\KFWLogon" Action="createKeyAndRemoveKeyOnUninstall" />
              <Registry Id="reg_kfwlogon02" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\KFWLogon" />
              <Registry Id="reg_kfwlogon03" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\KFWLogon" Name="Asynchronous" Type="integer" Value="0" />
@@ -44,6 +43,9 @@
              <Registry Id="reg_kfwlogon12" Root="HKLM" Key="SYSTEM\CurrentControlSet\Services\MIT Kerberos\NetworkProvider" Name="Class" Type="integer" Value="2" />
              <Registry Id="reg_kfwlogon13" Root="HKLM" Key="SYSTEM\CurrentControlSet\Services\MIT Kerberos\NetworkProvider" Name="Name" Type="string" Value="MIT Kerberos"/>
          </Component>
+         <Component Id="cmf_kfwcpcc_EXE" Guid="C3284E7A-3665-45A6-B64E-C909B1D1BAA6">
+             <File Id="filekfwcpcc_EXE"  Name="kfwcpcc.exe"  LongName="kfwcpcc.exe"  DiskId="1" src="$(var.BinDir)kfwcpcc.exe" />
+         </Component>
      <?ifdef DebugSyms?>
          <Component Id="cmp_ClientSystemDebug" Guid="2D13ED48-53C2-4878-B196-2AD7F4100998">
      		<File Id="filekfwlogon_PDB" Name="kfwlogon.pdb" LongName="kfwlogon.pdb" KeyPath="yes" DiskId="1" src="$(var.BinDir)kfwlogon.pdb" />
@@ -178,14 +180,18 @@
                     <Component Id="cmf_krbv4w32_dll" Guid="DFA23F6C-5297-4876-AF52-6F7CF2CB34AC" DiskId="1">
 	                    <File Id="fil_krbv4w32_dll" LongName="krbv4w32.dll" Name="krbv4w32.dll" KeyPath="yes" />
                     </Component>
+
                     <Component Id="cmf_leash32_exe" Guid="990D5F6B-4CEE-4706-96F4-F7AF12F97DF7" DiskId="1">
-	                    <File Id="fil_leash32_exe" LongName="leash32.exe" Name="leash32.exe" KeyPath="yes">
-			        <Shortcut Id="sc_leash32_exe" Advertise="no" Directory="dirShortcut" LongName="Leash Kerberos Ticket Manager.lnk" Name="Leash.lnk" Arguments="[LEASHAUTOINIT]" />
-	                    </File>
+	                    <File Id="fil_leash32_exe" LongName="leash32.exe" Name="leash32.exe" KeyPath="yes" />
 	                    <Registry Id="reg_ts_leash32_0" Root="HKLM" Key="Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\leash32" Action="createKeyAndRemoveKeyOnUninstall" />
 	                    <Registry Id="reg_ts_leash32_1" Root="HKLM" Key="Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\leash32" Name="Flags" Type="integer" Value="1032" />
                     </Component>
 
+                    <Component Id="csc_leash32_exe" Guid="8A096700-47B1-4A0B-B7B5-44F75086DEAE" DiskId="1">
+                        <Shortcut Id="sc_leash32_exe" Advertise="no" Directory="dirShortcut" LongName="Leash Kerberos Ticket Manager.lnk" Name="Leash.lnk" Arguments="[LEASHAUTOINIT]" Target="[!fil_leash32_exe]" />
+                        <Condition>USELEASH</Condition>
+                    </Component>
+
                     <!-- Leash32 configuration -->
                     <Component Id="rcm_leash_1" Guid="B91648A0-26F7-43BB-A954-202FF3811E3C" DiskId="1">
 	                    <Registry Id="reg_leash_1" Root="HKLM" Key="Software\MIT\Leash32\Settings" Name="AfsStatus" Type="integer" Value="[LEASHAFSSTATUS]" KeyPath="yes"/>
@@ -213,10 +219,18 @@
 	                    <Condition>LEASHMSLSAIMPORT</Condition>
                     </Component>
                     
