ipa-client-install --uninstall breaks host login with SELinux errors

Issue

• When we run a ipa-client-install --uninstall with SE Linux enforced, we cannot login using ssh keys or password via console after reboot. An autorelabel is required to fix the SElinux labels:

# ipa-client-install --uninstall
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The original nsswitch.conf configuration has been restored.
You may need to restart services or reboot the machine.
Do you want to reboot the machine? [no]: no
The ipa-client-install command was successful

• Then login or passwd command fails:

# passwd
Changing password for user root.
passwd: Permission denied