[Freeipa-users] Obtain TGT at login.

Greetings, My organization is working to remove the need for passwords for its end-users.  While moving forward on this project I have noticed after logging into a system the user is never given a TGT after login.  A TGT can be obtained by using kinit and entering a password, but this defeats the purpose eliminating the use of passwords.  Is there some guidance I can follow to configure freeIPA to obtain a TGT at login.  So farmy searches have come up empty. Is this type of configuration handled by SSSD or do I need to configure kerberos? Any guidance is greatly appreciated. Thanks, -- *Michael Rainey*