Document unlockiter

ticket: 7977

doc/admin/admin_commands/kadmin_local.rst

@@ -154,6 +154,19 @@ Supported options for the DB2 module are:
     **-x dbname=**\ \*filename*
         Specifies the base filename of the DB2 database.
 
+    **-x lockiter**
+        Make iteration operations hold the lock for the duration of
+        the entire operation, rather than temporarily releasing the
+        lock while handling each principal.  This is the default
+        behavior, but this option exists to allow command line
+        override of a [dbmodules] setting.  First introduced in
+        release 1.13.
+
+    **-x unlockiter**
+        Make iteration operations unlock the database for each
+        principal, instead of holding the lock for the duration of the
+        entire operation.  First introduced in release 1.13.
+
 Supported options for the LDAP module are:
 
     **-x host=**\ *ldapuri*

doc/admin/conf_files/kdc_conf.rst

@@ -456,6 +456,13 @@ The following tags may be specified in a [dbmodules] subsection:
     **ldap_kdc_sasl_authcid** or **ldap_kadmind_sasl_authcid** names
     for SASL authentication.  This file must be kept secure.
 
+**unlockiter**
+    If set to ``true``, this DB2-specific tag causes iteration
+    operations to release the database lock while processing each
+    principal.  Setting this flag to ``true`` can prevent extended
+    blocking of KDC or kadmin operations when dumps of large databases
+    are in progress.  First introduced in release 1.13.
+
 The following tag may be specified directly in the [dbmodules]
 section to control where database modules are loaded from: