Use k5_setmsg

Replace most calls to krb5_set_error_message with k5_setmsg for
brevity.  Leave alone plugin sources where we don't include k5-int.h
(mostly PKINIT).

13 files changed, 101 insertions, 129 deletions

diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
index b0cd2a5e9..b2c449f5b 100644
--- a/src/plugins/kdb/db2/kdb_db2.c
+++ b/src/plugins/kdb/db2/kdb_db2.c
@@ -230,9 +230,9 @@ configure_context(krb5_context context, char *conf_section, char **db_args)
             dbc->hashfirst = TRUE;
         } else {
             status = EINVAL;
-            krb5_set_error_message(context, status,
-                                   _("Unsupported argument \"%s\" for db2"),
-                                   opt ? opt : val);
+            k5_setmsg(context, status,
+                      _("Unsupported argument \"%s\" for db2"),
+                      opt ? opt : val);
             goto cleanup;
         }
     }
@@ -813,9 +813,8 @@ krb5_db2_put_principal(krb5_context context, krb5_db_entry *entry,
     krb5_clear_error_message (context);
     if (db_args) {
         /* DB2 does not support db_args DB arguments for principal */
-        krb5_set_error_message(context, EINVAL,
-                               _("Unsupported argument \"%s\" for db2"),
-                               db_args[0]);
+        k5_setmsg(context, EINVAL, _("Unsupported argument \"%s\" for db2"),
+                  db_args[0]);
         return EINVAL;
     }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
index 4e0a9e8d7..8284f814f 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
@@ -215,10 +215,10 @@ has_sasl_external_mech(krb5_context context, char *ldap_server)
                           "supportedSASLMechanisms", "EXTERNAL");
     switch (ret) {
     case 1: /* not supported */
-        krb5_set_error_message(context, 1, "%s", ERR_MSG2);
+        k5_setmsg(context, 1, "%s", ERR_MSG2);
         break;
     case 2: /* don't know */
-        krb5_set_error_message(context, 1, "%s", ERR_MSG1);
+        k5_setmsg(context, 1, "%s", ERR_MSG1);
         break;
     default:
         break;
@@ -298,7 +298,7 @@ int
 set_ldap_error(krb5_context ctx, int st, int op)
 {
     int translated_st = translate_ldap_error(st, op);
-    krb5_set_error_message(ctx, translated_st, "%s", ldap_err2string(st));
+    k5_setmsg(ctx, translated_st, "%s", ldap_err2string(st));
     return translated_st;
 }
 
@@ -309,7 +309,7 @@ prepend_err_str(krb5_context ctx, const char *str, krb5_error_code err,
     const char *omsg;
 
     omsg = krb5_get_error_message(ctx, oerr);
-    krb5_set_error_message(ctx, err, "%s %s", str, omsg);
+    k5_setmsg(ctx, err, "%s %s", str, omsg);
     krb5_free_error_message(ctx, omsg);
 }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
index b9f70fd6c..3ebfb8764 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
@@ -46,14 +46,13 @@ krb5_validate_ldap_context(krb5_context context,
 
     if (ldap_context->bind_dn == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, _("LDAP bind dn value missing "));
+        k5_setmsg(context, st, _("LDAP bind dn value missing "));
         goto err_out;
     }
 
     if (ldap_context->bind_pwd == NULL && ldap_context->service_password_file == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("LDAP bind password value missing "));
+        k5_setmsg(context, st, _("LDAP bind password value missing "));
         goto err_out;
     }
 
@@ -71,8 +70,7 @@ krb5_validate_ldap_context(krb5_context context,
     /* NULL password not allowed */
     if (ldap_context->bind_pwd != NULL && strlen(ldap_context->bind_pwd) == 0) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("Service password length is zero"));
+        k5_setmsg(context, st, _("Service password length is zero"));
         goto err_out;
     }
 
