Partial merge from Novell LDAP integration branch, not including the

actual LDAP bits:

* include/kdb.h (krb5_db_entry_new): Add MASK field indicating what's
changed.
(KRB5_KDB_SRV_TYPE_*): New macros indicating which type of service is
accessing the database.
* lib/kadm5/srv/svr_principal.c: Set mask field.
* lib/kadm5/srv/server_misc.c, server_init.c: Pass service type to
krb5_db_open.
* kadmin/dbutil/kdb5_stash.c (kdb5_stash): Pass service type to
krb5_db_open.
* kadmin/dbutil/kdb5_util.c (open_db_and_mkey): Pass service type to
krb5_db_open.
* kdc/main.c (init_realm): Pass service type to krb5_db_open.
* lib/kadm5/srv/svr_principal.c: Set mask field.
* kadmin/dbutil/dump.c (load_db): Pass service type to krb5_db_open.
* lib/kdb/kdb5.h (KRB5_KDB_SRV_TYPE_*): New macros.

* lib/kdb/err_handle.{c,h}: Deleted.
* lib/kadm5/clnt/err_handle.{c,h}: Deleted.
(krb5_db_clr_error): Declaration deleted.
* lib/kdb/Makefile.in, lib/kadm5/clnt/Makefile.in: Don't build them.
* lib/kdb/kdb5.c, lib/kadm5/clnt, lib/kadm5/srv: Use new error-message API.
* kdc/do_tgs_req.c (process_tgs_req): Use new error-message API.
* kdc/kdc_preauth.c (check_padata)
* kdc/do_as_req.c (process_as_req):
* kdc/main.c (init_realm):
* kadmin/server/ovsec_kadmd.c (main, do_schpw):
* schpw.c (process_chpw_request):
* kadmin/server/server_stubs.c:
* kadmin/cli/kadmin.c (extended_com_err_fn): New function.
(kadmin_startup): Tell com_err library to use it, for kadmin.local.
* lib/kdb/libkdb5.exports: Don't export krb5_db_clr_error.
* lib/kdb/Makefile.in: (SRCS, STLIBOBJS): Don't build err_handle.c.
* lib/kdb/kdb5.c (kdb_load_library): Don't pass argument to init_library.
(krb5_db_clr_error): Function deleted.
* lib/kdb/kdb5.h (struct _kdb_vftabl): Remove argument from init_library field.
* lib/kadm5/logger.c (krb5_klog_init): Save the krb5_context pointer.
(klog_com_err_proc): Use it, and call new error-message API.
* lib/kadm5/srv/svr_principal.c: Use new error-message API.
* kadmin/dbutil/kdb5_util.c (extended_com_err_fn): New function.
(main): Tell com_err library to use it.

* plugins/kdb/db2: Use new error-message APIs and updated DAL
interface.

* lib/kadm5/kadm_rpc.h: Delete err_str fields.
* lib/kadm5/kadm_rpc_xdr.c: Don't process them.
* kadmin/server/server_stubs.c: Don't use ret.err_str field.

* include/k5-thread.h (k5_key_t): Deleted unused values.

* lib/kdb/kdb5.h (KDB_MODULE_SECTION): Change db_modules to dbmodules.
(KDB_MODULE_DEF_SECTION): New macro.
* tests/Makefile.in (krb5.conf): Rename db_modules to dbmodules.
* tests/dejagnu/config/default.exp (setup_krb5_conf): Likewise.
* kadmin/testing/proto/krb5.conf.proto: Likewise.

* lib/kdb/libkdb5.exports: Do export krb5_def_store_mkey.

* lib/kadm5/admin.h (KADM5_CPW_FUNCTION, KADM5_RANDKEY_USED): New macros.
(struct _kadm5_config_params): New field kpasswd_server.

* lib/krb5/error_tables/kdb5_err.et (KRB5_KDB_SERVER_INTERNAL_ERR):
New error code.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17899 dc483132-0cff-0310-8789-dd5450dbe970

3 files changed, 121 insertions, 399 deletions

diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c
index 9acb95d1b..6950ff1a7 100644
--- a/src/kadmin/server/ovsec_kadmd.c
+++ b/src/kadmin/server/ovsec_kadmd.c
@@ -216,6 +216,7 @@ int main(int argc, char *argv[])
      kadm5_config_params params;
      char **db_args      = NULL;
      int    db_args_size = 0;
+     char *errmsg;
 
      setvbuf(stderr, NULL, _IONBF, 0);
 
