Use dedicated keytab for Samba
    
    Samba just needs the cifs/ key on the ipa server. Configure samba to use a
    different keytab file so that we do not risk samba commands (net, or similar)
    to mess up the system keytab.
    
    https://fedorahosted.org/freeipa/ticket/2168