Oh ok, so I just need to create IPA host and let admin fetch its keytab on all real hosts running the service. Fair enough, thanks!

Btw in the meantime I discovered that it is possible to retrieve user's keytab with "ipa-getkeytab -r" if you authenticate as "cn=Directory Manager". Apparently, it has the rights to do this. But the only way then is by specifying its password in command line with "ipa-getkeytab -w" (it doesn't support prompting you securely, like kinit or ldapsearch do). So it is NOT a good idea to do so, unless you then clean up your history etc.... Better not :)

---
Regards,
Dmitry Perets

On Fri, 22 Nov 2019, 21:01 Alexander Bokovoy, <abokovoy@redhat.com> wrote:
On pe, 22 marras 2019, Charles Hedrick wrote:
>Bound in the sense that it has the hostname as part of the principal,
>not in the sense that there’s any actual connection with that host when
>you use it.
>
>Dmitry Perets wants to use the same principal and key table on several
>hosts. They can simply create a principal for one of them. It and its
>key table can be used anywhere. We do it regularly. I would prefer this
>not to work, but it does.

Correct. And it doesn't need any of the newer functionality too.

>
>On Nov 22, 2019, at 2:40 PM, Alexander Bokovoy <abokovoy@redhat.com<mailto:abokovoy@redhat.com>> wrote:
>
>No, this is not really what it is. Service principals are always bound
>to a host name but starting with FreeIPA 4.7.0 it is possible to create
>service principals that have no host object with the same host name.
>


--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland