Description of problem:
While installing IPA, saw following

Configuring directory server (dirsrv). Estimated time: 10 seconds
  [1/3]: configuring ssl for ds instance
  [2/3]: restarting directory server
  [3/3]: adding CA certificate entry
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc). Estimated time: 30 seconds
  [1/10]: adding sasl mappings to the directory
  [2/10]: adding kerberos container to the directory
  [3/10]: configuring KDC
  [4/10]: initialize kerberos container
Failed to initialize the realm container
  [5/10]: adding default ACIs
  [6/10]: creating a keytab for the directory
  [error] CalledProcessError: Command ''kadmin.local' '-q' 'addprinc -randkey
ldap/nocp6.idm.lab.eng.rdu2.redhat.com@IDM.LAB.ENG.RDU2.REDHAT.COM' '-x'
'ipa-setup-override-restrictions'' returned non-zero exit status 1
ipa.ipapython.install.cli.install_tool(Server): ERROR    Command
''kadmin.local' '-q' 'addprinc -randkey
ldap/nocp6.idm.lab.eng.rdu2.redhat.com@IDM.LAB.ENG.RDU2.REDHAT.COM' '-x'
'ipa-setup-override-restrictions'' returned non-zero exit status 1

Version-Release number of selected component (if applicable):
[root@nocp6 ~]# rpm -q ipa-server krb5-server python-krbV
ipa-server-4.2.0-1.el7.x86_64
krb5-server-1.13.2-3.el7.x86_64
python-krbV-1.0.90-8.el7.x86_64
[root@nocp6 ~]#

How reproducible:
Always

Additional info:
(1) No avc denial
(2) Nothing in /var/log/kadmind.log