feat: use DNS discovery to find Kerberos servers

Rationale: when configured with /etc/krb5.conf, SSSD ignores the values
of dns_lookup_kdc and dns_lookp_realm properties, ignores the static kdc
servers declared in the [realms] section, and always try to find the
Kerberos TGT servers using DNS _srv_ discovery, based on the realm name
as search domain (which is not optimal in the Orange network).

It's easier to define how to get the list of Kerberos servers from the
SSSD configuration, because then you can either give a static list of
servers or use DNS discovery by specifying the right search domain.

If krb5_use_kdcinfo property value is true (the default), then the
Kerberos servers are taken from sssd.conf, otherwise if the value is
false then the servers are taken from krb5.conf

etc/sssd/sssd.conf

@@ -6,12 +6,14 @@ domains = ad.francetelecom.fr
 certificate_verification = no_ocsp
 services = nss
 
+
 [nss]
 filter_users = root
 filter_groups = root
 
+
 [pam]
-pam_verbosity = 3
+pam_verbosity = 2
 pam_account_expired_message = Account expired, please contact help desk.
 pam_account_locked_message = Account locked, please contact help desk
 pam_public_domains = ad.francetelecom.fr
@@ -19,19 +21,26 @@ pam_cert_auth = false
 p11_child_timeout = 60
 offline_credentials_expiration = 0
 
+
 [domain/ad.francetelecom.fr]
-min_id = 1000
 id_provider = files
+min_id = 1000
+max_id = 60000
+#
 auth_provider = krb5
-chpass_provider = none
-cache_credentials = true
-use_fully_qualified_names = false
 krb5_realm = AD.FRANCETELECOM.FR
 krb5_auth_timeout = 10
 krb5_store_password_if_offline = true
 krb5_lifetime = 24h
 krb5_renewable_lifetime = 7d
 krb5_renew_interval = 30m
-# see /etc/krb5.conf
-krb5_use_kdcinfo = false
+krb5_use_kdcinfo = true
+krb5_kdcinfo_lookahead = 5:2
+dns_discovery_domain = S-FT-FR-EBU._sites.ad.francetelecom.fr
+#
+chpass_provider = none
+#
+cache_credentials = true
+use_fully_qualified_names = false
+lookup_family_order = ipv4_only