People rebuild IPA client systems all the time and need to easily re-enroll clients after they rebuilt them especially if they are virtual machines. This calls for a new provisioning method using a keytab.

Scenario:

1. Machine has been initially provisioned using an OTP method
2. Machine is de-provisioned
3. Machine needs to be rebuilt with the same name

Currently OTP method does not work for re-enrolment because it requires two asynchronous operations: one to get a new OTP from IPA and another to call the install with the new OTP.
Using other provisioning schemes we support (admin based ones) means sticking admin password into the kickstart files - not a good security practice.

The proposal is to allow backing up a keytab and then using keytab to acquire the ticket and then installing the client.

Prerequisites:
1. System has already been enrolled
2. Host entry exists
3. Keytab was backed up
4. New authentication method/parameter is added to ipa-client-install

Proposed sequence:
1. Keytab is restored in a predefined place
2. ipa-client-install is called with new argumet --keytab=<path to keytab>
3. Client install does kinit using keytab and then continues the enrolment re-provisioning new keytab, certs and ssh keys. Restored keytab is destroyed or overwritten.

Note: The system can be de-provisioned with or without calling ipa-client-install --uninstall so the contents of the host entry might be different. The logic should work regardless of how the client was de-provisioned. Effectively running the ipa-client-install with --keytab option should reinit/repair the client configuration if the keytab is correct regardless of the current state of the client.