Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

16.4. Retrieve Existing Keytabs for Multiple Servers

In some scenarios, like in a cluster environment, the same keytab file is required for a service represented on one common host name by different machines. IdM commands can be used to retrieve the same keytab on each of the hosts.
To prepare the common host name and the service principal, run the following commands on an IdM server:
  1. Authenticate as admin user: 
    [root@ipaserver ~]# kinit admin
    Copy to Clipboard Toggle word wrap
  2. Add a common forward DNS record for all IP addresses that share this host name: 
    [root@ipaserver ~]# ipa dnsrecord-add idm.example.com cluster --a-rec={192.0.2.40,192.0.2.41}
  Record name: cluster
    A record: 192.0.2.40, 192.0.2.41
    Copy to Clipboard Toggle word wrap
  3. Create a new host entry object for the common DNS name: 
    [root@ipaserver ~]# ipa host-add cluster.idm.example.com
------------------------------------
Added host "cluster.idm.example.com"
------------------------------------
  Host name: cluster.idm.example.com
  Principal name: host/cluster.idm.example.com@IDM.EXAMPLE.COM
  Password: False
  Keytab: False
  Managed by: cluster.idm.example.com
    Copy to Clipboard Toggle word wrap
  4. Add the service principal for the host: 
    [root@ipaserver ~]# ipa service-add HTTP/cluster.idm.example.com
------------------------------------------------------------
Added service "HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM"
------------------------------------------------------------
  Principal: HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM
  Managed by: cluster.idm.example.com
    Copy to Clipboard Toggle word wrap
  5. Add the hosts to the service, that should be able to retrieve the keytab from IdM: 
    [root@ipaserver ~]# ipa service-allow-retrieve-keytab HTTP/cluster.idm.example.com --hosts={node01.idm.example.com,node02.idm.example.com}
  Principal: HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM
  Managed by: cluster.idm.example.com
  Hosts allowed to retrieve keytab: node01.idm.example.com, node02.idm.example.com
-------------------------
Number of members added 2
-------------------------
    Copy to Clipboard Toggle word wrap
  6. Grant permission to create a new keytab to one host: 
    [root@ipaserver ~]# ipa service-allow-create-keytab HTTP/cluster.idm.example.com --hosts=node01.idm.example.com
Principal: HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM
Managed by: cluster.idm.example.com
Hosts allowed to retrieve keytab: node01.idm.example.com, node02.idm.example.com
Hosts allowed to create keytab: node01.idm.example.com
-------------------------
Number of members added 1
-------------------------
    Copy to Clipboard Toggle word wrap
On the clients, follow these steps:
  1. Authenticate with the hosts Kerberos keytab: 
    # kinit -kt /etc/krb5.keytab
    Copy to Clipboard Toggle word wrap
    1. On the client you granted the respective permission to, generate a new keytab and store it in a file: 
      [root@node01 ~]# ipa-getkeytab -s ipaserver.idm.example.com -p HTTP/cluster.idm.example.com -k /tmp/client.keytab
      Copy to Clipboard Toggle word wrap
    2. On all other clients, retrieve the existing keytab from the IdM server by adding the -r option to the command: 
      [root@node02 ~]# ipa-getkeytab -r -s ipaserver.idm.example.com -p HTTP/cluster.idm.example.com -k /tmp/client.keytab
      Copy to Clipboard Toggle word wrap
      Warning
      Be aware that if you omit the -r option, a new keytab will be generated. This invalidates all previously retrieved keytabs for this service principal.
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat