Password-based login in Web UI is performing a Kerberos TGT request using the password provided in the login form. In order to support RADIUS and OTP authentication, this mechanism is first acquiring an Anonymous PKINIT ticket and then using it as the FAST channel to do actual TGT request.

For trusted users this approach does not work because we limit Anonymous PKINIT use in FreeIPA KDC configuration to only request TGTs. For trust operations we have to request a cross-realm TGT through a TGS request and this fails for Anonymous PKINIT FAST channel as violating a KDC policy (as expected).

Password-based authentication in Web UI for trusted AD users is implemented via a fallback from using an Anonymous PKINIT as the FAST channel to a direct TGT request to AD DCs. This will not work in the case a trusted IPA user has passwordless mechanism enabled such as RADIUS or OTP. In those cases we have to use a different ticket as a FAST channel.

We need to switch to HTTP/<ipa-server> as a FAST principal directly and use it instead of Anonymous PKINIT. The downside is that from IPA API endpoint code (ipaserver/rpcserver.py) we don't have direct access to the HTTP/<ipa-server> principal's keytab, it is handled by the GSSProxy. As a result, we can acquire the ticket and store it in the armor credential cache but it will be unusable to raw Kerberos because it will be encrypted by the GSSProxy. And we cannot use GSSAPI calls with FAST as it is not supported there.

Neither HTTP keytab nor HTTP service certificate/key are accessible to ipaapi user (they all owned by root). So we cannot use keytab-based kinit or PKINIT-based kinit directly. An alternative could be to move our current direct calls to kinit into a separate oddjob-based helper. The end result is always a credentials cache. This would increase potential auth time and reduce number of parallel authentications... We can move a FAST channel ticket acquisition only and let the rest be done the same way as before. However, this means a ccache will be left unencrypted on disk for some time.

Please note that this infrastructure change will also be needed to support passwordless authentication in Web UI as well, though for in-realm IPA users we can continue relying on Anonymous PKINIT for the FAST channel.