Privileged service impersonation via realm-unaware uniqueness check

Privilege escalation in FreeIPA in Red Hat Enterprise Linux allows remote authenticated users to impersonate privileged services via LDAP writes. The 389-ds uniqueness constraint for Kerberos principal names does not treat equivalent realm forms as the same principal, so a new service entry can set krbCanonicalName to an existing privileged identity and bypass the intended uniqueness check. Exploitation requires LDAP write rights such as a computer account or another principal allowed to add service objects, and it yields unauthorized Kerberos service tickets that can enable domain compromise.