#4679 talks about transparent migration. E.g., when user logs into Web UI and is not migrated (doesn't have kerberos keys generated), IPA can detect this state and inform the user.
Any action should be properly designed because it can have performance impact (additional query on auth fail).
Metadata Update from @pvoborni: - Issue assigned to someone - Issue set to the milestone: Future Releases
Login to comment on this ticket.