Partial merge from Novell LDAP integration branch, not including the

actual LDAP bits:

* include/kdb.h (krb5_db_entry_new): Add MASK field indicating what's
changed.
(KRB5_KDB_SRV_TYPE_*): New macros indicating which type of service is
accessing the database.
* lib/kadm5/srv/svr_principal.c: Set mask field.
* lib/kadm5/srv/server_misc.c, server_init.c: Pass service type to
krb5_db_open.
* kadmin/dbutil/kdb5_stash.c (kdb5_stash): Pass service type to
krb5_db_open.
* kadmin/dbutil/kdb5_util.c (open_db_and_mkey): Pass service type to
krb5_db_open.
* kdc/main.c (init_realm): Pass service type to krb5_db_open.
* lib/kadm5/srv/svr_principal.c: Set mask field.
* kadmin/dbutil/dump.c (load_db): Pass service type to krb5_db_open.
* lib/kdb/kdb5.h (KRB5_KDB_SRV_TYPE_*): New macros.

* lib/kdb/err_handle.{c,h}: Deleted.
* lib/kadm5/clnt/err_handle.{c,h}: Deleted.
(krb5_db_clr_error): Declaration deleted.
* lib/kdb/Makefile.in, lib/kadm5/clnt/Makefile.in: Don't build them.
* lib/kdb/kdb5.c, lib/kadm5/clnt, lib/kadm5/srv: Use new error-message API.
* kdc/do_tgs_req.c (process_tgs_req): Use new error-message API.
* kdc/kdc_preauth.c (check_padata)
* kdc/do_as_req.c (process_as_req):
* kdc/main.c (init_realm):
* kadmin/server/ovsec_kadmd.c (main, do_schpw):
* schpw.c (process_chpw_request):
* kadmin/server/server_stubs.c:
* kadmin/cli/kadmin.c (extended_com_err_fn): New function.
(kadmin_startup): Tell com_err library to use it, for kadmin.local.
* lib/kdb/libkdb5.exports: Don't export krb5_db_clr_error.
* lib/kdb/Makefile.in: (SRCS, STLIBOBJS): Don't build err_handle.c.
* lib/kdb/kdb5.c (kdb_load_library): Don't pass argument to init_library.
(krb5_db_clr_error): Function deleted.
* lib/kdb/kdb5.h (struct _kdb_vftabl): Remove argument from init_library field.
* lib/kadm5/logger.c (krb5_klog_init): Save the krb5_context pointer.
(klog_com_err_proc): Use it, and call new error-message API.
* lib/kadm5/srv/svr_principal.c: Use new error-message API.
* kadmin/dbutil/kdb5_util.c (extended_com_err_fn): New function.
(main): Tell com_err library to use it.

* plugins/kdb/db2: Use new error-message APIs and updated DAL
interface.

* lib/kadm5/kadm_rpc.h: Delete err_str fields.
* lib/kadm5/kadm_rpc_xdr.c: Don't process them.
* kadmin/server/server_stubs.c: Don't use ret.err_str field.

* include/k5-thread.h (k5_key_t): Deleted unused values.

* lib/kdb/kdb5.h (KDB_MODULE_SECTION): Change db_modules to dbmodules.
(KDB_MODULE_DEF_SECTION): New macro.
* tests/Makefile.in (krb5.conf): Rename db_modules to dbmodules.
* tests/dejagnu/config/default.exp (setup_krb5_conf): Likewise.
* kadmin/testing/proto/krb5.conf.proto: Likewise.

* lib/kdb/libkdb5.exports: Do export krb5_def_store_mkey.

* lib/kadm5/admin.h (KADM5_CPW_FUNCTION, KADM5_RANDKEY_USED): New macros.
(struct _kadm5_config_params): New field kpasswd_server.

* lib/krb5/error_tables/kdb5_err.et (KRB5_KDB_SERVER_INTERNAL_ERR):
New error code.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17899 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 89 insertions, 367 deletions

diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
index c26ed697b..ee5d653cd 100644
--- a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -246,6 +246,7 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
     restriction_t		*rp;
+    char			*errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -282,17 +283,15 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
 						&arg->rec, arg->mask,
 						arg->passwd);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-		prime_arg, ret.err_str,
+		prime_arg, errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
@@ -301,17 +300,6 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &service_name);
 
  exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -324,6 +312,7 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
     restriction_t		*rp;
+    char                        *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -362,17 +351,15 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
 					     arg->ks_tuple,
 					     arg->passwd);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-		prime_arg, ret.err_str, 
+		prime_arg, errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
@@ -380,17 +367,6 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -403,6 +379,7 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -435,17 +412,15 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
     } else {
 	 ret.code = kadm5_delete_principal((void *)handle, arg->princ);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal", prime_arg, 
-                ret.err_str,
-		client_name.value, service_name.value,
-		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
+	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal",
+			  prime_arg, errmsg,
+			  client_name.value, service_name.value,
+			  inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free(prime_arg);
@@ -453,17 +428,6 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
  exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
 
     return &ret;
 }
@@ -478,6 +442,7 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
     restriction_t		    *rp;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -511,17 +476,15 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_modify_principal((void *)handle, &arg->rec,
 						arg->mask);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_principal",
- 	        prime_arg, ret.err_str,
-		client_name.value, service_name.value,
-		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
+			  prime_arg, errmsg,
+			  client_name.value, service_name.value,
+			  inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
@@ -529,17 +492,6 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -555,6 +507,7 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
     restriction_t		*rp;
+    char                        *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -600,18 +553,14 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_rename_principal((void *)handle, arg->src,
 						arg->dest);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_rename_principal",
-		prime_arg, ret.err_str,
+		prime_arg, errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg1);
@@ -619,17 +568,6 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -643,6 +581,7 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_gprinc_ret, &ret);
 
