Need to use -clearpolicy with addprinc.

1 files changed, 5 insertions, 0 deletions

diff --git a/doc/notes b/doc/notes
index 5f1633e..257305a 100644
--- a/doc/notes
+++ b/doc/notes
@@ -117,6 +117,11 @@ Server Issues
     doing the principal creation or randomization, separated by spaces and
     enclosed in double quotes.
 
+    When creating a new principal with addprinc, pass the -clearpolicy
+    flag.  Otherwise, the principal will be placed in the default policy
+    and will be subject to password strength checking, and the initial
+    password used with -randkey will fail.
+
     Whenever we generate a new keytab, we may need to push the key into
     K4.  We could make the client send a flag saying whether they want
     synchronization with K4, but it's easier to just always do it (except