We want to let AD admins install new linux FreeIPA clients using their AD credentials.  It looks like if fails using kinit in the script.  If you run kinit 'AD\ad_admin' you get the same error.

Is it feasible to do what we want?  Does it make sense?  We already have a system for managing the sysadmins in AD and don't really want to setup double accounts for them.  (We have lots of sysadmins).

Thanks,
Steve