-                    <Component Id="csc_leashStartup" Guid="3408C97D-68D6-4207-9142-BF82F7C62DC0" DiskId="1">
+                    <Component Id="csc_NetIDMgrStartup" Guid="669227E3-0ADC-4173-90C3-631FCFC8EBC3" DiskId="1">
+                        <Registry Id="reg_sc_nidmgr_marker" Root="HKLM" Key="$(var.KfwRegRoot)\Client\$(var.VersionString)" Name="NetIDMgrAutoStart" Type="integer" Value="1" KeyPath="yes" />
+                        <Shortcut Id="sc_netidmgr_exe_startup" Advertise="no" Directory="StartupFolder" LongName="Network Identity Manager.lnk" Name="netidmgr.lnk" Arguments="[LEASHAUTOINIT]" Target="[dirbin]netidmgr.exe" Show="minimized" />
+                        <Condition>USENETIDMGR</Condition>
+                    </Component>
+
+                    <Component Id="csc_LeashStartup" Guid="0DF73BCD-F34E-4B01-AA71-0EE08EB62F70" DiskId="1">
                         <Registry Id="reg_sc_leash_marker" Root="HKLM" Key="$(var.KfwRegRoot)\Client\$(var.VersionString)" Name="LeashAutoStart" Type="integer" Value="1" KeyPath="yes" />
-                        <Shortcut Id="sc_leash32_exe_startup" Advertise="no" Directory="StartupFolder" LongName="Network Identity Manager.lnk" Name="netidmgr.lnk" Arguments="[LEASHAUTOINIT]" Target="[dirbin]netidmgr.exe" Show="minimized" WorkingDirectory="[dirbin]"/>
+                        <Shortcut Id="sc_leash_exe_startup" Advertise="no" Directory="StartupFolder" LongName="Leash Credentials Manager.lnk" Name="netidmgr.lnk" Arguments="[LEASHAUTOINIT]" Target="[dirbin]leash32.exe" Show="minimized" />
+                        <Condition>USELEASH</Condition>
                     </Component>
+
                 <?ifdef OldHelp?>
                     <Component Id="cmf_leash32_hlp" Guid="919616D6-1605-4A79-8E33-C18A0D0F25E3" DiskId="1">
 	                    <File Id="fil_leash32_hlp" LongName="leash32.hlp" Name="leash32.hlp" KeyPath="yes" />
@@ -655,35 +669,36 @@
                         </Component>
                     </Directory>
                     <Directory Id="dirinc_netidmgr" Name="netidmgr" src="$(var.IncDir)netidmgr\">
-						<Component Id="cmp_dirinc_netidmgr" Guid="EBD8BA04-574A-4081-A994-BCEC8ACBC878" DiskId="1">
-							<File Id="fil_hashtable_h" LongName="hashtable.h" Name="HASHTA~1.H" />
-							<File Id="fil_kconfig_h" LongName="kconfig.h" Name="kconfig.h" /> 
-							<File Id="fil_kcreddb_h" LongName="kcreddb.h" Name="kcreddb.h" /> 
-							<File Id="fil_khaction_h" LongName="khaction.h" Name="khaction.h" /> 
-							<File Id="fil_khactiondef_h" LongName="khactiondef.h" Name="KHACTI~1.H" /> 
-							<File Id="fil_khalerts_h" LongName="khalerts.h" Name="khalerts.h" /> 
-							<File Id="fil_khconfigui_h" LongName="khconfigui.h" Name="KHCONF~1.H" /> 
-							<File Id="fil_khdefs_h" LongName="khdefs.h" Name="khdefs.h" /> 
-							<File Id="fil_kherr_h" LongName="kherr.h" Name="kherr.h" /> 
-							<File Id="fil_kherror_h" LongName="kherror.h" Name="kherror.h" /> 
-							<File Id="fil_khhelp_h" LongName="khhelp.h" Name="khhelp.h" /> 
-							<File Id="fil_khhtlink_h" LongName="khhtlink.h" Name="khhtlink.h" /> 
-							<File Id="fil_khlist_h" LongName="khlist.h" Name="khlist.h" /> 
-							<File Id="fil_khmsgtypes_h" LongName="khmsgtypes.h" Name="KHMSGT~1.H" /> 
-							<File Id="fil_khnewcred_h" LongName="khnewcred.h" Name="KHNEWC~1.H" /> 
-							<File Id="fil_khprops_h" LongName="khprops.h" Name="khprops.h" /> 
-							<File Id="fil_khremote_h" LongName="khremote.h" Name="khremote.h" /> 
-							<File Id="fil_khrescache_h" LongName="khrescache.h" Name="KHRESC~1.H" /> 
-							<File Id="fil_khtracker_h" LongName="khtracker.h" Name="KHTRAC~1.H" />
-							<File Id="fil_khuidefs_h" LongName="khuidefs.h" Name="khuidefs.h" KeyPath="yes" />
-							<File Id="fil_kmm_h" LongName="kmm.h" Name="kmm.h" /> 
-							<File Id="fil_kmq_h" LongName="kmq.h" Name="kmq.h" /> 
-							<File Id="fil_kplugin_h" LongName="kplugin.h" Name="kplugin.h" /> 
-							<File Id="fil_mstring_h" LongName="mstring.h" Name="mstring.h" /> 
