Modify principal selection for keytab authentication
    
    Currently we construct the principal as host/fqdn@REALM. The problem
    with this is that this principal doesn't have to be in the keytab. In
    that case the provider fails to start. It is better to scan the keytab
    and find the most suitable principal to use. Only in case no suitable
    principal is found the backend should fail to start.
    
    The second issue solved by this patch is that the realm we are
    authenticating the machine to can be in general different from the realm
    our users are part of (in case of cross Kerberos trust).
    
    The patch adds new configuration option SDAP_SASL_REALM.
    
    https://fedorahosted.org/sssd/ticket/781