The old database handling used [realms]->REALMNAME->database_name to specify the pathname for the database. After the DAL changes, [dbmodules]->dbmodulename->database_name is where the db2 backend looks first for the pathname, falling back to [realms]->REALMNAME->database_name if it's not found, for backwards compatibility, and then falls back to a hard-coded pathname. The kadm5_config_params handling includes code that looks at [realms]- >REALMNAME->database_name only, and has the same hard-coded default pathname. Some of the code using kadm5_config_params seems to assume that the pathname there is correct. In short, I don't think we currently fully support the mode where the database pathname is specified in the dbmodules section only. Also, for some conceivable database back ends, and in fact for the LDAP back end, there may not *be* a filename. So anything building on that filename may need some rethinking. Ken