-							<File Id="fil_sync_h" LongName="sync.h" Name="sync.h" /> 
-							<File Id="fil_utils_h" LongName="utils.h" Name="utils.h" /> 
-							<File Id="fil_netidmgr_h" LongName="netidmgr.h" Name="netidmgr.h" /> 
-						</Component>
+                        <Component Id="cmp_dirinc_netidmgr" Guid="EBD8BA04-574A-4081-A994-BCEC8ACBC878" DiskId="1">
+                            <File Id="fil_hashtable_h" LongName="hashtable.h" Name="HASHTA~1.H" />
+                            <File Id="fil_kconfig_h" LongName="kconfig.h" Name="kconfig.h" /> 
+                            <File Id="fil_kcreddb_h" LongName="kcreddb.h" Name="kcreddb.h" /> 
+                            <File Id="fil_khaction_h" LongName="khaction.h" Name="khaction.h" /> 
+                            <File Id="fil_khactiondef_h" LongName="khactiondef.h" Name="KHACTI~1.H" /> 
+                            <File Id="fil_khalerts_h" LongName="khalerts.h" Name="khalerts.h" /> 
+                            <File Id="fil_khconfigui_h" LongName="khconfigui.h" Name="KHCONF~1.H" /> 
+                            <File Id="fil_khdefs_h" LongName="khdefs.h" Name="khdefs.h" /> 
+                            <File Id="fil_kherr_h" LongName="kherr.h" Name="kherr.h" /> 
+                            <File Id="fil_kherror_h" LongName="kherror.h" Name="kherror.h" /> 
+                            <File Id="fil_khhtlink_h" LongName="khhtlink.h" Name="khhtlink.h" /> 
+                            <File Id="fil_khlist_h" LongName="khlist.h" Name="khlist.h" /> 
+                            <File Id="fil_khmsgtypes_h" LongName="khmsgtypes.h" Name="KHMSGT~1.H" /> 
+                            <File Id="fil_khnewcred_h" LongName="khnewcred.h" Name="KHNEWC~1.H" /> 
+                            <File Id="fil_khprops_h" LongName="khprops.h" Name="khprops.h" /> 
+                            <File Id="fil_khremote_h" LongName="khremote.h" Name="khremote.h" /> 
+                            <File Id="fil_khrescache_h" LongName="khrescache.h" Name="KHRESC~1.H" /> 
+                            <File Id="fil_khtracker_h" LongName="khtracker.h" Name="KHTRAC~1.H" />
+                            <File Id="fil_khuidefs_h" LongName="khuidefs.h" Name="khuidefs.h" KeyPath="yes" />
+                            <File Id="fil_kmm_h" LongName="kmm.h" Name="kmm.h" />
+                            <File Id="fil_kmq_h" LongName="kmq.h" Name="kmq.h" />
+                            <File Id="fil_kplugin_h" LongName="kplugin.h" Name="kplugin.h" />
+                            <File Id="fil_mstring_h" LongName="mstring.h" Name="mstring.h" />
+                            <File Id="fil_sync_h" LongName="sync.h" Name="sync.h" />
+                            <File Id="fil_utils_h" LongName="utils.h" Name="utils.h" />
+                            <File Id="fil_perfstat_h" LongName="perfstat.h" Name="perfstat.h" />
+                            <File Id="fil_netidmgr_h" LongName="netidmgr.h" Name="netidmgr.h" /> 
+                            <File Id="fil_netidmgr_version_h" LongName="netidmgr_version.h" Name="netidmvr.h" />
+                        </Component>
                     </Directory>
                     <Directory Id="dirinc_wshelper" Name="wshelper" src="$(var.IncDir)wshelper\">
                         <Component Id="cmp_dirinc_wshelper" Guid="5A4FCD76-6DC6-455c-B465-FD8123252EBD" DiskId="1">
@@ -716,6 +731,7 @@
                             <File Id="fil_loadfuncs_lib" LongName="loadfuncs.lib" Name="LOADFU~1.LIB" />
                             <File Id="fil_wshelp32_lib" LongName="wshelp32.lib" Name="wshelp32.lib" />
                             <File Id="fil_xpprof32_lib" LongName="xpprof32.lib" Name="xpprof32.lib" />
+                            <File Id="fil_nidmgr32_lib" LongName="nidmgr32.lib" Name="nidmgr32.lib" />
                         </Component>
                     </Directory>
                 </Directory>
@@ -775,12 +791,12 @@
                     </Directory>
                 </Directory>
                 