@@ -113,9 +111,9 @@ krb5_ldap_initialize(krb5_ldap_context *ldap_context,
 
     /* ldap init */
     if ((st = ldap_initialize(&ldap_server_handle->ldap_handle, server_info->server_name)) != 0) {
-        krb5_set_error_message(ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR,
-                               _("Cannot create LDAP handle for '%s': %s"),
-                               server_info->server_name, ldap_err2string(st));
+        k5_setmsg(ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR,
+                  _("Cannot create LDAP handle for '%s': %s"),
+                  server_info->server_name, ldap_err2string(st));
         st = KRB5_KDB_ACCESS_ERROR;
         goto err_out;
     }
@@ -125,10 +123,10 @@ krb5_ldap_initialize(krb5_ldap_context *ldap_context,
         server_info->server_status = ON;
         krb5_update_ldap_handle(ldap_server_handle, server_info);
     } else {
-        krb5_set_error_message(ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR,
-                               _("Cannot bind to LDAP server '%s' as '%s'"
-                                 ": %s"), server_info->server_name,
-                               ldap_context->bind_dn, ldap_err2string(st));
+        k5_setmsg(ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR,
+                  _("Cannot bind to LDAP server '%s' as '%s': %s"),
+                  server_info->server_name, ldap_context->bind_dn,
+                  ldap_err2string(st));
         st = KRB5_KDB_ACCESS_ERROR;
         server_info->server_status = OFF;
         time(&server_info->downtime);
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
index 4fcf5a025..9cbde9a96 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
@@ -128,8 +128,7 @@ cleanup:
         int rc;
         rc = krb5_ldap_delete_krbcontainer(context,
                                            ldap_context->container_dn);
-        krb5_set_error_message(context, rc,
-                               _("could not complete roll-back, error "
+        k5_setmsg(context, rc, _("could not complete roll-back, error "
                                  "deleting Kerberos Container"));
     }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_handle.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_handle.c
index 2188b2d31..616a7e2f7 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_handle.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_handle.c
@@ -70,7 +70,6 @@ krb5_update_server_info(krb5_ldap_server_handle *ldap_server_handle,
             if ((st=ldap_result2error(ldap_server_handle->ldap_handle, result, 1)) == LDAP_SUCCESS) {
                 server_info->server_status = ON;
             } else {
-                /* ?? */        krb5_set_error_message(0, 0, "%s", ldap_err2string(st));
                 server_info->server_status = OFF;
                 time(&server_info->downtime);
             }
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
index e3b42f55a..4ef7f2e75 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
@@ -55,8 +55,7 @@ krb5_ldap_read_krbcontainer_dn(krb5_context context, char **container_dn)
         if ((st=profile_get_string(context->profile, KDB_MODULE_SECTION, ldap_context->conf_section,
                                    KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
                                    &dn)) != 0) {
-            krb5_set_error_message(context, st,
-                                   _("Error reading kerberos container "
+            k5_setmsg(context, st, _("Error reading kerberos container "
                                      "location from krb5.conf"));
             goto cleanup;
         }
@@ -67,8 +66,7 @@ krb5_ldap_read_krbcontainer_dn(krb5_context context, char **container_dn)
         if ((st=profile_get_string(context->profile, KDB_MODULE_DEF_SECTION,
                                    KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
                                    NULL, &dn)) != 0) {
-            krb5_set_error_message(context, st,
-                                   _("Error reading kerberos container "
+            k5_setmsg(context, st, _("Error reading kerberos container "
                                      "location from krb5.conf"));
             goto cleanup;
         }
@@ -76,8 +74,7 @@ krb5_ldap_read_krbcontainer_dn(krb5_context context, char **container_dn)
 
