If krb is explicitly 'no' do not check for ipa