Configure the ipa_pwd_extop plugin on replicas.
    
    If plugin isn't configured then the kerberos attributes don't get populated.
    User's will get Preauthentication errors from the kerberos libraries
    because there is no krbPrincipalKey to match against.
    
    442134