s4-kdc use 'flags' to only create the 'admin data' elements when requested