This is a clone of https://redhat.atlassian.net/browse/RHEL-174626

What were you trying to do that didn't work?

Attempting to install a FreeIPA replica using ipa-replica-install in the following environment:
- Master: RHEL 8.10 with FIPS enabled
- Replica: RHEL 9.8 with FIPS enabled

Replica installation fails during ipa-replica-conncheck with Kerberos/GSSAPI authentication errors.

Observed error:

KerberosError: No credentials found with supported encryption types

Both:
- JSON RPC connection
- SSH GSSAPI fallback
fail with the same error.

What is the impact of this issue to you?

This prevents deployment of FreeIPA replicas in mixed-version FIPS environments.

Specifically:
RHEL 9 FIPS replicas cannot be promoted from RHEL 8 FIPS masters

Automated CI/testing involving mixed-version FIPS deployments fails

Existing upgrade and topology expansion workflows are blocked

How reproducible is this bug?:

100% reproducible in tested environments.

Observed consistently when:
- Master is RHEL 8 FIPS enabled
- Replica is RHEL 9 FIPS enabled

Replica promotion uses Kerberos/GSSAPI during ipa-replica-install

Steps to reproduce

1. Install FreeIPA master on RHEL 8.10 with FIPS enabled.
2. Install RHEL 9.8 system with FIPS enabled.
3. Attempt replica installation:

ipa-replica-install -U \
    --setup-dns \
    --no-dnssec-validation \
    --forwarder 10.11.5.19 \
    --setup-ca \
    --allow-zone-overlap \
    --server master.testrealm.test \
    --domain testrealm.test \
    --principal admin \
    --admin-password Secret123

Observe failure during ipa-replica-conncheck.

Expected results

Replica installation should succeed.

ipa-replica-conncheck should honor system crypto policy/FIPS configuration and negotiate supported SHA-2 encryption types successfully.

Actual results

Replica installation fails during connection checks with:

KerberosError: No credentials found with supported encryption types

and:

Connection closed during gssapi-with-mic