Description of problem:
when user kinit at first time, 8-bit string can not be used as password.
after the first kinit, user is be able to use 8-bit string as password.

Version-Release number of selected component (if applicable):
[yi@fig (RH6.3-x86_64) ipa-password] rpm -qi ipa-server
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.2.0                             Vendor: Red Hat, Inc.
Release     : 16.el6                        Build Date: Sat 26 May 2012
07:13:12 PM PDT
Install Date: Mon 04 Jun 2012 10:03:47 AM PDT      Build Host:
x86-007.build.bos.redhat.com
Group       : System Environment/Base       Source RPM:
ipa-2.2.0-16.el6.src.rpm
Size        : 3779984                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server
Description :
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If you are installing an IPA server you need
to install this package (in other words, most people should NOT install
this package).


How reproducible: always


Steps to Reproduce:
1. install ipa server
2. kinit as admin
3. create a new user : testuser13693
4. as admin, assign initial password : "redhat"
5. run "kinit testuser13693"
6. enter initial password "redhat"
7. for new passowrd, use : p.1000?X.1



Actual results:
[yi@fig (RH6.3-x86_64) ipa-password] kinit testuser13693
Password for testuser13693@YZHANG.REDHAT.COM:
Password expired.  You must change it now.
Enter new password:
Enter it again:
Password change rejected: Password not changed.
Kerberos database constraints violated while trying to change password.
.  Please try again.