S4U2Self operation needs better support in IPA KDB driver. In particular, cross-realm S4U2Self does not produce PAC in the resulting ticket which makes it useless for group membership checks.

In addition, with MIT Kerberos 1.18, the API for sign_authdata() was extended to allow the callback to provide information about authentication indicators in PAC or generate them based on the PAC content.

This ticket should be used to track refactoring of ipadb_sign_authdata() code.