@@ -693,36 +632,22 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
 	 }
 	 
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
 		prime_arg,  
-		ret.err_str,
+		errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -735,6 +660,7 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_gprincs_ret, &ret);
 
@@ -770,35 +696,21 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
 					       arg->exp, &ret.princs,
 					       &ret.count);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_principals",
 		prime_arg,  
-		ret.err_str,
+		errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -811,6 +723,7 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -850,18 +763,14 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 
-	       prime_arg, ret.err_str,
+	       prime_arg, errmsg,
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -869,17 +778,6 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -892,6 +790,7 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -937,18 +836,14 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	     errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -956,17 +851,6 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -979,6 +863,7 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1015,18 +900,14 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_SETKEY) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	     errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setv4key_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -1034,17 +915,6 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1057,6 +927,7 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1093,18 +964,14 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_SETKEY) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -1112,17 +979,6 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1135,6 +991,7 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1174,18 +1031,14 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_SETKEY) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -1193,17 +1046,6 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1218,6 +1060,7 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
 	    			service_name;
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
+    char                        *errmsg;
 
     xdr_free(xdr_chrand_ret, &ret);
 
@@ -1272,35 +1115,20 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1315,6 +1143,7 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
 	    			service_name;
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
+    char                        *errmsg;
 
     xdr_free(xdr_chrand_ret, &ret);
 
@@ -1374,35 +1203,20 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1415,6 +1229,7 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;    
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1446,35 +1261,20 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_create_policy((void *)handle, &arg->rec,
 					     arg->mask);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	 
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1487,6 +1287,7 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;    
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1516,35 +1317,20 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
     } else {
 	 ret.code = kadm5_delete_policy((void *)handle, arg->name);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	 
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1557,6 +1343,7 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;    
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1587,35 +1374,20 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_modify_policy((void *)handle, &arg->rec,
 					     arg->mask);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),	    
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1631,6 +1403,7 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
     kadm5_policy_ent_t	e;
     kadm5_principal_ent_rec	caller_ent;
     kadm5_server_handle_t	handle;
+    char                        *errmsg;
 
     xdr_free(xdr_gpol_ret,  &ret);
 
@@ -1687,19 +1460,15 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
 	 }
 	 
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
 		((prime_arg == NULL) ? "(null)" : prime_arg),
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	 
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     } else {
 	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
 		prime_arg, client_name.value, service_name.value,
@@ -1709,17 +1478,6 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 
 }
@@ -1733,6 +1491,7 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_gpols_ret, &ret);
 
@@ -1766,35 +1525,20 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
 					       arg->exp, &ret.pols,
 					       &ret.count);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_policies",
 		prime_arg,  
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1804,6 +1548,7 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
      gss_buffer_desc		    client_name, service_name;
      OM_uint32			    minor_stat;
      kadm5_server_handle_t	    handle;
+     char                           *errmsg;
 
      xdr_free(xdr_getprivs_ret, &ret);
 
@@ -1824,35 +1569,20 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 
      ret.code = kadm5_get_privs((void *)handle, &ret.privs);
      if( ret.code == 0 )
-	 ret.err_str = "success";
+	 errmsg = "success";
      else
-	 ret.err_str = error_message(ret.code);
+	 errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
      krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_privs",
 	    client_name.value, 
-	    ret.err_str, 
+	    errmsg, 
 	    client_name.value, service_name.value,
 	    inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-     /* xdr free frees this string. so make a copy */
-     ret.err_str = strdup( ret.err_str ); 
-     /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-
      free_server_handle(handle);
      gss_release_buffer(&minor_stat, &client_name);
      gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
      return &ret;
 }
 
@@ -1863,6 +1593,7 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 	 			service_name;
      kadm5_server_handle_t	handle;
      OM_uint32			minor_stat;
+     char                       *errmsg = 0;
 
      xdr_free(xdr_generic_ret, &ret);
 
@@ -1879,11 +1610,13 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 	  goto exit_func;
      }
 
+     if (ret.code != 0)
+	 errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
      krb5_klog_syslog(LOG_NOTICE, LOG_DONE ", flavor=%d",
 	    (ret.api_version == KADM5_API_VERSION_1 ?
 	     "kadm5_init (V1)" : "kadm5_init"),
 	    client_name.value,
-	    (ret.code == 0) ? "success" : error_message(ret.code),
+	    (ret.code == 0) ? "success" : errmsg,
 	    client_name.value, service_name.value,
 	    inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr),
 	    rqstp->rq_cred.oa_flavor);
@@ -1891,17 +1624,6 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
      gss_release_buffer(&minor_stat, &service_name);
 	    
 exit_func:
-     if( ret.err_str == NULL )
-     {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-     }
      return(&ret);
 }