I installed IPA replica. I have a master.ipa.pb and replica.ipa.pb servers. I lowered the priority of replace.ipa.pb in SRV records so it is always picked as second. When I stop kdc on master.ipa.pb I get this result:

Failover for ldap_child GSSAPI works. But failover doesn't work for krb5_child.

• If krb5_child can't contact kdc:
  (Thu May 18 13:23:17 2017) [[sssd[krb5_child[125945]]]] [get_and_save_tgt_with_keytab] (0x0020): 1459: [-1765328228][Cannot contact any KDC for requested realm]

• We bubble up with
  ERR_CREDS_EXPIRED

• Which result with terminating the child without sending a reply
  kerr = privileged_krb5_setup(kr, offline);
  if (kerr != 0) {
  DEBUG(SSSDBG_CRIT_FAILURE, "privileged_krb5_setup failed.\n");
  ret = EFAULT;
  goto done;
  }

• And we are unable to parse response in provider
  (Thu May 18 13:23:17 2017) [sssd[be[IPA.PB]]] [krb5_auth_queue_done] (0x0040): krb5_auth_recv failed with: 22
  (Thu May 18 13:23:17 2017) [sssd[be[IPA.PB]]] [ipa_pam_auth_handler_krb5_done] (0x0040): KRB5 auth failed [22]: Invalid argument

• And we finish without failover

  ret = parse_krb5_child_response(state, buf, len, pd,
  state->be_ctx->domain->pwd_expiration_warning,
  &res);
  if (ret) {
  DEBUG(SSSDBG_OP_FAILURE, "Could not parse child response [%d]: %s\n",
  ret, strerror(ret));
  goto done;
  }