     if (dn == NULL) {
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
-        krb5_set_error_message(context, st,
-                               _("Kerberos container location not specified"));
+        k5_setmsg(context, st, _("Kerberos container location not specified"));
         goto cleanup;
     }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
index 8776ab513..8d72832bb 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
@@ -84,8 +84,8 @@ prof_get_integer_def(krb5_context ctx, const char *conf_section,
                                KDB_MODULE_SECTION, conf_section, name,
                                0, &out_temp);
     if (err) {
-        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
-                               name, error_message(err));
+        k5_setmsg(ctx, err, _("Error reading '%s' attribute: %s"), name,
+                  error_message(err));
         return err;
     }
     if (out_temp != 0) {
@@ -96,8 +96,8 @@ prof_get_integer_def(krb5_context ctx, const char *conf_section,
                                KDB_MODULE_DEF_SECTION, name, 0,
                                dfl, &out_temp);
     if (err) {
-        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
-                               name, error_message(err));
+        k5_setmsg(ctx, err, _("Error reading '%s' attribute: %s"), name,
+                  error_message(err));
         return err;
     }
     *out = out_temp;
@@ -116,8 +116,8 @@ prof_get_boolean_def(krb5_context ctx, const char *conf_section,
     err = profile_get_boolean(ctx->profile, KDB_MODULE_SECTION, conf_section,
                               name, -1, &out_temp);
     if (err) {
-        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
-                               name, error_message(err));
+        k5_setmsg(ctx, err, _("Error reading '%s' attribute: %s"), name,
+                  error_message(err));
         return err;
     }
     if (out_temp != -1) {
@@ -127,8 +127,8 @@ prof_get_boolean_def(krb5_context ctx, const char *conf_section,
     err = profile_get_boolean(ctx->profile, KDB_MODULE_DEF_SECTION, name, 0,
                               dfl, &out_temp);
     if (err) {
-        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
-                               name, error_message(err));
+        k5_setmsg(ctx, err, _("Error reading '%s' attribute: %s"), name,
+                  error_message(err));
         return err;
     }
     *out = out_temp;
@@ -147,8 +147,8 @@ prof_get_string_def(krb5_context ctx, const char *conf_section,
                               KDB_MODULE_SECTION, conf_section, name,
                               0, out);
     if (err) {
-        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
-                               name, error_message(err));
+        k5_setmsg(ctx, err, _("Error reading '%s' attribute: %s"), name,
+                  error_message(err));
         return err;
     }
     if (*out != 0)
@@ -157,8 +157,8 @@ prof_get_string_def(krb5_context ctx, const char *conf_section,
                               KDB_MODULE_DEF_SECTION, name, 0,
                               0, out);
     if (err) {
-        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
-                               name, error_message(err));
+        k5_setmsg(ctx, err, _("Error reading '%s' attribute: %s"), name,
+                  error_message(err));
         return err;
     }
     return 0;
@@ -248,15 +248,14 @@ krb5_ldap_parse_db_params(krb5_context context, char **db_args)
             /* "temporary" is passed by kdb5_util load without -update,
              * which we don't support. */
             status = EINVAL;
-            krb5_set_error_message(context, status,
-                                   _("KDB module requires -update argument"));
+            k5_setmsg(context, status,
+                      _("KDB module requires -update argument"));
             goto cleanup;
         }
 
         if (val == NULL) {
             status = EINVAL;
-            krb5_set_error_message(context, status, _("'%s' value missing"),
-                                   opt);
+            k5_setmsg(context, status, _("'%s' value missing"), opt);
             goto cleanup;
         }
 
@@ -286,8 +285,7 @@ krb5_ldap_parse_db_params(krb5_context context, char **db_args)
             lctx->ldap_debug = atoi(val);
         } else {
             status = EINVAL;
-            krb5_set_error_message(context, status, _("unknown option '%s'"),
-                                   opt);
+            k5_setmsg(context, status, _("unknown option '%s'"), opt);
             goto cleanup;
         }
 
@@ -359,8 +357,8 @@ krb5_ldap_read_server_params(krb5_context context, char *conf_section,
 
     if (ldap_context->max_server_conns < 2) {
         st = EINVAL;
-        krb5_set_error_message(context, st, _("Minimum connections required "
-                                              "per server is 2"));
+        k5_setmsg(context, st,
+                  _("Minimum connections required per server is 2"));
         goto cleanup;
     }
 
@@ -406,8 +404,8 @@ krb5_ldap_read_server_params(krb5_context context, char *conf_section,
     if (ldap_context->server_info_list == NULL) {
         if ((st=profile_get_string(context->profile, KDB_MODULE_SECTION, conf_section,
                                    KRB5_CONF_LDAP_SERVERS, NULL, &tempval)) != 0) {
-            krb5_set_error_message(context, st, _("Error reading "
-                                                  "'ldap_servers' attribute"));
+            k5_setmsg(context, st,
+                      _("Error reading 'ldap_servers' attribute"));
             goto cleanup;
         }
 
