My organization is working to remove the need for passwords for its end-users.  While moving forward on this project I have noticed after logging into a system the user is never given a TGT after login.  A TGT can be obtained by using kinit and entering a password, but this defeats the purpose eliminating the use of passwords.  Is there some guidance I can follow to configure freeIPA to obtain a TGT at login.  So far my searches have come up empty.

Is this type of configuration handled by SSSD or do I need to configure kerberos?

Any guidance is greatly appreciated.

Michael Rainey