Final Thoughts: Suggestions

• A way of adding user instances and service principals to the KDC that is integrated into the standard OS X Server administration tools

• Separation of being allowed to “administer this directory domain” and being given kadmin rights

  • If alice is allowed to administer the directory domain, she should be given an admin instance and be asked to supply a password for that to make any changes to the Kerberos database