krb5_ldap_get_string
ret = krb5_ldap_get_string(ld, ent, "krbticketpolicyreference", &policydn,
ret = krb5_ldap_get_string(ld, ent, "krbpwdpolicyreference", &pwdpolicydn,
ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled,
krb5_ldap_get_string(LDAP *, LDAPMessage *, char *, char **, krb5_boolean *);
st = krb5_ldap_get_string(ld, ent, "krbpwdallowedkeysalts",
st = krb5_ldap_get_string(ld, ent, "cn", &policy, &attr_present);