@@ -305,7 +306,7 @@ int main(int argc, char *argv[])
           ret = krb5_c_random_os_entropy(context, 1, NULL);
 	  if(ret) {
 	    krb5_klog_syslog(LOG_ERR, "Error getting random seed: %s, aborting",
-			     error_message(ret));
+			     krb5_get_error_message (context, ret));
 	    exit(1);
 	  }
 	  
@@ -314,9 +315,8 @@ int main(int argc, char *argv[])
 			  KADM5_STRUCT_VERSION,
 			  KADM5_API_VERSION_2,
 			  db_args,
-			  &global_server_handle)) != 
-	KADM5_OK) {
-	 const char *e_txt = error_message(ret);
+		     &global_server_handle)) != KADM5_OK) {
+	  const char *e_txt = krb5_get_error_message (context, ret);
 	  krb5_klog_syslog(LOG_ERR, "%s while initializing, aborting",
 		 e_txt);
 	  fprintf(stderr, "%s: %s while initializing, aborting\n",
@@ -332,7 +332,7 @@ int main(int argc, char *argv[])
      
      if ((ret = kadm5_get_config_params(context, NULL, NULL, &params,
 					&params))) {
-	 const char *e_txt = error_message(ret);
+	  const char *e_txt = krb5_get_error_message (context, ret);
 	  krb5_klog_syslog(LOG_ERR, "%s: %s while initializing, aborting",
 			   whoami, e_txt);
 	  fprintf(stderr, "%s: %s while initializing, aborting\n",
@@ -362,7 +362,7 @@ int main(int argc, char *argv[])
      addr.sin_port = htons(params.kadmind_port);
 
      if ((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
-	 const char *e_txt = error_message(errno);
+	  const char *e_txt = krb5_get_error_message (context, ret);
 	  krb5_klog_syslog(LOG_ERR, "Cannot create TCP socket: %s",
 			   e_txt);
 	  fprintf(stderr, "Cannot create TCP socket: %s",
@@ -373,10 +373,10 @@ int main(int argc, char *argv[])
      }
 
      if ((schpw = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
-	 const char *e_txt = error_message(errno);
+	 const char *e_txt = krb5_get_error_message (context, ret);
 	 krb5_klog_syslog(LOG_ERR,
-			   "cannot create simple chpw socket: %s",
-			   e_txt);
+			  "cannot create simple chpw socket: %s",
+			  e_txt);
 	 fprintf(stderr, "Cannot create simple chpw socket: %s",
 		 e_txt);
 	 kadm5_destroy(global_server_handle);
@@ -402,18 +402,17 @@ int main(int argc, char *argv[])
 			SO_REUSEADDR,
 			(char *) &allowed,
 			sizeof(allowed)) < 0) {
-	     const char *e_txt = error_message(errno);
+	     const char *e_txt = krb5_get_error_message (context, ret);
 	     krb5_klog_syslog(LOG_ERR, "Cannot set SO_REUSEADDR: %s",
 			      e_txt);
-	     fprintf(stderr, "Cannot set SO_REUSEADDR: %s",
-		     e_txt);
+	     fprintf(stderr, "Cannot set SO_REUSEADDR: %s", e_txt);
 	     kadm5_destroy(global_server_handle);
 	     krb5_klog_close(context);	  
 	     exit(1);
 	 }
 	 if (setsockopt(schpw, SOL_SOCKET, SO_REUSEADDR,
 			(char *) &allowed, sizeof(allowed)) < 0) {
-	     const char *e_txt = error_message(errno);
+	     const char *e_txt = krb5_get_error_message (context, ret);
 	     krb5_klog_syslog(LOG_ERR, "main",
 			      "cannot set SO_REUSEADDR on simple chpw socket: %s", 
 			      e_txt);
@@ -433,12 +432,11 @@ int main(int argc, char *argv[])
 
      if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
 	  int oerrno = errno;
-	  const char *e_txt = error_message(errno);
+	  const char *e_txt = krb5_get_error_message (context, errno);
 	  fprintf(stderr, "%s: Cannot bind socket.\n", whoami);
 	  fprintf(stderr, "bind: %s\n", e_txt);
 	  errno = oerrno;
-	  krb5_klog_syslog(LOG_ERR, "Cannot bind socket: %s",
-			   e_txt);
+	  krb5_klog_syslog(LOG_ERR, "Cannot bind socket: %s", e_txt);
 	  if(oerrno == EADDRINUSE) {
 	       char *w = strrchr(whoami, '/');
 	       if (w) {
@@ -474,7 +472,7 @@ int main(int argc, char *argv[])
      if (bind(schpw, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
 	  char portbuf[32];
 	  int oerrno = errno;
-	  const char *e_txt = error_message(errno);
+	  const char *e_txt = krb5_get_error_message (context, errno);
 	  fprintf(stderr, "%s: Cannot bind socket.\n", whoami);
 	  fprintf(stderr, "bind: %s\n", e_txt);
 	  errno = oerrno;
@@ -566,7 +564,7 @@ int main(int argc, char *argv[])
      }
 kterr:
      if (ret) {
-	  krb5_klog_syslog(LOG_ERR, "%s", error_message(ret));
+	  krb5_klog_syslog(LOG_ERR, "%s", krb5_get_error_message (context, ret));
 	  fprintf(stderr, "%s: Can't set up keytab for RPC.\n", whoami);
 	  kadm5_destroy(global_server_handle);
 	  krb5_klog_close(context);
@@ -618,10 +616,11 @@ kterr:
      }
 
