my initial reaction is that it seems like freeipa should stick freeipa sockets in /run/freeipa not /run/krb5kdc. However, it looks like the OTP plugin in the MIT code looks at this patch although it doesn't create a socket there. Note to myself for when I look at this bug after stretch release.
- Bug#859243: please include tmpfiles.d snippet for OTP rundi... Timo Aaltonen
- Bug#859243: please include tmpfiles.d snippet for OTP ... Benjamin Kaduk
- Bug#859243: please include tmpfiles.d snippet for OTP ... Sam Hartman