@Override
  protected void exportKeytabFile(String principal, String keytabFileDestinationPath, Set<EncryptionType> keyEncryptionTypes) throws KerberosOperationException {
    String encryptionTypeSpec = null;
    if (!CollectionUtils.isEmpty(keyEncryptionTypes)) {
      StringBuilder encryptionTypeSpecBuilder = new StringBuilder();
      for (EncryptionType encryptionType : keyEncryptionTypes) {
        if (encryptionTypeSpecBuilder.length() > 0) {
          encryptionTypeSpecBuilder.append(',');
        }
        encryptionTypeSpecBuilder.append(encryptionType.getName());
        encryptionTypeSpecBuilder.append(":normal");
      }

      encryptionTypeSpec = encryptionTypeSpecBuilder.toString();
    }

    String query = (StringUtils.isEmpty(encryptionTypeSpec))
        ? String.format("xst -k \"%s\" %s", keytabFileDestinationPath, principal)
        : String.format("xst -k \"%s\" -e %s %s", keytabFileDestinationPath, encryptionTypeSpec, principal);

    ShellCommandUtil.Result result = invokeKAdmin(query);

    if (!result.isSuccessful()) {
      String message = String.format("Failed to export the keytab file for %s:\n\tExitCode: %s\n\tSTDOUT: %s\n\tSTDERR: %s",
          principal, result.getExitCode(), result.getStdout(), result.getStderr());
      LOG.warn(message);
      throw new KerberosOperationException(message);
    }
  }
Invokes the kadmin shell command to issue queries

@param query a String containing the query to send to the kdamin command
@return a ShellCommandUtil.Result containing the result of the operation
@throws KerberosKDCConnectionException       if a connection to the KDC cannot be made
@throws KerberosAdminAuthenticationException if the administrator credentials fail to authenticate
@throws KerberosRealmException               if the realm does not map to a KDC
@throws KerberosOperationException           if an unexpected error occurred
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/MITKerberosOperationHandler.java