-                
                 <Directory Id="dirdoc" Name="doc" src="$(var.DocDir)">
                     <Component Id="efl_leash_userdoc_pdf" Guid="68FB24DD-5EC2-4db1-AD42-5B9DDEC247C5" DiskId="1">
                         <File Id="fil_leash_userdoc_pdf" LongName="leash_userdoc.pdf" Name="leash.pdf" KeyPath="yes">
 			    <Shortcut Id="sc_leash_userdoc_pdf" Advertise="no" Directory="dirShortcut" LongName="Leash User Documentation.lnk" Name="leashdoc.lnk" />
                         </File>
+                        <Condition>USELEASH</Condition>
                     </Component>
                     <Component Id="efl_relnotes_html" Guid="C65F920A-039D-4839-848F-0AD7B445F376" DiskId="1">
                         <File Id="fil_relnotes_html" LongName="relnotes.html" Name="RELNOT~1.HTM" KeyPath="yes">
diff --git a/src/windows/installer/wix/kfw.wxs b/src/windows/installer/wix/kfw.wxs
index 01c6f53b6d..f791feed62 100644
--- a/src/windows/installer/wix/kfw.wxs
+++ b/src/windows/installer/wix/kfw.wxs
@@ -58,8 +58,10 @@
         
         <!-- Launch conditions -->
         <Condition Message="$(loc.AdminRequired)">Privileged</Condition>
-        <Condition Message="$(loc.OsVersionRequired)">Version9X &gt;= 410 Or VersionNT &gt;= 400</Condition>
-        
+        <Condition Message="$(loc.OsVersionRequired)">VersionNT &gt;= 500</Condition>
+        <Condition Message="$(loc.CMNotSelected)">USELEASH Or USENETIDMGR</Condition>
+        <Condition Message="$(loc.CMDupSelected)">Not (USELEASH And USENETIDMGR)</Condition>
+
         <!-- Custom actions -->
         <Binary Id="binCustom" src="custom\custom.dll" />
         
@@ -165,7 +167,7 @@
         
         <!-- KfW MSI -->
         <Upgrade Id="61211594-AAA1-4A98-A299-757326763CC7">
-            <UpgradeVersion IgnoreRemoveFailure="no" IncludeMinimum="no" Maximum="$(var.VersionString)" IncludeMaximum="no" MigrateFeatures="yes" Property="UPGRADEKFW" />
+            <UpgradeVersion IgnoreRemoveFailure="no" IncludeMinimum="no" Maximum="$(var.VersionString)" IncludeMaximum="yes" MigrateFeatures="yes" Property="UPGRADEKFW" />
         </Upgrade>
        
