In FreeIPA 4.0 Draft documentation, section 3.4.1 contains incorrect directions on importing the Kerberos key for use with NFS. Currently, the instructions read as:

1. Get credentials from Kerberos.
   {{{[root@server ~]#kinit admin}}}
2. On a FreeIPA server, add an NFS service principal for the NFS client.
   {{{[root@server ~]# ipa service-add nfs/ipaclient.example.com@EXAMPLE}}}
3. On the FreeIPA server, obtain a keytab for the NFS service principal.
   {{{[root@server ~]# ipa-getkeytab -s ipaserver.example.com -p nfs/ipaclient.example.com@EXAMPLE -k /tmp/krb5.keytab}}}
4. Copy the keytab from the FreeIPA server to the NFS server. For example, if the FreeIPA and NFS servers are on different machines:
   {{{[root@server ~]# scp /tmp/krb5.keytab root@nfs.example.com:/etc/krb5.keytab}}}
5. Copy the keytab from the FreeIPA server to the FreeIPA client. For example:
   {{{[root@server ~]# scp /tmp/krb5.keytab root@client.example.com:/etc/krb5.keytab}}}

These instructions are directing the users to overwrite the existing /etc/krb5.keytab. They should read:

1. On a FreeIPA server, add an NFS service principal for the NFS client.
   {{{[root@ipaserver ~]# ipa service-add nfs/ipaclient.example.com@EXAMPLE}}}
2. On the NFS server, acquire credentials from Kerberos:
   {{{[root@nfsserver ~]#kinit admin}}}
3. On the NFS server, obtain a keytab for the NFS service principal.
   {{{[root@nfsserver ~]# ipa-getkeytab -s ipaserver.example.com -p nfs/ipaclient.example.com@EXAMPLE -k /etc/krb5.keytab}}}

....and this is where I get stuck. I can't progress beyond this point.