Create a per-service default as well. https://fedorahosted.org/freeipa/ticket/2184
https://fedorahosted.org/freeipa/ticket/2344