From freeipa-devel thread: comparing master's ipa-kdb's handling of krbPrincipalName and krbCanonicalName attributes with that of the upstream kldap driver, there are a few differences which I'm thinking are bugs.

• If an entry has multiple krbPrincipalName values, the name which was used to look it up is required to match only the last value of the attribute that we read, not any of them.
• If an entry has a krbCanonicalName value, and the name which we used to look it up doesn't match it, if database aliases are allowed, we return an error instead of using it to populate the returned entry.