does anyone know how to use the --principal flag when exporting kerberos keytabs with samba AD? i have a user with "two" SPNs:
User CN=nfs-host,CN=Users,DC=sub,DC=domain,DC=com has the following servicePrincipalName:
nfs/nfs-host.sub.domain.com@SUB.DOMAIN.COM
nfs/nfs-host@SUB.DOMAIN.COM
if i run
samba-tool domain exportkeytab krb5.keytab --principal=nfs-host
i get three keys (which i believe are the three different encryption types, not the user + two SPNs):
Keytab name: FILE:krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
2 nfs-host@SUB.DOMAIN.COM
2 nfs-host@SUB.DOMAIN.COM
2 nfs-host@SUB.DOMAIN.COM
but if i run
samba-tool domain exportkeytab krb5.keytab --principal=nfs/nfs-host
nothing gets exported. i also tried nfs/nfs-host@SUB.DOMAIN.COM, nfs/nfs-host.sub.domain.com@SUB.DOMAIN.COM, and every other combination i could think of, but nothings gets exported. what am i doing wrong?