ehlo,
I realized that it might be better to discuss it here rather then in
pull requests because it seems to be related to two different commits.
I will describe a test case on master with already created replica on another
host.
* kinit as admin
// create user with dummy password
* echo $dummypw | ipa user-add $login --first "$firstname" --last
"$lastname" \
--password
// adding sleep think that first kinit hits slave sometimes and the user is
// not replicated yet.
* sleep 2
* FirstKinitAs $login $dummypw $password
FirstKinitAs is a bash function which change initial password
something like: echo -e "$password\n$newpassword\n$newpassword" | kinit -V
$username
Such test works reliably with 1.15.3 and kinit always talk to local master
(I didn't try to remove sleep 2)
But situation changed a little bit with git master due to following commits
IPA: Only generate kdcinfo files on clients
https://pagure.io/SSSD/sssd/c/a309525cc47da726461aec1f238165c17aade2a6
localauth plugin: change return code of sss_an2ln
https://pagure.io/SSSD/sssd/c/3f94a979eebd1c9496b49b4e07b7823550dec97e
It is enough to revert just one of these patches and situation is back stable
BTW failure is not 100% reliable but it happens quite often 40-60% of cases.
And I think kinit on IPA server should always talk to local KDC unless
it is down.
Attaching two logs with KRB5TRACE + SSSD_KRB5_LOCATOR_DEBUG
LS