dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
add: ipaAllowedTarget: 'cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX'

dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
default: objectClass: groupOfPrincipals
default: objectClass: top
default: cn: ipa-cifs-delegation-targets
default: memberPrincipal: cifs/$FQDN@$REALM

dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
add: memberPrincipal: cifs/$FQDN@$REALM