Propagate kinit errors with trust account
    
    When using Global Catalog for resolving users and groups, one needs
    to authenticate against Active Directory DC using GSSAPI. Obtaining
    Kerberos ticket might fail. Make sure the failure message is actually
    returned to the user so that decision can be made about the source
    of issue.
    
    https://fedorahosted.org/freeipa/ticket/3265