Description of problem:
It is possible to add a new user into krb5 db via kadmin although there is an option "supported_enctypes = arcfour-hmac:normal" in kdc.conf file and FIPS mode is enabled.
In my opinion, it should not be possible to do it because rc4 enctype is not FIPS compliance. 

Version-Release number of selected component (if applicable):
RHEL-8.2.0-20191120.0
krb5-1.17-17.el8.x86_64
openssl-1.1.1c-8.el8.x86_64

How reproducible:
always

Steps to Reproduce:
FIPS is enabled
export krb5REALM='TEST.COM'
export krb5HostName=`hostname`
export krb5DomainName=`hostname -d`
export krb5conf="/etc/krb5.conf"
export krb5confdir="/etc/krb5.conf.d"
export krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf"
export krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl"

1. sed -i "s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM/" $krb5conf
2. sed -i "s/\[realms\]/[realms]\n $krb5REALM = {\n  kdc = $krb5HostName\n  admin_server = $krb5HostName\n }/" $krb5conf
3. sed -i "s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM\n $krb5DomainName = $krb5REALM/" $krb5conf
4. sed -i s/EXAMPLE.COM/$krb5REALM/ $krb5kdcconf
5. sed -i s/EXAMPLE.COM/$krb5REALM/ $krb5kadmacl
6. restorecon -Rv $krb5conf /var/kerberos/krb5kdc
7. kdb5_util create -s -P password
8. sed -i 's/supported_enctypes.*/supported_enctypes = arcfour-hmac:normal/' $krb5kdcconf"
9. systemctl start kadmin; systemctl start krb5kdc
10.kadmin.local -q "addprinc -pw $krb5RootPass root/admin"
11. kadmin.local -q "addprinc -pw bob bob"

Actual results:
[root]# kadmin.local -q "ank -pw bob bob"
Authenticating as principal root/admin with password.
WARNING: no policy specified for bob; defaulting to no policy
Principal "bob" created.

[root]# kadmin.local -q "getprinc bob"
Authenticating as principal root/admin with password.
Principal: bob
Expiration date: [never]
Last password change: Tue Nov 26 09:08:36 EST 2019
Password expiration date: [never]
Maximum ticket life: 1 day 00:00:00
Maximum renewable life: 0 days 00:00:00
Last modified: Tue Nov 26 09:08:36 EST 2019 (root/admin)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 1, DEPRECATED:arcfour-hmac
MKey: vno 1
Attributes:
Policy: [none]

Expected results:
[root]# kadmin.local -q "ank -pw bob bob"
Authenticating as principal root/admin.COM with password.
WARNING: no policy specified for bob.COM; defaulting to no policy
add_principal: Cryptosystem internal error while creating "bob.COM".

Additional info:
/etc/krb5.conf
includedir /etc/krb5.conf.d/

[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = TEST.COM
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
    spake_preauth_groups = edwards25519
    default_ccache_name = KEYRING:persistent:%{uid}
[realm]
---snipped---

kdc.conf
[kdcdefaults]
    kdc_ports = 88
    kdc_tcp_ports = 88
    spake_preauth_kdc_challenge = edwards25519

[realms]
TEST.COM = {
     acl_file = /var/kerberos/krb5kdc/kadm5.acl
     dict_file = /usr/share/dict/words
     admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
     supported_enctypes = arcfour-hmac:normal
}


Symlink to crypto-policies was removed.
TC#574624: /CoreOS/krb5/Sanity/sanity-test-of-cipher-suites