Configure s4u2proxy during installation.
    
    This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX
    
    Within that container we control which services are allowed to
    delegate tickets for other services. Right now that is limited
    from the IPA HTTP to ldap services.
    
    Requires a version of mod_auth_kerb that supports s4u2proxy
    
    https://fedorahosted.org/freeipa/ticket/1098