> On Nov 13, 2017, at 12:50 PM, Patrik Lundin <patrik.lun...@su.se> wrote:
>
> Maby it is just me but I was surprised to have "get" not reflect the
> actual contents in the database.
IIRC that was needed to reliably get pruning to work, since some
kadmin clients add keys by doing get + add + set. We also did not
want users with "get" privileges on the key values to get old keys
that can only be used to compromise captured traffic, and are not
needed for live keytab files. Perhaps I am not recalling the
details quite right, but it made sense at the time...
--
Viktor.