      if ((ret = kadm5int_acl_init(context, 0, params.acl_file))) {
+	  errmsg = krb5_get_error_message (context, ret);
 	  krb5_klog_syslog(LOG_ERR, "Cannot initialize acl file: %s",
-		 error_message(ret));
+		 errmsg);
 	  fprintf(stderr, "%s: Cannot initialize acl file: %s\n",
-		  whoami, error_message(ret));
+		  whoami, errmsg);
 	  svcauth_gssapi_unset_names();
 	  kadm5_destroy(global_server_handle);
 	  krb5_klog_close(context);
@@ -630,9 +629,10 @@ kterr:
 
      if (!nofork && (ret = daemon(0, 0))) {
 	  ret = errno;
-	  krb5_klog_syslog(LOG_ERR, "Cannot detach from tty: %s", error_message(ret));
+	  errmsg = krb5_get_error_message (context, ret);
+	  krb5_klog_syslog(LOG_ERR, "Cannot detach from tty: %s", errmsg);
 	  fprintf(stderr, "%s: Cannot detach from tty: %s\n",
-		  whoami, error_message(ret));
+		  whoami, errmsg);
 	  svcauth_gssapi_unset_names();
 	  kadm5_destroy(global_server_handle);
 	  krb5_klog_close(context);
@@ -851,7 +851,7 @@ void reset_db(void)
      if (ret = kadm5_flush(global_server_handle)) {
 	  krb5_klog_syslog(LOG_ERR, "FATAL ERROR!  %s while flushing databases.  "
 		 "Databases may be corrupt!  Aborting.",
-		 error_message(ret));
+		 krb5_get_error_message (context, ret));
 	  krb5_klog_close(context);
 	  exit(3);
      }
@@ -1134,13 +1134,13 @@ void do_schpw(int s1, kadm5_config_params *params)
     if ((len = recvfrom(s1, req, sizeof(req), 0, (struct sockaddr *)&from,
 			&fromlen)) < 0) {
 	krb5_klog_syslog(LOG_ERR, "chpw: Couldn't receive request: %s",
-			 error_message(errno));
+			 krb5_get_error_message (context, errno));
 	return;
     }
 
     if ((ret = krb5_kt_resolve(context, "KDB:", &kt))) {
 	krb5_klog_syslog(LOG_ERR, "chpw: Couldn't open admin keytab %s",
-			 error_message(ret));
+			 krb5_get_error_message (context, ret));
 	return;
     }
 
@@ -1164,10 +1164,11 @@ void do_schpw(int s1, kadm5_config_params *params)
        interoperate if the client is single-homed. */
 
     if ((s2 = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+	char *errmsg = krb5_get_error_message (context, errno);
 	krb5_klog_syslog(LOG_ERR, "cannot create connecting socket: %s",
-			 error_message(errno));
+			 errmsg);
 	fprintf(stderr, "Cannot create connecting socket: %s",
-		error_message(errno));
+		errmsg);
 	svcauth_gssapi_unset_names();
 	kadm5_destroy(global_server_handle);
 	krb5_klog_close(context);	  
@@ -1176,7 +1177,7 @@ void do_schpw(int s1, kadm5_config_params *params)
 
     if (connect(s2, (struct sockaddr *) &from, sizeof(from)) < 0) {
 	krb5_klog_syslog(LOG_ERR, "chpw: Couldn't connect to client: %s",
-			 error_message(errno));
+			 krb5_get_error_message (context, errno));
 	goto cleanup;
     }
 
@@ -1184,7 +1185,7 @@ void do_schpw(int s1, kadm5_config_params *params)
 				    params->realm, s2, kt, &from,
 				    &reqdata, &repdata))) {
 	krb5_klog_syslog(LOG_ERR, "chpw: Error processing request: %s", 
-			 error_message(ret));
+			 krb5_get_error_message (context, ret));
     }
 
     close(s2);
@@ -1201,7 +1202,7 @@ void do_schpw(int s1, kadm5_config_params *params)
 	krb5_xfree(repdata.data);
 
 	krb5_klog_syslog(LOG_ERR, "chpw: Error sending reply: %s", 
-			 error_message(errno));
+			 krb5_get_error_message (context, errno));
 	goto cleanup;
     }
 