         <!-- NSIS installation -->
@@ -193,6 +195,11 @@
                 <Data Column="Desc">Leash Ticket Manager</Data>
             </Row>
             <Row>
+                <Data Column="Id">kpNetIDMgr</Data>
+                <Data Column="Image">netidmgr.exe</Data>
+                <Data Column="Desc">Network Identity Manager</Data>
+            </Row>
+            <Row>
                 <Data Column="Id">kpKrbcc</Data>
                 <Data Column="Image">krbcc32s.exe</Data>
                 <Data Column="Desc">Kerberos Credential Cache</Data>
@@ -200,12 +207,12 @@
             <Row>
                 <Data Column="Id">kpK95</Data>
                 <Data Column="Image">k95.exe</Data>
-                <Data Column="Desc"></Data>
+                <Data Column="Desc">Kermit 95</Data>
             </Row>
             <Row>
                 <Data Column="Id">kpK95g</Data>
                 <Data Column="Image">k95g.exe</Data>
-                <Data Column="Desc"></Data>
+                <Data Column="Desc">Kermit 95 GUI</Data>
             </Row>
             <Row>
                 <Data Column="Id">kpkrb5</Data>
diff --git a/src/windows/installer/wix/lang/license.rtf b/src/windows/installer/wix/lang/license.rtf
new file mode 100644
index 0000000000..b28c080267
--- /dev/null
+++ b/src/windows/installer/wix/lang/license.rtf
@@ -0,0 +1,102 @@
+{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fmodern\fprq1\fcharset0 Courier New;}{\f1\froman\fprq2\fcharset0 Times New Roman;}}

+{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\nowidctlpar\tx916\tx1832\tx2748\tx3664\tx4580\tx5496\tx6412\tx7328\tx8244\tx9160\tx10076\tx10992\tx11908\tx12824\tx13740\tx14656\f0\fs20 Copyright Notice and Legal Administrivia\par

+----------------------------------------\par

+\par

+Copyright (C) 1985-2005 by the Massachusetts Institute of Technology.\par

+\par

+All rights reserved.\par

+\par

+Export of this software from the United States of America may require a specific license from the United States Government.  It is the responsibility of any person or organization contemplating export to obtain such a license before exporting.\par

+\par

+WITHIN THAT CONSTRAINT, permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and\par

+this permission notice appear in supporting documentation, and that the name of M.I.T. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.  Furthermore if you modify this software you must label your software as modified software and not distribute it in such a fashion that it might be confused with the original MIT software. M.I.T. makes no representations about the suitability of this software for any purpose.  It is provided "as is" without express or implied warranty.\par

+\par

+THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.\par

+\par

+Individual source code files are copyright MIT, Cygnus Support, OpenVision, Oracle, Sun Soft, FundsXpress, and others.\par

+\par

+Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira, and Zephyr are trademarks of the Massachusetts Institute of Technology (MIT).  No commercial use of these trademarks may be made without prior written permission of MIT.\par

+\par

+"Commercial use" means use of a name in a product or other for-profit manner.  It does NOT prevent a commercial firm from referring to the MIT trademarks in order to convey information (although in doing so, recognition of their trademark status should be given).\par

+\par

+----\par

+\par

+The following copyright and permission notice applies to the OpenVision Kerberos Administration system located in kadmin/create, kadmin/dbutil, kadmin/passwd, kadmin/server, lib/kadm5, and portions of lib/rpc:\par

+\par

+Copyright, OpenVision Technologies, Inc., 1996, All Rights Reserved\par

+\par

+WARNING: Retrieving the OpenVision Kerberos Administration system source code, as described below, indicates your acceptance of the following terms.  If you do not agree to the following terms, do not retrieve the OpenVision Kerberos administration system.\par

+\par

+You may freely use and distribute the Source Code and Object Code compiled from it, with or without modification, but this Source Code is provided to you "AS IS" EXCLUSIVE OF ANY WARRANTY, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, OR ANY OTHER WARRANTY, WHETHER EXPRESS OR IMPLIED.  IN NO EVENT WILL OPENVISION HAVE ANY LIABILITY FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY OTHER REASON.\par

+\par

+OpenVision retains all copyrights in the donated Source Code. OpenVision also retains copyright to derivative works of the Source Code, whether created by OpenVision or by a third party. The OpenVision copyright notice must be preserved if derivative works are made based on the donated Source Code.\par

+\par

+OpenVision Technologies, Inc. has donated this Kerberos Administration system to MIT for inclusion in the standard Kerberos 5 distribution.  This donation underscores our commitment to continuing Kerberos technology development and our gratitude for the valuable work which has been performed by MIT and the Kerberos community.\par

+\par

+----\par

+\par

+Portions contributed by Matt Crawford <crawdad@fnal.gov> were work performed at Fermi National Accelerator Laboratory, which is operated by Universities Research Association, Inc., under contract DE-AC02-76CHO3000 with the U.S. Department of Energy.\par

+\par

+\pard ----\f1\fs24\par

+\pard\nowidctlpar\tx916\tx1832\tx2748\tx3664\tx4580\tx5496\tx6412\tx7328\tx8244\tx9160\tx10076\tx10992\tx11908\tx12824\tx13740\tx14656\f0\fs20\par

+The implementation of the Yarrow pseudo-random number generator in src/lib/crypto/yarrow has the following copyright:\par

+\par

+Copyright 2000 by Zero-Knowledge Systems, Inc.\par

+\par

+Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Zero-Knowledge Systems, Inc. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.  Zero-Knowledge Systems, Inc. makes no representations about the suitability of this software for any purpose.  It is provided "as is" without express or implied warranty.\par

+\par

+ZERO-KNOWLEDGE SYSTEMS, INC. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL ZERO-KNOWLEDGE SYSTEMS, INC. BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\par

+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTUOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\par

