Bug 204261

Description of problem:

For Kerberos databases containing more than one realm, kpasswd fails to change
passwords for any realm other than the one that kadmind was started with.  I.e.,
if your KDC contains principals from realms EXAMPLE1.COM and EXAMPLE2.COM, and
kadmind is started with "-r EXAMPLE1.COM", kpasswd will only work for principals
in that realm.  

This is a hairy problem, because the obvious workaround (running another
instance of kadmind) doesn't work because you can't specify an alternative
kpasswd port to kadmind (only an alternative kadmin port).  This means that
users from all realms in the KDC but one must rely on the system administrator
to change their password for them!


Version-Release number of selected component (if applicable): krb5-server 1.4.3-5.1


How reproducible:
Consistently.

Steps to Reproduce:
1.  Create a Kerberos database for two realms:

kdb5_util -r EXAMPLE1.COM create -s
kdb5_util -r EXAMPLE2.COM -d EXAMPLE2.COM create -s (set the master keys to the
same value)
kdb5_util -r EXAMPLE2.COM -d EXAMPLE2.COM dump -new_mkey_file .k5.EXAMPLE1.COM >
EXAMPLE2.COM.dump
kbd5_util load -update EXAMPLE2.COM.dump
cp .k5.EXAMPLE1.COM .k5.EXAMPLE2.COM

2.  Add test principals in each realm
3.  Start kadmind (you can specify one realm explicitly, or let it choose the
default realm specified in /etc/krb5.conf)
4.  Try to change the passwords for each test principal using kpasswd. 

Actual results:
For realms other than the one kadmind was set up to serve, kpasswd returns:
Authentication error: Failed reading application request


Expected results:
Password should be changed.

Additional info: