diff --git a/daemons/ipa-kdb/ipa_kdb_principals.c b/daemons/ipa-kdb/ipa_kdb_principals.c
index e7fd38855..e94e1f87d 100644
--- a/daemons/ipa-kdb/ipa_kdb_principals.c
+++ b/daemons/ipa-kdb/ipa_kdb_principals.c
@@ -2063,6 +2063,7 @@ done:
 static bool should_filter_out_attr(krb5_tl_data *data)
 {
     switch (data->tl_data_type) {
+        case KRB5_TL_CONSTRAINED_DELEGATION_ACL:
         case KRB5_TL_DB_ARGS:
         case KRB5_TL_KADM_DATA:
         case KRB5_TL_LAST_ADMIN_UNLOCK: