If the SID was explicitly set for the host or service entry, honor it when issuing PAC. For normal services and hosts we don't allocate individual SIDs but for cifs/... principals on domain members we do as they need to login to Samba domain controller. Related: https://pagure.io/freeipa/issue/9031 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>