Fix KDC verification failure due to bonding utility failing to obtain host heys

See http://kerberos.996246.n3.nabble.com/kadmin-kadmind-ext-keytab-issue-td11529.html for fix

acl-updater/plugin/plugin.cpp

@@ -87,7 +87,7 @@ post_modify (Slapi_PBlock *pb)
 				stream << "\n\n";
 	
 				stream << "# Internal Kerberos administration account\n";
-				stream << TQString("kadmin/%1@%2\tall").arg(rootaccountname).arg(realmname);
+				stream << TQString("kadmin/%1@%2\tall,get-keys").arg(rootaccountname).arg(realmname);
 				stream << "\n\n";
 	
 				stream << "# Configured realm administrators\n";
@@ -98,7 +98,7 @@ post_modify (Slapi_PBlock *pb)
 					krbConvertedUser.truncate(cmpos);
 					krbConvertedUser.remove(0, eqpos);
 					krbConvertedUser.append("@"+realmname);
-					stream << krbConvertedUser << "\tall\n";
+					stream << krbConvertedUser << "\tall,get-keys\n";
 				}
 				file.close();
 			}

confskel/heimdal/kadmind.acl

@@ -2,7 +2,7 @@
 # All changes will be lost!
 
 # Internal Kerberos administration account
-kadmin/@@@ROOTUSER@@@@@@@REALM_UCNAME@@@	all
+kadmin/@@@ROOTUSER@@@@@@@REALM_UCNAME@@@	all,get-keys
 
 # Configured realm administrators
-@@@ADMINUSER@@@@@@@REALM_UCNAME@@@	all
+@@@ADMINUSER@@@@@@@REALM_UCNAME@@@	all,get-keys