The client does a fair bit of work when trying to validate the hostnames, do discovery and verify that the server it gets back is an IPA server. The debug logging around this is horrid with very little state information, duplicate log messages or just nothing at all.

In many cases errors are printed only to stderr/stdout.

This needs to be revisited to make debugging enrollment problems easier.