I tried the trick of running:
ipa config-mod --add-sids --enable-sid
on my 2 ipa servers (one in 8 and one in 9) and it did not cure the
authentication problem for my clients hitting the newest sever.
The disable_pac=true trick did the work, but it is unsafe.
I wonder if I need to issue the ipa idrange... command as proposed by
Charles some messages above.
Cheers,
Isidro