+\par

+\pard ----\f1\fs24\par

+\pard\nowidctlpar\tx916\tx1832\tx2748\tx3664\tx4580\tx5496\tx6412\tx7328\tx8244\tx9160\tx10076\tx10992\tx11908\tx12824\tx13740\tx14656\f0\fs20\par

+The implementation of the AES encryption algorithm in src/lib/crypto/aes has the following copyright:\par

+\par

+Copyright (c) 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.\par

+All rights reserved.\par

+\par

+LICENSE TERMS\par

+\par

+The free distribution and use of this software in both source and binary form is allowed (with or without changes) provided that:\par

+\par

+1. distributions of this source code include the above copyright notice, this list of conditions and the following disclaimer;\par

+\par

+2. distributions in binary form include the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other associated materials;\par

+\par

+3. the copyright holder's name is not used to endorse products built using this software without specific written permission. \par

+\par

+DISCLAIMER\par

+\par

+This software is provided 'as is' with no explcit or implied warranties in respect of any properties, including, but not limited to, correctness and fitness for purpose.\par

+\par

+\par

+\par

+Acknowledgements\par

+----------------\par

+\par

+Appreciation Time!!!!  There are far too many people to try to thank them all; many people have contributed to the development of Kerberos V5.  This is only a partial listing....\par

+\par

+Thanks to Paul Vixie and the Internet Software Consortium for funding the work of Barry Jaspan.  This funding was invaluable for the OV administration server integration, as well as the 1.0 release preparation process.\par

+\par

+Thanks to John Linn, Scott Foote, and all of the folks at OpenVision Technologies, Inc., who donated their administration server for use in the MIT release of Kerberos.\par

+\par

+Thanks to Jeff Bigler, Mark Eichin, Marc Horowitz, Nancy Gilman, Ken Raeburn, and all of the folks at Cygnus Support, who provided innumerable bug fixes and portability enhancements to the Kerberos V5 tree.  Thanks especially to Jeff Bigler, for the new user and system administrator's documentation.\par

+\par

+Thanks to Doug Engert from ANL for providing many bug fixes, as well as testing to ensure DCE interoperability.\par

+\par

+Thanks to Ken Hornstein at NRL for providing many bug fixes and suggestions, and for working on SAM preauthentication.\par

+\par

+Thanks to Matt Crawford at FNAL for bugfixes and enhancements.\par

+\par

+Thanks to Sean Mullan and Bill Sommerfeld from Hewlett Packard for their many suggestions and bug fixes.\par

+\par

+Thanks to Nalin Dahyabhai of RedHat and Chris Evans for locating and providing patches for numerous buffer overruns.\par

+\par

+Thanks to Christopher Thompson and Marcus Watts for discovering the ftpd security bug.\par

+\par

+Thanks to Paul Nelson of Thursby Software Systems for implementing the Microsoft set password protocol.\par

+\par

+Thanks to the members of the Kerberos V5 development team at MIT, both past and present: Danilo Almeida, Jeffrey Altman, Jay Berkenbilt, Richard Basch, Mitch Berger, John Carr, Don Davis, Alexandra Ellwood, Nancy Gilman, Matt Hancher, Sam Hartman, Paul Hill, Marc Horowitz, Eva Jacobus, Miroslav Jurisic, Barry Jaspan, Geoffrey King, John Kohl, Peter Litwack, Scott McGuire, Kevin Mitchell, Cliff Neuman, Paul Park, Ezra Peisach, Chris Provenzano, Ken Raeburn, Jon Rochlis, Jeff Schiller, Jen Selby, Brad Thompson, Harry Tsai, Ted Ts'o, Marshall Vale, Tom Yu.\par

+\pard\nowidctlpar\f1\fs24\par

+}

+
diff --git a/src/windows/installer/wix/lang/strings_1033.wxl b/src/windows/installer/wix/lang/strings_1033.wxl
index 722782b3c6..8813343768 100644
--- a/src/windows/installer/wix/lang/strings_1033.wxl
+++ b/src/windows/installer/wix/lang/strings_1033.wxl
@@ -52,7 +52,10 @@
     <String Id="KerberosDocDesc">Documentation</String>
     
     <String Id="AdminRequired">You need administrative privileges to install Kerberos for Windows</String>
-    <String Id="OsVersionRequired">This product requires Windows 98/ME/2000/XP/2003.  The current operating system is not supported.</String>
+    <String Id="OsVersionRequired">This product requires Windows 2000/XP/2003.  The current operating system is not supported.</String>
+    <String Id="CMNotSelected">Neither Leash nor Network Identity Manager has been selected for this package.  Please contact your administrator or the provider of this installation package to resolve this issue.</String>
+    <String Id="CMDupSelected">Both Leash and Network Identity Manager has been selected for this package.  Only one of these can be selected at one time.  Please contact your administrator or the provider of this installation package to resolve this issue.</String>
+
     <String Id="CantRemoveNSIS">The NSIS based installation of Kerberos for Windows could not be uninstalled because the NSIS uninstaller must be run in Full UI mode.</String>
     <String Id="IE501Required">Kerberos for Windows requires Microsoft Internet Explorer version 5.01 or higher.  Please resolve this and run the installer again.</String>
 
