[Freeipa-users] Failed to authenticate: KDC returned error string: PAC_ENFORCEMENT_TGT_WITHOUT_PAC

[Brian J. Murrell]

Hi.

I just upgraded my FreeIPA EL8.10 host to:

4.9.13-20.module_el8.10.0+4050+3b475c71 from:

4.9.13-18.module_el8.10.0+4036+84b152d9

and now I am getting a slew of:

Failed to authenticate: KDC returned error string:
PAC_ENFORCEMENT_TGT_WITHOUT_PAC

from SASL driven "password" login services.

I tried to roll back using dnf but IPA refuses to start after it has
been upgraded and then rolled back.  What a pity.

Any ideas what the above error is meaning and how I can resolve it? 
Google has no idea about that error at all, sadly.

Cheers,
b.