@@ -1212,4 +1213,3 @@ cleanup:
 
     return;
 }
-
diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 28cf75c2f..b30c2d536 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -260,7 +260,7 @@ process_chpw_request(context, server_handle, realm, s, keytab, sockin,
 
     krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %s: %s",
 		     inet_ntoa(((struct sockaddr_in *)&remote_addr)->sin_addr),
-		     clientstr, ret ? error_message(ret) : "success");
+		     clientstr, ret ? krb5_get_error_message (context, ret) : "success");
     krb5_free_unparsed_name(context, clientstr);
 
     if (ret) {
diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
index c26ed697b..ee5d653cd 100644
--- a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -246,6 +246,7 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
     restriction_t		*rp;
+    char			*errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -282,17 +283,15 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
 						&arg->rec, arg->mask,
 						arg->passwd);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-		prime_arg, ret.err_str,
+		prime_arg, errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
@@ -301,17 +300,6 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &service_name);
 
  exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -324,6 +312,7 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
     restriction_t		*rp;
+    char                        *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -362,17 +351,15 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
 					     arg->ks_tuple,
 					     arg->passwd);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-		prime_arg, ret.err_str, 
+		prime_arg, errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
@@ -380,17 +367,6 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -403,6 +379,7 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -435,17 +412,15 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
     } else {
 	 ret.code = kadm5_delete_principal((void *)handle, arg->princ);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal", prime_arg, 
-                ret.err_str,
-		client_name.value, service_name.value,
-		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
+	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal",
+			  prime_arg, errmsg,
+			  client_name.value, service_name.value,
+			  inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free(prime_arg);
@@ -453,17 +428,6 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
  exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
 
     return &ret;
 }
@@ -478,6 +442,7 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
     restriction_t		    *rp;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -511,17 +476,15 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_modify_principal((void *)handle, &arg->rec,
 						arg->mask);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_principal",
- 	        prime_arg, ret.err_str,
-		client_name.value, service_name.value,
-		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
+			  prime_arg, errmsg,
+			  client_name.value, service_name.value,
+			  inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
 	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
@@ -529,17 +492,6 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -555,6 +507,7 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
     restriction_t		*rp;
+    char                        *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -600,18 +553,14 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_rename_principal((void *)handle, arg->src,
 						arg->dest);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_rename_principal",
-		prime_arg, ret.err_str,
+		prime_arg, errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg1);
@@ -619,17 +568,6 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -643,6 +581,7 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_gprinc_ret, &ret);
 
@@ -693,36 +632,22 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
 	 }
 	 
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
 		prime_arg,  
-		ret.err_str,
+		errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -735,6 +660,7 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_gprincs_ret, &ret);
 
@@ -770,35 +696,21 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
 					       arg->exp, &ret.princs,
 					       &ret.count);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_principals",
 		prime_arg,  
-		ret.err_str,
+		errmsg,
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -811,6 +723,7 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -850,18 +763,14 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 
-	       prime_arg, ret.err_str,
+	       prime_arg, errmsg,
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -869,17 +778,6 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -892,6 +790,7 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -937,18 +836,14 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	     errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -956,17 +851,6 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -979,6 +863,7 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1015,18 +900,14 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_SETKEY) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	     errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setv4key_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -1034,17 +915,6 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1057,6 +927,7 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1093,18 +964,14 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_SETKEY) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -1112,17 +979,6 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1135,6 +991,7 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1174,18 +1031,14 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_SETKEY) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
 
     free_server_handle(handle);
@@ -1193,17 +1046,6 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1218,6 +1060,7 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
 	    			service_name;
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
+    char                        *errmsg;
 
     xdr_free(xdr_chrand_ret, &ret);
 
@@ -1272,35 +1115,20 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	/* xdr free frees this string. so make a copy */
-	ret.err_str = strdup( ret.err_str ); 
-	/* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1315,6 +1143,7 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
 	    			service_name;
     OM_uint32			minor_stat;
     kadm5_server_handle_t	handle;
+    char                        *errmsg;
 
     xdr_free(xdr_chrand_ret, &ret);
 
