The following known issue description has been removed from the RHEL 7.0 Release Notes.
The Identity Manager (IdM) Kerberos driver does not actively update default PAC types for Kerberos tickets issued by IdM Kerberos key distribution center (KDC). Consequently, if the default list of PAC types is changed in the IdM configuration, the IdM Kerberos KDC does not generate the configured PAC types for the issued tickets until the KDC is restarted. To change the default list, run the "ipa config-mod --pac-type <NEW-PAC-TYPES>" command. To work around this problem, restart the IdM Kerberos KDC service on all IdM servers. As a result, IdM Kerberos KDC generates the configured PAC types as set in the IdM server configuration.