diff --git a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
index fa0c5cd37..f2804c9b2 100644
--- a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
+++ b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
@@ -89,8 +89,9 @@ ipa_kdcpolicy_check_as(krb5_context context, krb5_kdcpolicy_moddata moddata,
 
     ua = ied->user_auth;
 
-    /* If no mechanisms are set, allow every auth method */
-    if (ua == IPADB_USER_AUTH_NONE) {
+    /* If no mechanisms are set, or it is anonymous PKINIT, allow every auth method */
+    if ((ua == IPADB_USER_AUTH_NONE) ||
+        (request->kdc_options & KDC_OPT_REQUEST_ANONYMOUS)) {
         jitter(ONE_DAY_SECONDS, lifetime_out);
         kerr = 0;
         goto done;