@@ -1374,35 +1203,20 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 	if( ret.code == 0 )
-	    ret.err_str = "success";
+	    errmsg = "success";
 	else
-	    ret.err_str = error_message(ret.code);
+	    errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-	       prime_arg, ret.err_str, 
+	       prime_arg, errmsg, 
 	       client_name.value, service_name.value,
 	       inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     free(prime_arg);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1415,6 +1229,7 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;    
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1446,35 +1261,20 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_create_policy((void *)handle, &arg->rec,
 					     arg->mask);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	 
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1487,6 +1287,7 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;    
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1516,35 +1317,20 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
     } else {
 	 ret.code = kadm5_delete_policy((void *)handle, arg->name);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	 
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1557,6 +1343,7 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;    
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_generic_ret, &ret);
 
@@ -1587,35 +1374,20 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_modify_policy((void *)handle, &arg->rec,
 					     arg->mask);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),	    
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1631,6 +1403,7 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
     kadm5_policy_ent_t	e;
     kadm5_principal_ent_rec	caller_ent;
     kadm5_server_handle_t	handle;
+    char                        *errmsg;
 
     xdr_free(xdr_gpol_ret,  &ret);
 
@@ -1687,19 +1460,15 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
 	 }
 	 
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
 		((prime_arg == NULL) ? "(null)" : prime_arg),
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));	 
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     } else {
 	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
 		prime_arg, client_name.value, service_name.value,
@@ -1709,17 +1478,6 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 
 }
@@ -1733,6 +1491,7 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
 				    service_name;
     OM_uint32			    minor_stat;
     kadm5_server_handle_t	    handle;
+    char                            *errmsg;
 
     xdr_free(xdr_gpols_ret, &ret);
 
@@ -1766,35 +1525,20 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
 					       arg->exp, &ret.pols,
 					       &ret.count);
 	 if( ret.code == 0 )
-	     ret.err_str = "success";
+	     errmsg = "success";
 	 else
-	     ret.err_str = error_message(ret.code);
+	     errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
 	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_policies",
 		prime_arg,  
-		ret.err_str, 
+		errmsg, 
 		client_name.value, service_name.value,
 		inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
     }
     free_server_handle(handle);
     gss_release_buffer(&minor_stat, &client_name);
     gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
     return &ret;
 }
 
@@ -1804,6 +1548,7 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
      gss_buffer_desc		    client_name, service_name;
      OM_uint32			    minor_stat;
      kadm5_server_handle_t	    handle;
+     char                           *errmsg;
 
      xdr_free(xdr_getprivs_ret, &ret);
 
@@ -1824,35 +1569,20 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 
      ret.code = kadm5_get_privs((void *)handle, &ret.privs);
      if( ret.code == 0 )
-	 ret.err_str = "success";
+	 errmsg = "success";
      else
-	 ret.err_str = error_message(ret.code);
+	 errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
 
      krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_privs",
 	    client_name.value, 
-	    ret.err_str, 
+	    errmsg, 
 	    client_name.value, service_name.value,
 	    inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
 
-     /* xdr free frees this string. so make a copy */
-     ret.err_str = strdup( ret.err_str ); 
-     /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-
      free_server_handle(handle);
      gss_release_buffer(&minor_stat, &client_name);
      gss_release_buffer(&minor_stat, &service_name);
 exit_func:
-    if( ret.err_str == NULL )
-    {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-    }
      return &ret;
 }
 
@@ -1863,6 +1593,7 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 	 			service_name;
      kadm5_server_handle_t	handle;
      OM_uint32			minor_stat;
+     char                       *errmsg = 0;
 
      xdr_free(xdr_generic_ret, &ret);
 
@@ -1879,11 +1610,13 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 	  goto exit_func;
      }
 
+     if (ret.code != 0)
+	 errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
      krb5_klog_syslog(LOG_NOTICE, LOG_DONE ", flavor=%d",
 	    (ret.api_version == KADM5_API_VERSION_1 ?
 	     "kadm5_init (V1)" : "kadm5_init"),
 	    client_name.value,
-	    (ret.code == 0) ? "success" : error_message(ret.code),
+	    (ret.code == 0) ? "success" : errmsg,
 	    client_name.value, service_name.value,
 	    inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr),
 	    rqstp->rq_cred.oa_flavor);
@@ -1891,17 +1624,6 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
      gss_release_buffer(&minor_stat, &service_name);
 	    
 exit_func:
-     if( ret.err_str == NULL )
-     {
-	 if( ret.code == 0 )
-	     ret.err_str = "success";
-	 else
-	     ret.err_str = error_message(ret.code);
-
-	 /* xdr free frees this string. so make a copy */
-	 ret.err_str = strdup( ret.err_str ); 
-	 /* no need to check for NULL. Even if it is NULL, atleast error_code will be returned */
-     }
      return(&ret);
 }