I'm trying to set up kerberos auth with fedora infrastructure, but it looks like there's a fas->ipa syncing problem, because the password I use for FAS is not accepted.

$ ./KrbDebug
test_01_installed (main.TestKerberos) ... ok
test_02_using_collection (main.TestKerberos) ... ok
test_03_configuration (main.TestKerberos) ... ok
test_04_kinit (main.TestKerberos) ... ok

Ran 4 tests in 0.838s

OK
$ KRB5_TRACE=/dev/stdout kinit pmoravco@FEDORAPROJECT.ORG
[9167] 1487938069.438026: Resolving unique ccache of type KEYRING
[9167] 1487938069.438051: Getting initial credentials for pmoravco@FEDORAPROJECT.ORG
[9167] 1487938069.438137: Sending request (199 bytes) to FEDORAPROJECT.ORG
[9167] 1487938069.438229: Resolving hostname id.fedoraproject.org
[9167] 1487938069.478434: Terminating TCP connection to https 2605:bc80:3010:600:dead:beef:cafe:feda:443
[9167] 1487938069.479966: Terminating TCP connection to https 2604:1580:fe00:0:dead:beef:cafe:fed1:443
[9167] 1487938069.481718: Terminating TCP connection to https 2605:bc80:3010:600:dead:beef:cafe:fed9:443
[9167] 1487938069.483596: Terminating TCP connection to https 2610:28:3090:3001:dead:beef:cafe:fed3:443
[9167] 1487938069.485059: Terminating TCP connection to https 2607:f188::dead:beef:cafe:fed1:443
[9167] 1487938069.775258: TLS certificate name matched "id.fedoraproject.org"
[9167] 1487938069.896152: Sending HTTPS request to https 152.19.134.142:443
[9167] 1487938070.642482: Received answer (275 bytes) from https 152.19.134.142:443
[9167] 1487938070.642511: Terminating TCP connection to https 152.19.134.142:443
[9167] 1487938070.644409: Terminating TCP connection to https 140.211.169.206:443
[9167] 1487938070.644502: Response was not from master KDC
[9167] 1487938070.644560: Received error from KDC: -1765328359/Additional pre-authentication required
[9167] 1487938070.644680: Processing preauth types: 136, 19, 2, 133
[9167] 1487938070.644697: Selected etype info: etype aes256-cts, salt "XJ^hFbU>0%cC#E", params ""
[9167] 1487938070.644706: Received cookie: MIT
Password for pmoravco@FEDORAPROJECT.ORG:
[9167] 1487938078.536321: AS key obtained for encrypted timestamp: aes256-cts/E8E2
[9167] 1487938078.536357: Encrypted timestamp (for 1487938077.158647): plain 301AA011180F32303137303232343132303735375AA1050203026BB7, encrypted D537FE9CCDEE800F38E35A6C9756F6284356324E8A0D8918925B5A6459BD73CF159B2D47D0F4FC30A5F43800DFC7891164FD735F12DA01F7
[9167] 1487938078.536373: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[9167] 1487938078.536377: Produced preauth for next request: 133, 2
[9167] 1487938078.536392: Sending request (294 bytes) to FEDORAPROJECT.ORG
[9167] 1487938078.536420: Resolving hostname id.fedoraproject.org
[9167] 1487938078.562374: Terminating TCP connection to https 2604:1580:fe00:0:dead:beef:cafe:fed1:443
[9167] 1487938078.563875: Terminating TCP connection to https 2605:bc80:3010:600:dead:beef:cafe:fed9:443
[9167] 1487938078.565136: Terminating TCP connection to https 2610:28:3090:3001:dead:beef:cafe:fed3:443
[9167] 1487938078.566398: Terminating TCP connection to https 2607:f188::dead:beef:cafe:fed1:443
[9167] 1487938078.567972: Terminating TCP connection to https 2605:bc80:3010:600:dead:beef:cafe:feda:443
[9167] 1487938078.930486: TLS certificate name matched "id.fedoraproject.org"
[9167] 1487938079.98212: Sending HTTPS request to https 140.211.169.206:443
[9167] 1487938079.511625: Received answer (189 bytes) from https 140.211.169.206:443
[9167] 1487938079.511662: Terminating TCP connection to https 140.211.169.206:443
[9167] 1487938079.513628: Response was not from master KDC
[9167] 1487938079.513688: Received error from KDC: -1765328353/Decrypt integrity check failed
[9167] 1487938079.513718: Retrying AS request with master KDC
[9167] 1487938079.513731: Getting initial credentials for pmoravco@FEDORAPROJECT.ORG
[9167] 1487938079.513830: Sending request (199 bytes) to FEDORAPROJECT.ORG (master)
kinit: Password incorrect while getting initial credentials