@@ -1327,7 +1325,7 @@ krb5_error_code
 krb5_ldap_lock(krb5_context kcontext, int mode)
 {
     krb5_error_code status = KRB5_PLUGIN_OP_NOTSUPP;
-    krb5_set_error_message(kcontext, status, "LDAP %s", error_message(status));
+    k5_setmsg(kcontext, status, "LDAP %s", error_message(status));
     return status;
 }
 
@@ -1335,7 +1333,7 @@ krb5_error_code
 krb5_ldap_unlock(krb5_context kcontext)
 {
     krb5_error_code status = KRB5_PLUGIN_OP_NOTSUPP;
-    krb5_set_error_message(kcontext, status, "LDAP %s", error_message(status));
+    k5_setmsg(kcontext, status, "LDAP %s", error_message(status));
     return status;
 }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
index 47ba5f022..81d5cbab6 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
@@ -156,7 +156,7 @@ krb5_ldap_iterate(krb5_context context, char *match_expr,
         realm = context->default_realm;
         if (realm == NULL) {
             st = EINVAL;
-            krb5_set_error_message(context, st, _("Default realm not set"));
+            k5_setmsg(context, st, _("Default realm not set"));
             goto cleanup;
         }
     }
@@ -256,7 +256,7 @@ krb5_ldap_delete_principal(krb5_context context,
 
     if (DN == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, _("DN information missing"));
+        k5_setmsg(context, st, _("DN information missing"));
         goto cleanup;
     }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index c30599e72..00702730b 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -105,8 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
 
     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
         st = KRB5_KDB_NOENTRY;
-        krb5_set_error_message(context, st,
-                               _("Principal does not belong to realm"));
+        k5_setmsg(context, st, _("Principal does not belong to realm"));
         goto cleanup;
     }
 
@@ -276,9 +275,8 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
                         xargs->dn != NULL || xargs->containerdn != NULL ||
                         xargs->linkdn != NULL) {
                         st = EINVAL;
-                        krb5_set_error_message(context, st,
-                                               _("%s option not supported"),
-                                               arg);
+                        k5_setmsg(context, st, _("%s option not supported"),
+                                  arg);
                         goto cleanup;
                     }
                     dptr = &xargs->dn;
@@ -286,41 +284,36 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
                     if (optype == MODIFY_PRINCIPAL ||
                         xargs->dn != NULL || xargs->containerdn != NULL) {
                         st = EINVAL;
-                        krb5_set_error_message(context, st,
-                                               _("%s option not supported"),
-                                               arg);
+                        k5_setmsg(context, st, _("%s option not supported"),
+                                  arg);
                         goto cleanup;
                     }
                     dptr = &xargs->containerdn;
                 } else if (strcmp(arg, LINKDN_ARG) == 0) {
                     if (xargs->dn != NULL || xargs->linkdn != NULL) {
                         st = EINVAL;
-                        krb5_set_error_message(context, st,
-                                               _("%s option not supported"),
-                                               arg);
+                        k5_setmsg(context, st, _("%s option not supported"),
+                                  arg);
                         goto cleanup;
                     }
                     dptr = &xargs->linkdn;
                 } else {
                     st = EINVAL;
-                    krb5_set_error_message(context, st,
-                                           _("unknown option: %s"), arg);
+                    k5_setmsg(context, st, _("unknown option: %s"), arg);
                     goto cleanup;
                 }
 
                 xargs->dn_from_kbd = TRUE;
                 if (arg_val == NULL || strlen(arg_val) == 0) {
                     st = EINVAL;
-                    krb5_set_error_message(context, st,
-                                           _("%s option value missing"), arg);
+                    k5_setmsg(context, st, _("%s option value missing"), arg);
                     goto cleanup;
                 }
             }
 
             if (arg_val == NULL) {
                 st = EINVAL;
-                krb5_set_error_message(context, st,
-                                       _("%s option value missing"), arg);
+                k5_setmsg(context, st, _("%s option value missing"), arg);
                 goto cleanup;
             }
             arg_val_len = strlen(arg_val) + 1;
@@ -522,8 +515,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
     if (is_principal_in_realm(ldap_context, entry->princ) != 0) {
         st = EINVAL;
-        krb5_set_error_message(context, st, _("Principal does not belong to "
-                                              "the default realm"));
+        k5_setmsg(context, st,
+                  _("Principal does not belong to the default realm"));
         goto cleanup;
     }
 
