The IPA client installer currently edits /etc/openldap/ldap.conf, setting up the client to consume LDAP data from IPA. It currently sets: URI BASE TLS_CACERT This PR makes ipa-client to add this AV pair: SASL_MECH GSSAPI Resolves: https://pagure.io/freeipa/issue/7366 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>