Clarify lockout replication issues in docs

In the "KDC replication and account lockout" section of lockout.rst,
specifically call out kprop and incremental propagation as the
mechanisms which do not replicate account lockout state, and add a
note that KDCs using LDAP may not be affected by that section's
concerns.

ticket: 7773 (new)
target_version: 1.12
tags: pullup

diff --git a/doc/admin/lockout.rst b/doc/admin/lockout.rst
index e52092191da6a41f27c9b18404318227a85fd665..7e62841c7457edbd0548e0f6faf49bb9dfe30dc6 100644 (file)
--- a/doc/admin/lockout.rst
+++ b/doc/admin/lockout.rst
@@ -95,19 +95,25 @@ This command will reset the number of failed attempts to 0.
 KDC replication and account lockout
 -----------------------------------
 
-The account lockout state of a principal is not replicated between
-KDCs.  Because of this, the number of attempts an attacker can make
-within a time period is multiplied by the number of KDCs.  For
-instance, if the **maxfailure** parameter on a policy is 10 and there
-are four KDCs in the environment (a master and three slaves), an
-attacker could make as many as 40 attempts before the principal is
-locked out on all four KDCs.
+The account lockout state of a principal is not replicated by either
+traditional :ref:`kprop(8)` or incremental propagation.  Because of
+this, the number of attempts an attacker can make within a time period
+is multiplied by the number of KDCs.  For instance, if the
+**maxfailure** parameter on a policy is 10 and there are four KDCs in
+the environment (a master and three slaves), an attacker could make as
+many as 40 attempts before the principal is locked out on all four
+KDCs.
 
 An administrative unlock is propagated from the master to the slave
 KDCs during the next propagation.  Propagation of an administrative
 unlock will cause the counter of failed attempts on each slave to
 reset to 1 on the next failure.
 
+If a KDC environment uses a replication strategy other than kprop or
+incremental propagation, such as the LDAP KDB module with multi-master
+LDAP replication, then account lockout state may be replicated between
+KDCs and the concerns of this section may not apply.
+
 
 KDC performance and account lockout
 -----------------------------------