@@ -592,11 +585,10 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
                     ldap_msgfree(result);
                     free(filter);
                     st = EINVAL;
-                    krb5_set_error_message(context, st,
-                                           _("operation can not continue, "
-                                             "more than one entry with "
-                                             "principal name \"%s\" found"),
-                                           user);
+                    k5_setmsg(context, st,
+                              _("operation can not continue, more than one "
+                                "entry with principal name \"%s\" found"),
+                              user);
                     goto cleanup;
                 } else if (numlentries == 1) {
                     found_entry = TRUE;
@@ -739,8 +731,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
         if (outofsubtree == TRUE) {
             st = EINVAL;
-            krb5_set_error_message(context, st,
-                                   _("DN is out of the realm subtree"));
+            k5_setmsg(context, st, _("DN is out of the realm subtree"));
             goto cleanup;
         }
 
@@ -796,7 +787,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
         st = EINVAL;
         snprintf(errbuf, sizeof(errbuf),
                  _("ldap object is already kerberized"));
-        krb5_set_error_message(context, st, "%s", errbuf);
+        k5_setmsg(context, st, "%s", errbuf);
         goto cleanup;
     }
 
@@ -817,7 +808,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             snprintf(errbuf, sizeof(errbuf),
                      _("link information can not be set/updated as the "
                        "kerberos principal belongs to an ldap object"));
-            krb5_set_error_message(context, st, "%s", errbuf);
+            k5_setmsg(context, st, "%s", errbuf);
             goto cleanup;
         }
         /*
@@ -831,7 +822,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             if ((st=krb5_get_linkdn(context, entry, &linkdns)) != 0) {
                 snprintf(errbuf, sizeof(errbuf),
                          _("Failed getting object references"));
-                krb5_set_error_message(context, st, "%s", errbuf);
+                k5_setmsg(context, st, "%s", errbuf);
                 goto cleanup;
             }
             if (linkdns != NULL) {
@@ -839,7 +830,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
                 snprintf(errbuf, sizeof(errbuf),
                          _("kerberos principal is already linked to a ldap "
                            "object"));
-                krb5_set_error_message(context, st, "%s", errbuf);
+                k5_setmsg(context, st, "%s", errbuf);
                 for (j=0; linkdns[j] != NULL; ++j)
                     free (linkdns[j]);
                 free (linkdns);
@@ -1001,7 +992,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
                 goto cleanup;
         } else {
             st = EINVAL;
-            krb5_set_error_message(context, st, "Password policy value null");
+            k5_setmsg(context, st, "Password policy value null");
             goto cleanup;
         }
     } else if (entry->mask & KADM5_LOAD && found_entry == TRUE) {
@@ -1196,7 +1187,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
                          _("Principal delete failed (trying to replace "
                            "entry): %s"), ldap_err2string(st));
                 st = translate_ldap_error (st, OP_ADD);
-                krb5_set_error_message(context, st, "%s", errbuf);
+                k5_setmsg(context, st, "%s", errbuf);
                 goto cleanup;
             } else {
                 st = ldap_add_ext_s(ld, standalone_principal_dn, mods, NULL, NULL);
@@ -1206,7 +1197,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             snprintf(errbuf, sizeof(errbuf), _("Principal add failed: %s"),
                      ldap_err2string(st));
             st = translate_ldap_error (st, OP_ADD);
-            krb5_set_error_message(context, st, "%s", errbuf);
+            k5_setmsg(context, st, "%s", errbuf);
             goto cleanup;
         }
     } else {
@@ -1244,7 +1235,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             snprintf(errbuf, sizeof(errbuf), _("User modification failed: %s"),
                      ldap_err2string(st));
             st = translate_ldap_error (st, OP_MOD);
-            krb5_set_error_message(context, st, "%s", errbuf);
+            k5_setmsg(context, st, "%s", errbuf);
             goto cleanup;
         }
 
