Description of problem:

When RHEL system is joined to AD using realm join on RHEL 7.1 (realmd-0.14.6-6.el7, samba-common-4.1.12-21.el7_1), running net ads keytab add HTTP passes, with RHEL 7.1 code or with RHEL 7.2 code.

When however the system is joined to AD using realm join on RHEL 7.1 (realmd-0.16.1-3.el7, with or without samba-common-tools-4.2.3-7.el7 installed (to get /usr/bin/net)), that same net ads keytab add command fails.

Version-Release number of selected component (if applicable):

adcli-0.7.5-4.el7.x86_64
realmd-0.16.1-3.el7.x86_64
samba-common-tools-4.2.3-7.el7.x86_64

How reproducible:

Deterministic.

Steps to Reproduce:
1. yum install -y sssd adcli realmd /usr/bin/net
2. If your RHEL machine by default does not have DNS pointed to the Active Directory server, do something like

    cp /etc/resolv.conf /etc/resolv.conf.backup
    echo nameserver 11.12.13.14 > /etc/resolv.conf

3. In the commands below, we assume the AD realm is ADDOMAIN.TEST and the workgroup is ADDOMAIN:

    cat > /etc/net-keytab.conf <<EOF
[global]
   workgroup = ADDOMAIN
   realm = ADDOMAIN.TEST
   kerberos method = system keytab
   security = ads
EOF

4. realm join -v addomain.test
5. KRB5_KTNAME=FILE:/etc/gssproxy/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf

Actual results:

Successfully contacted LDAP server 10.11.12.13
Connected to LDAP server SERVER.ADDOMAIN.TEST
ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30
ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2
ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2
ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3
ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10
ads_sasl_spnego_bind: got server principal name = not_defined_in_RFC4178@please_ignore
../source3/libads/kerberos_keytab.c:312: failed to fetch machine password
return code = -1

Expected results:

Successfully contacted LDAP server 10.12.13.14
Connected to LDAP server SERVER.ADDOMAIN.TEST
ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30
ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2
ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2
ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3
ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10
ads_sasl_spnego_bind: got server principal name = not_defined_in_RFC4178@please_ignore
../source3/libads/kerberos_keytab.c:389: Attempting to add/update 'HTTP/client.example.com'
ads_add_service_principal_name: Host account for CLIENT found
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com) with encryption type (1) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com) with encryption type (3) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com) with encryption type (17) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com) with encryption type (18) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com) with encryption type (23) and version (2)
../source3/libads/kerberos_keytab.c:65: Will try to delete old keytab entries
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client) with encryption type (1) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client) with encryption type (3) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client) with encryption type (17) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client) with encryption type (18) and version (2)
../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client) with encryption type (23) and version (2)
return code = 0

Additional info: