List<Modification> mods = new ArrayList<Modification>(2);
EntryAttribute newPasswordAttribute = new DefaultServerAttribute(
schemaManager.lookupAttributeTypeRegistry( SchemaConstants.USER_PASSWORD_AT ), StringTools.getBytesUtf8( newPassword ) );
mods.add( new ServerModification( ModificationOperation.REPLACE_ATTRIBUTE, newPasswordAttribute ) );
EntryAttribute principalAttribute = new DefaultServerAttribute(
schemaManager.lookupAttributeTypeRegistry( KerberosAttribute.KRB5_PRINCIPAL_NAME_AT ), principal.getName() );
mods.add( new ServerModification( ModificationOperation.REPLACE_ATTRIBUTE, principalAttribute ) );
//FIXME check if keyderivation is necessary
ServerEntry entry = StoreUtils.findPrincipalEntry( session, searchBaseDn, principal.getName() );
session.modify( entry.getDn(), mods );