The recently released Bronze-Bit detection mechanism relies on the PAC to filter S4U2Proxy requests. However on FreeIPA v4.9, for the PAC to be present, the impersonated principal need to have an SID.

IPA domains initialized before the SID generation task was executed as part of ipa-server-install may still not have PACs generated in tickets if this task was not executed by administrators. This is a major issue as updating IPA on these domains will cause the HTTP API to stop working, because the API relies on S4U2Proxy, and the Bronze-Bit check needs an evidence ticket with a PAC to accept the request.

The Bronze-Bit check should be executed only if the IPA domain is able to generate PACs.