Some of the older non tunnelled authentication methods like a time stamp are susceptible to the dictionary attacks. More details on the issue can be read in RFC4120 chapter 10 paragraph 6.

This can be addressed by using FAST tunnel or anonymous pkinit. Upcoming SPAKE solution also addressed the issue algorithmically.

To be able to use Kerberos in environments with tightened security policies there needs to be an easy way to only allow SPAKE, FAST or pkinit based authentication and not allow other older less secure methods.

This RFE asks for:
- Collaboration with Kerberos upstream to provide such knob
- Have a way to make this change in IPA in a manageable way (UI/CLI or some simple documented procedure)