Principal Name 

The name of the principal (which is the primary/instance part of a fully qualified principal name). A principal is a unique identity to which the KDC can assign tickets.

If you are modifying a principal, you cannot edit its name. 

Password 

The password for the principal. You can use the Generate Random Password button to create a random password for the principal. 

Policy 

A menu of available policies for the principal. 

Account Expires 

The date and time on which the principal's account expires. When the account expires, the principal can no longer get a ticket-granting ticket (TGT) and might be unable to log in. 

Last Principal Change  

The date on which information for the principal was last modified. (Read only) 

Last Changed By 

The name of the principal that last modified the account for this principal. (Read only) 

Comments 

Comments that are related to the principal (for example, “Temporary Account”). 

Last Success 

The date and time when the principal last logged in successfully. (Read only) 

Last Failure 

The date and time when the last login failure for the principal occurred. (Read only) 

Failure Count 

The number of times a login failure has occurred for the principal. (Read only) 

Last Password Change 

The date and time when the principal's password was last changed. (Read only) 

Password Expires 

The date and time when the principal's current password expires. 

Key Version 

The key version number for the principal. This attribute is normally changed only when a password has been compromised. 

Maximum Lifetime (seconds) 

The maximum length of time for which a ticket can be granted for the principal (without renewal). 

Maximum Renewal (seconds) 

The maximum length of time for which an existing ticket can be renewed for the principal. 

Disable Account 

When checked, prevents the principal from logging in. This attribute provides an easy way to temporarily freeze a principal account. 

Require Password Change 

When checked, expires the principal's current password, which forces the user to use the kpasswd command to create a new password. This attribute is useful if a security breach occurs, and you need to make sure that old passwords are replaced.

Allow Postdated Tickets 

When checked, allows the principal to obtain postdated tickets.  

For example, you might need to use postdated tickets for cron jobs that must run after hours, but you cannot obtain tickets in advance because of short ticket lifetimes.

Allow Forwardable Tickets 

When checked, allows the principal to obtain forwardable tickets. 

Forwardable tickets are tickets that are forwarded to the remote host to provide a single-sign-on session. For example, if you are using forwardable tickets and you authenticate yourself through ftp or rsh, then other services, such as NFS services, are available without your being prompted for another password.

Allow Renewable Tickets 

When checked, allows the principal to obtain renewable tickets. 

A principal can automatically extend the expiration date or time of a ticket that is renewable (rather than having to get a new ticket after the first ticket expires). Currently, the NFS service is the ticket service that can renew tickets. 

Allow Proxiable Tickets 

When checked, allows the principal to obtain proxiable tickets. 

A proxiable ticket is a ticket that can be used by a service on behalf of a client to perform an operation for the client. With a proxiable ticket, a service can take on the identity of a client and obtain a ticket for another service. However, the service cannot obtain a ticket-granting ticket (TGT). 

Allow Service Tickets 

When checked, allows service tickets to be issued for the principal. 

You should not allow service tickets to be issued for the kadmin/hostname and changepw/hostname principals. This practice ensures that only these principals can update the KDC database.

Allow TGT-Based Authentication 

When checked, allows the service principal to provide services to another principal. More specifically, this attribute allows the KDC to issue a service ticket for the service principal. 

This attribute is valid only for service principals. When unchecked, service tickets cannot be issued for the service principal. 

Allow Duplicate Authentication 

When checked, allows the user principal to obtain service tickets for other user principals. 

This attribute is valid only for user principals. When unchecked, the user principal can still obtain service tickets for service principals, but not for other user principals. 

Required Preauthentication 

When checked, the KDC will not send a requested ticket-granting ticket (TGT) to the principal until the KDC can authenticate (through software) that the principal is really the principal that is requesting the TGT. This preauthentication is usually done through an extra password, for example, from a DES card. 

When unchecked, the KDC does not need to preauthenticate the principal before the KDC sends a requested TGT to the principal. 

Required Hardware Authentication 

When checked, the KDC will not send a requested ticket-granting ticket (TGT) to the principal until the KDC can authenticate (through hardware) that the principal is really the principal that is requesting the TGT. Hardware preauthentication can occur, for example, on a Java ring reader. 

When unchecked, the KDC does not need to preauthenticate the principal before the KDC sends a requested TGT to the principal. 

Policy Name 

The name of the policy. A policy is a set of rules that govern a principal's password and tickets. 

If you are modifying a policy, you cannot edit its name. 

Minimum Password Length 

The minimum length for the principal's password. 

Minimum Password Classes 

The minimum number of different character types that are required in the principal's password. 

For example, a minimum classes value of 2 means that the password must have at least two different character types, such as letters and numbers (hi2mom). A value of 3 means that the password must have at least three different character types, such as letters, numbers, and punctuation (hi2mom!). And so on.  

A value of 1 sets no restriction on the number of password character types. 

Saved Password History 

The number of previous passwords that have been used by the principal, and a list of the previous passwords that cannot be reused. 

Minimum Password Lifetime (seconds) 

The minimum length of time that the password must be used before it can be changed. 

Maximum Password Lifetime (seconds) 

The maximum length of time that the password can be used before it must be changed. 

Principals Using This Policy 

The number of principals to which this policy currently applies. (Read only)