6.2. Exporting keytab
Warning
Exporting a new keytab resets the secret associated with the service principal and invalidates any keytabs created previously for the principal.
To export a keytab for the server, do the following:
- Obtain the Kerberos ticket-granting ticket for an administrator: issue the command
kinit <admin>. - To obtain the keytab, issue the command
ipa-getkeytabwith the options:- -s
- FreeIPA server to obtain the keytab from
- -p
- Non-realm part of the full principal name
- -k
- File to append the keytab
Figure 6.3. Get Keytab
Once you have set up the service principal and exported the keytab, make sure your server security domain uses the output keytab file (refer to Section 2.2, “Defining Server Security Domain”) and configure the second login module to allow the client to load the roles assigned to the authenticated user (refer to Section 2.4, “Role Mapping”).
