The code that handles password login into FreeIPA WebUI currently does not support logging in using Kerberos principal aliases, enterprise principals or trusted users.

To achieve this, the logic of the login_password handler class in ipaserver/rpcserver.py has to be altered to do only basic syntactic validation of incoming usernames, treat them as enterprise principals, and letting our KDC to sort them out since it now can handle all of these scenarios properly.

This infrastructure change is required to allow trusted AD user self-service using Web interface.