Issue

Having a user as myusr@myrealm and a relative principal myusr/myinstance@myrealm, the vault owned by the user is not accessible using the principal myusr/myinstance@myrealm.

Steps to Reproduce

1. authenticate to freeipa as user and create a principal user@realm and create a vault: ipa vault-add myvault
2. authenticate to freeipa with a ticket with principal such as myusr/@myrealm and run ipa vault-find. it won't list the vaults belonging to myusr.

Actual behavior

In order to let the session using the principal myusr/@myrealm, it is necessary to share the container suing ipa vault-add-member, but the share doesn't work if the session on the instance is not alive or it just disappears when the session is closed.

Expected behavior

Every time a user comes with whatever principal user/[instance]@realm it should see its vault containers.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.11-7.module+el8.8.0+19639+24a8b95c.x86_64
ipa-client-4.9.11-7.module+el8.8.0+19639+24a8b95c.x86_64
389-ds-base-1.4.3.35-2.module+el8.8.0+19693+b24f535c.x86_64
package pki-ca is not installed
krb5-server-1.18.2-25.el8_8.x86_64