Bug 1437946

Cloned from upstream: https://pagure.io/freeipa/issue/6792

When upgrading from FreeIPA 4.4.3 to FreeIPA 4.5.0, the RPM upgrade fails with the following message:

```console
 Cleanup     : freeipa-client-common-4.4.3-2.fc25.noarch                                                     34/39 
  Cleanup     : freeipa-common-4.4.3-2.fc25.noarch                                                            35/39 
  Cleanup     : bind-pkcs11-libs-32:9.10.4-4.P6.fc25.x86_64                                                   36/39 
  Cleanup     : bind-libs-lite-32:9.10.4-4.P6.fc25.x86_64                                                     37/39 
  Cleanup     : bind-libs-32:9.10.4-4.P6.fc25.x86_64                                                          38/39 
  Cleanup     : bind-license-32:9.10.4-4.P6.fc25.noarch                                                       39/39 
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Failed to configure anonymous PKINIT
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
```

When inspecting `/var/log/ipaupgrade.log` we can see that the PKINIT keypair is issued but the anonymous principal is not created by upgrader code:

```console
<SNIP>
2017-03-21T15:51:07Z DEBUG stderr=
2017-03-21T15:51:07Z DEBUG Starting external process
2017-03-21T15:51:07Z DEBUG args=/usr/bin/kinit -n -c /tmp/krbccMLh35h/ccache
2017-03-21T15:51:07Z DEBUG Process finished, return code=1
2017-03-21T15:51:07Z DEBUG stdout=
2017-03-21T15:51:07Z DEBUG stderr=kinit: Client 'WELLKNOWN/ANONYMOUS' not found in Kerberos database while getting initial credentials

2017-03-21T15:51:07Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2017-03-21T15:51:07Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 48, in run
    raise admintool.ScriptError(str(e))

2017-03-21T15:51:07Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: Failed to configure anonymous PKINIT
2017-03-21T15:51:07Z ERROR Failed to configure anonymous PKINIT
```

This causes the password auth to IPA server (via JSON-RPC API or WebUI) to fail after upgrade and thus breaks the core functionality.

Steps to reproduce:

1.) Install FreeIPA 4.4.3 or older
2.) Upgrade to FreeIPA 4.5.0

Actual results:

Upgrade fails and WebUI logins on updated master do not work

Expected results:

Upgrade finishes without errors and WebUI works.