diff --git a/ipalib/errors.py b/ipalib/errors.py
index b599b83f1..fa51e15c0 100644
--- a/ipalib/errors.py
+++ b/ipalib/errors.py
@@ -249,7 +249,7 @@ class KrbPrincipalWrongFAST(PrivateError):
     """
     Raised when it is not possible to use our FAST armor for kinit
     """
-    format = '%(principal) cannot use Anonymous PKINIT as a FAST armor'
+    format = '%(principal)s cannot use Anonymous PKINIT as a FAST armor'
 
 ##############################################################################
 # Public errors:
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py
index 4d0fac912..ed775170e 100644
--- a/ipaserver/rpcserver.py
+++ b/ipaserver/rpcserver.py
@@ -1103,8 +1103,7 @@ class login_password(Backend, KerberosSession):
                                  message=unicode(e))
             elif ('kinit: Error constructing AP-REQ armor: '
                   'Matching credential not found') in str(e):
-                raise KrbPrincipalWrongFAST(principal=principal,
-                                            message=unicode(e))
+                raise KrbPrincipalWrongFAST(principal=principal)
             raise InvalidSessionPassword(principal=principal,
                                          message=unicode(e))