At this point I am mostly looking for confirmation/denial of the following observed behavior:

FreeIPA Kerberos will issue service tickets to a user with a valid TGT regardless of access control rules (HBAC).

Procedure to observe:

1. Create a test user.
2. Allow that user to login to one host, and just one (via ssh or so), HBAC is used.
3. Check that the user has a TGT (klist),or issue kinit as needed.
4. Try to ssh (or connect to any other Kerberos service) to any other server, you will probably get access denied (PAM-based services) because of HBAC, or even allowed (Kerberos-based services that do not use PAM).
5. Get that ticket list again: you got service ticket for every single host, even the ones to which you do not have access.

This is causing me great grieving ( :( ), because I was hoping to control authorization to a Kerberos service using FreeIPA, it turns out it just allows everyone in and now I have to add authorization at the service level, which could eventually use PAM, but... come on, why doesn't FreeIPA inspect access policies before issuing the ticket? (unless it does and I am missing something?)

So... can you confirm if what I found is the way it is supposed to work in its current state? (version 4.5.0)