diff --git a/src/windows/installer/wix/lang/ui_1033.wxi b/src/windows/installer/wix/lang/ui_1033.wxi
index 448e162de9..e3cb3dc55a 100644
--- a/src/windows/installer/wix/lang/ui_1033.wxi
+++ b/src/windows/installer/wix/lang/ui_1033.wxi
@@ -450,8 +450,7 @@
         </Control>
         <Control Id="BannerBitmap" Type="Bitmap" X="0" Y="0" Width="374" Height="44" TabSkip="no" Text="[BannerBitmap]" />
         <Control Id="AgreementText" Type="ScrollableText" X="20" Y="60" Width="330" Height="120" Sunken="yes" TabSkip="no">
-          <Text><![CDATA[{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fmodern\fprq1\fcharset0 Courier New;}{\f1\froman\fprq2\fcharset0 Times New Roman;}}{\*\generator Msftedit 5.41.15.1503;}\viewkind4\uc1\pard\tx916\tx1832\tx2748\tx3664\tx4580\tx5496\tx6412\tx7328\tx8244\tx9160\tx10076\tx10992\tx11908\tx12824\tx13740\tx14656\f0\fs20 Copyright Notice and Legal Administrivia\par ----------------------------------------\par \par Copyright (C) 1985-2004 by the Massachusetts Institute of Technology.\par \par All rights reserved.\par \par Export of this software from the United States of America may require a specific license from the United States Government.  It is the responsibility of any person or organization contemplating export to obtain such a license before exporting.\par \par WITHIN THAT CONSTRAINT, permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and\par this permission notice appear in supporting documentation, and that the name of M.I.T. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.  Furthermore if you modify this software you must label your software as modified software and not distribute it in such a fashion that it might be confused with the original MIT software. M.I.T. makes no representations about the suitability of this software for any purpose.  It is provided "as is" without express or implied warranty.\par \par THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.\par \par Individual source code files are copyright MIT, Cygnus Support, OpenVision, Oracle, Sun Soft, FundsXpress, and others.\par \par Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira, and Zephyr are trademarks of the Massachusetts Institute of Technology (MIT).  No commercial use of these trademarks may be made without prior written permission of MIT.\par \par "Commercial use" means use of a name in a product or other for-profit manner.  It does NOT prevent a commercial firm from referring to the MIT trademarks in order to convey information (although in doing so, recognition of their trademark status should be given).\par \par ----\par \par The following copyright and permission notice applies to the OpenVision Kerberos Administration system located in kadmin/create, kadmin/dbutil, kadmin/passwd, kadmin/server, lib/kadm5, and portions of lib/rpc:\par \par Copyright, OpenVision Technologies, Inc., 1996, All Rights Reserved\par \par WARNING: Retrieving the OpenVision Kerberos Administration system source code, as described below, indicates your acceptance of the following terms.  If you do not agree to the following terms, do not retrieve the OpenVision Kerberos administration system.\par \par You may freely use and distribute the Source Code and Object Code compiled from it, with or without modification, but this Source Code is provided to you "AS IS" EXCLUSIVE OF ANY WARRANTY, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, OR ANY OTHER WARRANTY, WHETHER EXPRESS OR IMPLIED.  IN NO EVENT WILL OPENVISION HAVE ANY LIABILITY FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY OTHER REASON.\par \par OpenVision retains all copyrights in the donated Source Code. OpenVision also retains copyright to derivative works of the Source Code, whether created by OpenVision or by a third party. The OpenVision copyright notice must be preserved if derivative works are made based on the donated Source Code.\par \par OpenVision Technologies, Inc. has donated this Kerberos Administration system to MIT for inclusion in the standard Kerberos 5 distribution.  This donation underscores our commitment to continuing Kerberos technology development and our gratitude for the valuable work which has been performed by MIT and the Kerberos community.\par \par ----\par \par Portions contributed by Matt Crawford <crawdad@fnal.gov> were work performed at Fermi National Accelerator Laboratory, which is operated by Universities Research Association, Inc., under contract DE-AC02-76CHO3000 with the U.S. Department of Energy.\par \par ---- The implementation of the Yarrow pseudo-random number generator in src/lib/crypto/yarrow has the following copyright:\par \par Copyright 2000 by Zero-Knowledge Systems, Inc.\par \par Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Zero-Knowledge Systems, Inc. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.  Zero-Knowledge Systems, Inc. makes no representations about the suitability of this software for any purpose.  It is provided "as is" without express or implied warranty.\par \par ZERO-KNOWLEDGE SYSTEMS, INC. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL ZERO-KNOWLEDGE SYSTEMS, INC. BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\par ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTUOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\par \par ---- The implementation of the AES encryption algorithm in src/lib/crypto/aes has the following copyright:\par \par Copyright (c) 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.\par All rights reserved.\par \par LICENSE TERMS\par \par The free distribution and use of this software in both source and binary form is allowed (with or without changes) provided that:\par \par 1. distributions of this source code include the above copyright notice, this list of conditions and the following disclaimer;\par \par 2. distributions in binary form include the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other associated materials;\par \par 3. the copyright holder's name is not used to endorse products built using this software without specific written permission. \par \par DISCLAIMER\par \par This software is provided 'as is' with no explcit or implied warranties in respect of any properties, including, but not limited to, correctness and fitness for purpose.\par \par \par \par Acknowledgements\par ----------------\par \par Appreciation Time!!!!  There are far too many people to try to thank them all; many people have contributed to the development of Kerberos V5.  This is only a partial listing....\par \par Thanks to Paul Vixie and the Internet Software Consortium for funding the work of Barry Jaspan.  This funding was invaluable for the OV administration server integration, as well as the 1.0 release preparation process.\par \par Thanks to John Linn, Scott Foote, and all of the folks at OpenVision Technologies, Inc., who donated their administration server for use in the MIT release of Kerberos.\par \par Thanks to Jeff Bigler, Mark Eichin, Marc Horowitz, Nancy Gilman, Ken Raeburn, and all of the folks at Cygnus Support, who provided innumerable bug fixes and portability enhancements to the Kerberos V5 tree.  Thanks especially to Jeff Bigler, for the new user and system administrator's documentation.\par \par Thanks to Doug Engert from ANL for providing many bug fixes, as well as testing to ensure DCE interoperability.\par \par Thanks to Ken Hornstein at NRL for providing many bug fixes and suggestions, and for working on SAM preauthentication.\par \par Thanks to Matt Crawford at FNAL for bugfixes and enhancements.\par \par Thanks to Sean Mullan and Bill Sommerfeld from Hewlett Packard for their many suggestions and bug fixes.\par \par Thanks to Nalin Dahyabhai of RedHat and Chris Evans for locating and providing patches for numerous buffer overruns.\par \par Thanks to Christopher Thompson and Marcus Watts for discovering the ftpd security bug.\par \par Thanks to Paul Nelson of Thursby Software Systems for implementing the Microsoft set password protocol.\par \par Thanks to the members of the Kerberos V5 development team at MIT, both past and present: Danilo Almeida, Jeffrey Altman, Jay Berkenbilt, Richard Basch, Mitch Berger, John Carr, Don Davis, Alexandra Ellwood, Nancy Gilman, Matt Hancher, Sam Hartman, Paul Hill, Marc Horowitz, Eva Jacobus, Miroslav Jurisic, Barry Jaspan, Geoffrey King, John Kohl, Peter Litwack, Scott McGuire, Kevin Mitchell, Cliff Neuman, Paul Park, Ezra Peisach, Chris Provenzano, Ken Raeburn, Jon Rochlis, Jeff Schiller, Jen Selby, Brad Thompson, Harry Tsai, Ted Ts'o, Marshall Vale, Tom Yu.\par \pard\f1\fs24\par } ]]>
-          </Text>
+          <Text src=".\lang\license.rtf"/>
         </Control>
         <Control Id="BannerLine" Type="Line" X="0" Y="44" Width="374" Height="0" />
         <Control Id="BottomLine" Type="Line" X="0" Y="234" Width="374" Height="0" />
@@ -1169,6 +1168,7 @@
       <Error Id="4004">ABORT: [2]</Error>
       <Error Id="4005">Custom action failed. Phase [2]</Error>
       <Error Id="4006">Failed to determine running processes. Status [2]</Error>
+      <Error Id="4007">Failed to install Kerberos network provider.  Status [2]</Error>
       <AdminUISequence>
         <Show Dialog="FatalError" OnExit="error" />
         <Show Dialog="UserExit" OnExit="cancel" />
diff --git a/src/windows/installer/wix/property.wxi b/src/windows/installer/wix/property.wxi
index 545e8f5b56..f969d912bc 100644
--- a/src/windows/installer/wix/property.wxi
+++ b/src/windows/installer/wix/property.wxi
@@ -29,8 +29,8 @@
     <!-- Important:  This product should only be installed in all-user mode -->
     <Property Id="ALLUSERS">1</Property>
 
