### Kadmin Options

You can invoke `kadmin` or `kadmin.local` with any of the following options:

-r REALM
  Use REALM as the default Kerberos realm for the database.
-p principal
  Use the Kerberos principal principal to authenticate to Kerberos. If this option is not given, `kadmin` will append `admin` to either the primary principal name, the environment variable USER, or to the username obtained from `getpwuid`, in order of preference.
-q query
  Pass query directly to `kadmin`. This is useful for writing scripts that pass specific queries to `kadmin`.

  You can invoke `kadmin` with any of the following options:

-k [-t keytab]
  Use the keytab keytab to decrypt the KDC response instead of prompting for a password on the TTY. In this case, the principal will be `host/`hostname``. If -t is not used to specify a keytab, then the default keytab will be used.
-c credentials cache
  Use credentials_cache as the credentials cache. The credentials cache should contain a service ticket for the `kadmin/admin` service, which can be acquired with the `kinit` program. If this option is not specified, `kadmin` requests a new service ticket from the KDC, and stores it in its own temporary ccache.
-w password
  Use password as the password instead of prompting for one on the TTY. Note: placing the password for a Kerberos principal with administration access into a shell script can be dangerous if unauthorized users gain read access to the script.
-s admin_server[:port]
  Specifies the admin server that kadmin should contact.

  You can invoke `kadmin.local` with an of the follwing options:

-d_ dbname
  Specifies the name of the Kerberos database.
-e "enctypes ..."
  Sets the list of cryptosystem and salt types to be used for any new keys created. See Supported Encryption Types and Salts for available types.
-m
  Do not authenticate using a keytab. This option will cause kadmin to prompt for the master database password.