this fix is need to make s4u2proxy delegation work when spnego mechs is used by the client instead of the raw krb5 mech. It can be reproduced with Firefox and ipa 2.2/master.
Fixed in 1.10, which is in F17. That's also the oldest release that we pushed IPA 2.2 for, so I'll mark this as CLOSED->CURRENTRELEASE.