Issue

The pac type MS-PAC is needed in CentOS Stream 8 and 9 for authentication.

It is possible to remove it with ipa config --pac-type=""

The pac type MS-PAC should be the default and should also be added to pac type if it is missing or trying to remove it should result in an error.

Steps to Reproduce

1. ipa config --pac-type=""

Actual behavior

No MS-PAC for ipaKrbAuthzData:

ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)
or
ipa: ERROR: cannot connect to 'https:///ipa/session/json': Exceeded number of tries to forward a request.

Expected behavior

Either MS-PAC needs to be set as the default for pac type or the command should fail due to missing requirement.
Also setting the pac type that is missing MS-PAC should either be fixed or should fail.

Important:
- The need to have MS-PAC as pac type needs to be documented properly.
- The pac type MS-PAC needs to be enforced with an update to the IPA versions that depend on it.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.9.13-3.module+el8.10.0+21104+67b26c14.x86_64

Additional info:

The ansible-freeipa tests for ipaclient module are resetting the pac type to the default and are trying to set other pac types also. This results in broken authentication.

https://github.com/freeipa/ansible-freeipa/blob/master/tests/config/test_config_empty_string_params.yml