Hi,
this is an attempt to fix bz#571896 aka trac#415. A new parameter
krb5_kadmin is introduced together with a new failover service in the
Kerberos provider. If the change password service is not available the
backend is not switched to offline mode unless authentication isn't
possible too.
I haven't add to option to the IPA provider, because I think here the
kpasswd always runs together with the KDC.
bye,
Sumit