Issue

This is known issue for transitive trusts. MIT Kerberos requires for non-hierarchical trusts that [capaths] section contains proper map of relationships between the realms.
There is an API to manage this map for IPA KDC driver. For IPA masters, it is written with the help of SSSD for KDC but on IPA clients it is not generated since receiving referrals from KDC was initially considered to be enough. However this has not proven to be enough and the issue is resolved in SSSD 1.12 version, where the map is also written on the IPA client:

commit:
    UTIL: Always write capaths

    We used to only generate the [capaths] section on the IPA server itself,
    when running in a trusted setup. But we also found out that the capaths
    are often required to make SSO fully work, so it's better to always
    generate them.