From a616cec9d89db6e87aa52992d0bf53c81c75457d Mon Sep 17 00:00:00 2001
From: Nicolas Williams <nico@twosigma.com>
Date: Wed, 8 Dec 2021 21:24:39 -0600
Subject: [PATCH] kdc: Document enable-pkinit param

---
 lib/krb5/krb5.conf.5 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/krb5/krb5.conf.5 b/lib/krb5/krb5.conf.5
index b03e2aaf5..bb2e61d88 100644
--- a/lib/krb5/krb5.conf.5
+++ b/lib/krb5/krb5.conf.5
@@ -816,6 +816,8 @@ enabled by default for now.
 Enable unarmored encrypted timestamp pre-authentication.
 Enabled by default for now, but in a future release will be
 disabled.
+.It Li enable-pkinit = Va BOOL
+Enable PKINIT (disabled by default).
 .It Li allow-anonymous = Va BOOL
 If the kdc is allowed to hand out anonymous tickets.
 .It Li synthetic_clients = Va BOOL