-    <Property Id="LEASHAUTOINIT">-autoinit</Property>
-    <Property Id="LEASHAUTOSTART">1</Property>
+    <Property Id="LEASHAUTOINIT" Admin="yes" Secure="yes">-autoinit</Property>
+    <Property Id="LEASHAUTOSTART" Admin="yes" Secure="yes">1</Property>
     
     <Property Id="ARPCOMMENTS">$(var.ARPComments)</Property>
     <Property Id="ARPCONTACT">kerberos@mit.edu</Property>
@@ -52,35 +52,43 @@
     <!--  Additional properties relating to the UI are in the appropriate UI.wxi file -->
     
     <!-- Configuration properties.  If these properties are defined, then
-         the corresponding component will be enabled. -->
+         the corresponding component will be enabled. If the corresponding
+         variable value is the empty string (""), then the properties will
+         not be defined. -->
 <?ifdef UseDefaultProperties?>
-    <Property Id="LEASHAFSSTATUS">$(var.LeashAfsStatus)</Property>
-    <Property Id="LEASHCREATEMISSINGCONFIG">$(var.LeashCreateMissingConfig)</Property>
-    <Property Id="LEASHAUTORENEWTICKETS">$(var.LeashAutoRenewTickets)</Property>
-    <Property Id="LEASHLOCKFILELOCATIONS">$(var.LeashLockFileLocations)</Property>
-    <Property Id="LEASHMSLSAIMPORT">$(var.LeashMsLsaImport)</Property>
-    <Property Id="LEASHLIFETIME">$(var.LeashLifetime)</Property>
-    <Property Id="LEASHRENEWTILL">$(var.LeashRenewTill)</Property>
-    <Property Id="LEASHRENEWABLE">$(var.LeashRenewable)</Property>
-    <Property Id="LEASHFORWARDABLE">$(var.LeashForwardable)</Property>
-    <Property Id="LEASHNOADDRESSES">$(var.LeashNoAddresses)</Property>
-    <Property Id="LEASHPROXIABLE">$(var.LeashProxiable)</Property>
-    <Property Id="LEASHPUBLICIP">$(var.LeashPublicIp)</Property>
-    <Property Id="LEASHUSEKRB4">$(var.LeashUseKrb4)</Property>
-    <Property Id="LEASHHIDEKINITOPTIONS">$(var.LeashHideKinitOptions)</Property>
-    <Property Id="LEASHLIFEMIN">$(var.LeashLifeMin)</Property>
-    <Property Id="LEASHLIFEMAX">$(var.LeashLifeMax)</Property>
-    <Property Id="LEASHRENEWMIN">$(var.LeashRenewMin)</Property>
-    <Property Id="LEASHRENEWMAX">$(var.LeashRenewMax)</Property>
-    <Property Id="LEASHUPPERCASEREALM">$(var.LeashUppercaseRealm)</Property>
-    <Property Id="LEASHTIMEHOST">$(var.LeashTimeHost)</Property>
-    <Property Id="LEASHPRESERVEKINITOPTIONS">$(var.LeashPreserveKinitOptions)</Property>
-    <Property Id="KRB4KRBREALMS">$(var.Krb4KrbRealms)</Property>
-    <Property Id="KRB4KRBCONF">$(var.Krb4KrbConf)</Property>
-    <Property Id="KRB4CONFIGDIR">$(var.Krb4ConfigDir)</Property>
-    <Property Id="KRB4TICKETFILE">$(var.Krb4TicketFile)</Property>
-    <Property Id="KRB5CONFIG">$(var.Krb5Config)</Property>
-    <Property Id="KRB5CCNAME">$(var.Krb5CcName)</Property>
-    <Property Id="KRB5PRESERVEIDENTITY">$(var.Krb5PreserveIdentity)</Property>
+    <Property Id="LEASHAFSSTATUS" Admin="yes" Secure="yes">$(var.LeashAfsStatus)</Property>
+    <Property Id="LEASHCREATEMISSINGCONFIG" Admin="yes" Secure="yes">$(var.LeashCreateMissingConfig)</Property>
+    <Property Id="LEASHAUTORENEWTICKETS" Admin="yes" Secure="yes">$(var.LeashAutoRenewTickets)</Property>
+    <Property Id="LEASHLOCKFILELOCATIONS" Admin="yes" Secure="yes">$(var.LeashLockFileLocations)</Property>
+    <Property Id="LEASHMSLSAIMPORT" Admin="yes" Secure="yes">$(var.LeashMsLsaImport)</Property>
+    <Property Id="LEASHLIFETIME" Admin="yes" Secure="yes">$(var.LeashLifetime)</Property>
+    <Property Id="LEASHRENEWTILL" Admin="yes" Secure="yes">$(var.LeashRenewTill)</Property>
+    <Property Id="LEASHRENEWABLE" Admin="yes" Secure="yes">$(var.LeashRenewable)</Property>
+    <Property Id="LEASHFORWARDABLE" Admin="yes" Secure="yes">$(var.LeashForwardable)</Property>
+    <Property Id="LEASHNOADDRESSES" Admin="yes" Secure="yes">$(var.LeashNoAddresses)</Property>
+    <Property Id="LEASHPROXIABLE" Admin="yes" Secure="yes">$(var.LeashProxiable)</Property>
+    <Property Id="LEASHPUBLICIP" Admin="yes" Secure="yes">$(var.LeashPublicIp)</Property>
+    <Property Id="LEASHUSEKRB4" Admin="yes" Secure="yes">$(var.LeashUseKrb4)</Property>
+    <Property Id="LEASHHIDEKINITOPTIONS" Admin="yes" Secure="yes">$(var.LeashHideKinitOptions)</Property>
+    <Property Id="LEASHLIFEMIN" Admin="yes" Secure="yes">$(var.LeashLifeMin)</Property>
+    <Property Id="LEASHLIFEMAX" Admin="yes" Secure="yes">$(var.LeashLifeMax)</Property>
+    <Property Id="LEASHRENEWMIN" Admin="yes" Secure="yes">$(var.LeashRenewMin)</Property>
+    <Property Id="LEASHRENEWMAX" Admin="yes" Secure="yes">$(var.LeashRenewMax)</Property>
+    <Property Id="LEASHUPPERCASEREALM" Admin="yes" Secure="yes">$(var.LeashUppercaseRealm)</Property>
+    <Property Id="LEASHTIMEHOST" Admin="yes" Secure="yes">$(var.LeashTimeHost)</Property>
+    <Property Id="LEASHPRESERVEKINITOPTIONS" Admin="yes" Secure="yes">$(var.LeashPreserveKinitOptions)</Property>
+    <Property Id="KRB4KRBREALMS" Admin="yes" Secure="yes">$(var.Krb4KrbRealms)</Property>
+    <Property Id="KRB4KRBCONF" Admin="yes" Secure="yes">$(var.Krb4KrbConf)</Property>
+    <Property Id="KRB4CONFIGDIR" Admin="yes" Secure="yes">$(var.Krb4ConfigDir)</Property>
+    <Property Id="KRB4TICKETFILE" Admin="yes" Secure="yes">$(var.Krb4TicketFile)</Property>
+    <Property Id="KRB5CONFIG" Admin="yes" Secure="yes">$(var.Krb5Config)</Property>
+    <Property Id="KRB5CCNAME" Admin="yes" Secure="yes">$(var.Krb5CcName)</Property>
+    <Property Id="KRB5PRESERVEIDENTITY" Admin="yes" Secure="yes">$(var.Krb5PreserveIdentity)</Property>
+<?endif?>
+<?ifdef UseLeash?>
+    <Property Id="USELEASH" Admin="yes" Secure="yes">$(var.UseLeash)</Property>
+<?endif?>
+<?ifdef UseNetIDMgr?>
+    <Property Id="USENETIDMGR" Admin="yes" Secure="yes">$(var.UseNetIDMgr)</Property>
 <?endif?>
 </Include>
\ No newline at end of file