I know this ticket is scheduled for RC2 but I suspect it is the root
cause of problems we were seeing in production and I wanted to provide a
scratch buil.
https://fedorahosted.org/sssd/ticket/1452
We always try to resolve the kpasswd server even when we're just
authenticating the user so that tools such as kpasswd work. However, we
should treat errors from this step as fatal only when actually changing
passwords.