When IPA CLI is used, it expects Kerberos ticket is available in a default credentials cache. For passwordless methods it means users have to first obtain some ticket to create a FAST channel (e.g. Anonymous PKINIT) and then use kinit -T FAST-ccache to obtain actual ticket. This is not always user friendly.

It would be better to make sure IPA CLI asks for the required credentials when they are missing and would obtain the tickets automatically. For passwordless method that would mean handling of both FAST and the TGT itself.

As a first step, implement asking for a password only. This would not support passwordless methods but would improve usability for users who have no Kerberos ticket available.