If trust relationship between FreeIPA and Active Directory is configured (established/created), AD users can bypass authentication of the FreeIPA portal, SMB server, LDAP directory and, presumably, any other GSSAPI services unauthorized, using impersonation in TGS, under certain conditions. In the worst case scenario a user could escalate their priveleges (permissions/rights) in FreeIPA domain. This is due to the fact that the portal, like other GSSAPI services, is not configured to verify PAC certificates and trusts the TGS cname field.