Usage: ipa-getkeytab [OPTION...]
  -q, --quiet                                              Print as little as
                                                           possible
  -v, --verbose                                            Print debugging
                                                           information
  -s, --server=Server Name                                 Contact this
                                                           specific KDC Server
  -p, --principal=Kerberos Service Principal Name          The principal to
                                                           get a keytab for
                                                           (ex:
                                                           ftp/ftp.example.com@EXAMPLE.COM)
  -k, --keytab=Keytab File Name                            The keytab file to
                                                           append the new key
                                                           to (will be created
                                                           if it does not
                                                           exist).
  -e, --enctypes=Comma separated encryption types list     Encryption types to
                                                           request
      --permitted-enctypes                                 Show the list of
                                                           permitted
                                                           encryption types
                                                           and exit
  -P, --password                                           Asks for a
                                                           non-random password
                                                           to use for the
                                                           principal
  -D, --binddn=DN to bind as if not using kerberos         LDAP DN
  -w, --bindpw=password to use if not using kerberos       LDAP password
  -W                                                       Prompt for LDAP
                                                           password
      --cacert=IPA CA certificate                          Path to the IPA CA
                                                           certificate
  -H, --ldapuri=url                                        LDAP uri to connect
                                                           to. Mutually
                                                           exclusive with
                                                           --server
  -Y, --mech=GSSAPI|EXTERNAL                               LDAP SASL bind
                                                           mechanism if no
                                                           bindd/bindpw
  -r, --retrieve                                           Retrieve current
                                                           keys without
                                                           changing them

Help options:
  -?, --help                                               Show this help
                                                           message
      --usage                                              Display brief usage
                                                           message