Note that every user of the demo account will be able to decrypt every other users&#39; communications, unless SPAKE preauth is used (and even then an MITM attack is likely possible).<br />
<br />
I believe this use case is currently possible in three suboptimal ways, the first of which is probably easiest:<br />
<br />
1. Set a long min_life on the principal.<br />
<br />
2. Provide a password quality plugin module which always fails the quality check for this principal.<br />
<br />
3. Disable the &quot;self&quot; kadm5_auth module, and instead provide a new module which enables self-service for every principal but this one.<br />
&nbsp;