This is managed in the configuration of the SSH server.
You don't provide enough information as to what 'known in FreeIA' means in your use case, but, assuming you mean users are FreeIPA users, by default you would be using GSSAPI with SSH.
Assuming also there's a HBAC rule in place to allow SSH access to the host or hostgroup in question, SSH keys would be an additional mechanism to kerberos.
Check the sshd_config manual page for PasswordAuthentication and AuthenticationMethods for additional information.