krbLastAdminUnlock was only a part of my issue.
I was able to resolve this issue, but not in the manner I expected.
A careless administrator overwrote the keytabs on two FreeIPA servers while he was
generating keytabs for MacOS hosts.
Somehow, FreeIPA still functioned, the only repercussion was that some users (but not all)
were unable to ssh into the IPA servers.
The syslog did log this as a keytab issue.
I was able to recover the original keytabs with "ipa-getkeytab -r”
- grant