diff --git a/install/ui/src/freeipa/host.js b/install/ui/src/freeipa/host.js
index 677da96f2..ba8d0f2a5 100644
--- a/install/ui/src/freeipa/host.js
+++ b/install/ui/src/freeipa/host.js
@@ -108,6 +108,26 @@ return {
                             name: 'macaddress',
                             flags: ['w_if_no_aci']
                         },
+                        {
+                            $type: 'custom_checkboxes',
+                            label: '@i18n:authtype.auth_indicators',
+                            name: 'krbprincipalauthind',
+                            add_dialog_title: '@i18n:authtype.custom_auth_ind_title',
+                            add_field_label: '@i18n:authtype.auth_indicator',
+                            options: [
+                                {
+                                    label: '@i18n:authtype.otp',
+                                    value: 'otp'
+                                },
+                                {
+                                    label: '@i18n:authtype.type_radius',
+                                    value: 'radius'
+                                }
+                            ],
+                            tooltip: {
+                                title: '@mc-opt:host_add:krbprincipalauthind:doc'
+                            }
+                        },
                         {
                             name: 'ipakrbokasdelegate',
                             $type: 'checkbox',
diff --git a/install/ui/test/data/ipa_init.json b/install/ui/test/data/ipa_init.json
index 8060d6993..32a6f1c56 100644
--- a/install/ui/test/data/ipa_init.json
+++ b/install/ui/test/data/ipa_init.json
@@ -49,6 +49,9 @@
                         "show_results": "Show Results"
                     },
                     "authtype": {
+                        "auth_indicators": "Authentication indicators",
+                        "auth_indicator": "Authentication indicator",
+                        "custom_auth_ind_title": "Add Custom Authentication Indicator",
                         "config_tooltip": "<p>Implicit method (password) will be used if no method is chosen.</p><p><strong>Password + Two-factor:</strong> LDAP and Kerberos allow authentication with either one of the authentication types but Kerberos uses pre-authentication method which requires to use armor ccache.</p><p><strong>RADIUS with another type:</strong> Kerberos always use RADIUS, but LDAP never does. LDAP only recognize the password and two-factor authentication options.</p>",
                         "otp": "OTP",
                         "type_otp": "Two factor authentication (password + OTP)",
@@ -543,10 +546,7 @@
                             "label_singular": "Server Role",
                         },
                         "service": {
-                            "auth_indicators": "Authentication indicators",
-                            "auth_indicator": "Authentication indicator",
                             "certificate": "Service Certificate",
-                            "custom_auth_ind_title": "Add Custom Authentication Indicator",
                             "delete_key_unprovision": "Delete Key, Unprovision",
                             "details": "Service Settings",
                             "host": "Host Name",
diff --git a/ipaserver/plugins/internal.py b/ipaserver/plugins/internal.py
index 204c153a8..5d17d6ecc 100644
--- a/ipaserver/plugins/internal.py
+++ b/ipaserver/plugins/internal.py
@@ -190,7 +190,10 @@ class i18n_messages(Command):
             "show_results": _("Show Results"),
         },
         "authtype": {
+            "auth_indicators": _("Authentication indicators"),
+            "auth_indicator": _("Authentication indicator"),
             "config_tooltip": _("<p>Implicit method (password) will be used if no method is chosen.</p><p><strong>Password + Two-factor:</strong> LDAP and Kerberos allow authentication with either one of the authentication types but Kerberos uses pre-authentication method which requires to use armor ccache.</p><p><strong>RADIUS with another type:</strong> Kerberos always use RADIUS, but LDAP never does. LDAP only recognize the password and two-factor authentication options.</p>"),
+            "custom_auth_ind_title": _("Add Custom Authentication Indicator"),
             "otp": _("OTP"),
             "type_otp": _("Two factor authentication (password + OTP)"),
             "type_password": _("Password"),
@@ -688,10 +691,7 @@ class i18n_messages(Command):
                 "label_singular": _("Server Role"),
             },
             "service": {
-                "auth_indicators": _("Authentication indicators"),
-                "auth_indicator": _("Authentication indicator"),
                 "certificate": _("Service Certificate"),
-                "custom_auth_ind_title": _("Add Custom Authentication Indicator"),
                 "delete_key_unprovision": _("Delete Key, Unprovision"),
                 "details": _("Service Settings"),
                 "host": _("Host Name"),