krbprincipalname can be modified using --set/addattr by those in the admins group. This should probably not be allowed by default.
https://bugzilla.redhat.com/show_bug.cgi?id=640723
Closing as a duplicate of ticket #416 which covers more attributes.
Metadata Update from @rcritten: - Issue assigned to rcritten - Issue set to the milestone: FreeIPA 2.0 - 2010/11
Login to comment on this ticket.