@@ -1373,9 +1364,9 @@ krb5_decode_krbsecretkey(krb5_context context, krb5_db_entry *entries,
         if (st != 0) {
             const char *msg = error_message(st);
             st = -1; /* Something more appropriate ? */
-            krb5_set_error_message(context, st, _("unable to decode stored "
-                                                  "principal key data (%s)"),
-                                   msg);
+            k5_setmsg(context, st,
+                      _("unable to decode stored principal key data (%s)"),
+                      msg);
             goto cleanup;
         }
         noofkeys += n_kd;
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
index 032be6f97..086c4588b 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
@@ -220,8 +220,7 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm)
 
     if (lrealm == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("Realm information not available"));
+        k5_setmsg(context, st, _("Realm information not available"));
         goto cleanup;
     }
 
@@ -306,8 +305,8 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm)
     if ((st=ldap_delete_ext_s(ld, ldap_context->lrparams->realmdn, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_DEL);
-        krb5_set_error_message(context, st, _("Realm Delete FAILED: %s"),
-                               ldap_err2string(ost));
+        k5_setmsg(context, st, _("Realm Delete FAILED: %s"),
+                  ldap_err2string(ost));
     }
 
 cleanup:
@@ -480,8 +479,7 @@ krb5_ldap_create_krbcontainer(krb5_context context, const char *dn)
 
     if (dn == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("Kerberos Container information is missing"));
+        k5_setmsg(context, st, _("Kerberos Container information is missing"));
         goto cleanup;
     }
 
@@ -493,8 +491,7 @@ krb5_ldap_create_krbcontainer(krb5_context context, const char *dn)
     rdns = ldap_explode_dn(dn, 1);
     if (rdns == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("Invalid Kerberos container DN"));
+        k5_setmsg(context, st, _("Invalid Kerberos container DN"));
         goto cleanup;
     }
 
@@ -510,9 +507,8 @@ krb5_ldap_create_krbcontainer(krb5_context context, const char *dn)
     if (st != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_ADD);
-        krb5_set_error_message(context, st,
-                               _("Kerberos Container create FAILED: %s"),
-                               ldap_err2string(ost));
+        k5_setmsg(context, st, _("Kerberos Container create FAILED: %s"),
+                  ldap_err2string(ost));
         goto cleanup;
     }
 
@@ -546,8 +542,7 @@ krb5_ldap_delete_krbcontainer(krb5_context context, const char *dn)
 
     if (dn == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("Kerberos Container information is missing"));
+        k5_setmsg(context, st, _("Kerberos Container information is missing"));
         goto cleanup;
     }
 
@@ -555,9 +550,8 @@ krb5_ldap_delete_krbcontainer(krb5_context context, const char *dn)
     if ((st = ldap_delete_ext_s(ld, dn, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_ADD);
-        krb5_set_error_message(context, st,
-                               _("Kerberos Container delete FAILED: %s"),
-                               ldap_err2string(ost));
+        k5_setmsg(context, st, _("Kerberos Container delete FAILED: %s"),
+                  ldap_err2string(ost));
         goto cleanup;
     }
 
@@ -923,6 +917,6 @@ krb5_ldap_delete_realm_1(krb5_context kcontext, char *conf_section,
                          char **db_args)
 {
     krb5_error_code status = KRB5_PLUGIN_OP_NOTSUPP;
-    krb5_set_error_message(kcontext, status, "LDAP %s", error_message(status));
+    k5_setmsg(kcontext, status, "LDAP %s", error_message(status));
     return status;
 }
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
index 32e2af005..36e6d597e 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
@@ -46,15 +46,14 @@ dec_password(krb5_context context, const char *str,
     *password_out = NULL;
 
     if (strncmp(str, "{HEX}", 5) != 0) {
-        krb5_set_error_message(context, EINVAL,
-                               _("Not a hexadecimal password"));
+        k5_setmsg(context, EINVAL, _("Not a hexadecimal password"));
         return EINVAL;
     }
     str += 5;
 
     len = strlen(str);
     if (len % 2 != 0) {
-        krb5_set_error_message(context, EINVAL, _("Password corrupt"));
+        k5_setmsg(context, EINVAL, _("Password corrupt"));
         return EINVAL;
     }
 
