In some deployments, where bad reverse DNS address are present, logging in using SSH and GSSAPI in an IPA installation may fail due to reverse lookups returning bad information and making SSH fail to pass the right name to the GSSAPI library.

In order to mitigate this issue administrators can set:
GSSAPITrustDNS = no in their /etc/ssh/ssh_config files on clients.

This prevents SSH from using reverse lookups and passes to libgssapi directly the name presented by the user. This in turn allow libgssapi to properly obtain a service ticket to access the target machine.

This should be a documented configuration step for ipa clients as it resolves situations where GSSAPI would be unusable otherwise.