When a client asks for a principal that is not handled by our KDC, but that we know another Realm we trust may be able to handle we should return WRONG_REALM and a referral instead of PRINCIPAL_NOT_FOUND.
This is a KDC action but can be triggered by returning the proper data from the ipa kdb plugin
Closing as duplicate to #3559.
Metadata Update from @simo: - Issue assigned to someone - Issue set to the milestone: FreeIPA 4.0 Backlog
Login to comment on this ticket.