@@ -65,7 +64,7 @@ dec_password(krb5_context context, const char *str,
     for (p = (unsigned char *)str; *p != '\0'; p += 2) {
         if (!isxdigit(*p) || !isxdigit(p[1])) {
             free(password);
-            krb5_set_error_message(context, EINVAL, _("Password corrupt"));
+            k5_setmsg(context, EINVAL, _("Password corrupt"));
             return EINVAL;
         }
         sscanf((char *)p, "%2x", &k);
@@ -99,9 +98,8 @@ krb5_ldap_readpassword(krb5_context context, krb5_ldap_context *ldap_context,
     fptr = fopen(file, "r");
     if (fptr == NULL) {
         st = errno;
-        krb5_set_error_message(context, st,
-                               _("Cannot open LDAP password file '%s': %s"),
-                               file, error_message(st));
+        k5_setmsg(context, st, _("Cannot open LDAP password file '%s': %s"),
+                  file, error_message(st));
         goto rp_exit;
     }
     set_cloexec_file(fptr);
@@ -129,9 +127,9 @@ krb5_ldap_readpassword(krb5_context context, krb5_ldap_context *ldap_context,
 
     if (entryfound == 0)  {
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
-        krb5_set_error_message(context, st, _("Bind DN entry '%s' missing in "
-                                              "LDAP password file '%s'"),
-                               ldap_context->bind_dn, file);
+        k5_setmsg(context, st,
+                  _("Bind DN entry '%s' missing in LDAP password file '%s'"),
+                  ldap_context->bind_dn, file);
         goto rp_exit;
     }
     /* replace the \n with \0 */
@@ -143,7 +141,7 @@ krb5_ldap_readpassword(krb5_context context, krb5_ldap_context *ldap_context,
     if (start == NULL) {
         /* password field missing */
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
-        krb5_set_error_message(context, st, _("Stash file entry corrupt"));
+        k5_setmsg(context, st, _("Stash file entry corrupt"));
         goto rp_exit;
     }
     ++ start;
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c
index 99b54017e..5fe3164e3 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c
@@ -53,7 +53,7 @@ krb5_ldap_create_policy(krb5_context context, krb5_ldap_policy_params *policy,
     /* validate the input parameters */
     if (policy == NULL || policy->policy == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, _("Ticket Policy Name missing"));
+        k5_setmsg(context, st, _("Ticket Policy Name missing"));
         goto cleanup;
     }
 
@@ -129,7 +129,7 @@ krb5_ldap_modify_policy(krb5_context context, krb5_ldap_policy_params *policy,
     /* validate the input parameters */
     if (policy == NULL || policy->policy==NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, _("Ticket Policy Name missing"));
+        k5_setmsg(context, st, _("Ticket Policy Name missing"));
         goto cleanup;
     }
 
@@ -206,8 +206,7 @@ krb5_ldap_read_policy(krb5_context context, char *policyname,
     /* validate the input parameters */
     if (policyname == NULL  || policy == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st,
-                               _("Ticket Policy Object information missing"));
+        k5_setmsg(context, st, _("Ticket Policy Object information missing"));
         goto cleanup;
     }
 
diff --git a/src/plugins/preauth/securid_sam2/securid2.c b/src/plugins/preauth/securid_sam2/securid2.c
index e3c8c7dae..ca99ce3ef 100644
--- a/src/plugins/preauth/securid_sam2/securid2.c
+++ b/src/plugins/preauth/securid_sam2/securid2.c
@@ -306,9 +306,9 @@ verify_securid_data_2(krb5_context context, krb5_db_entry *client,
     if ((sr2->sam_enc_nonce_or_sad.ciphertext.data == NULL) ||
         (sr2->sam_enc_nonce_or_sad.ciphertext.length <= 0)) {
         retval = KRB5KDC_ERR_PREAUTH_FAILED;
-        krb5_set_error_message(context, retval,
-                               "No preauth data supplied in "
-                               "verify_securid_data_2 (%s)", user);
+        k5_setmsg(context, retval,
+                  "No preauth data supplied in verify_securid_data_2 (%s)",
+                  user);
         goto cleanup;
     }