DocsHortonworks Data Platform

 

 1.4.3. Running the Kerberos Wizard

The Kerberos Wizard prompts for information related to the KDC, the KDC Admin Account and the Service and Ambari principals. Once provided, Ambari will automatically create principals, generate keytabs and distribute keytabs to the hosts in the cluster. The services will be configured for Kerberos and the service components are restarted to authenticate against the KDC.

[Important]Important

Since Ambari will automatically create principals in the KDC and generate keytabs, you must have Kerberos Admin Account credentials available when running the wizard.

High-Level View of Principal Creation, Keytab Generation, and Distribution Flow

Launching the Kerberos Wizard

  1. Be sure you've Installed and Configured your KDC and have prepared the JCE on each host in the cluster.

  2. Log in to Ambari Web and Browse to Admin > Kerberos.

  3. Click “Enable Kerberos” to launch the wizard.

  4. Select the type of KDC you are using and confirm you have met the prerequisites.

  5. Provide information about the KDC and admin account.

  6. Proceed with the install. (Optional) To manage your Kerberos client krb5.conf manually (and not have Ambari manage the krb5.conf), expand the Advanced krb5-conf section and uncheck the "Manage" option. (Optional) If you need to customize the attributes for the principals Ambari will create, see the Customizing the Attribute Template for more information.

  7. Ambari will install Kerberos clients on the hosts and test access to the KDC by testing that Ambari can create a principal, generate a keytab and distribute that keytab.

  8. Customize the Kerberos identities used by Hadoop and proceed to kerberize the cluster.

    [Note]Note

    Pay particular attention to the Ambari principal names. For example, if you want the Ambari Smoke User Principal name to be unique and include the cluster name , you can append ${cluster_name} to the identity setting. ${cluster-env/smokeuser}-${cluster_name}@{realm}

  9. After principals have been created and keytabs have been generated and distributed, Ambari updates the cluster configurations, then starts and tests the Services in the cluster.

[Note]Note

If you cluster includes Storm, after enabling Kerberos, you must also Set Up Ambari for Kerberos for storm Service Summary information to be displayed in Ambari Web. Otherwise, you will see n/a for Storm information such as Slots, Tasks, Executors and Topologies.

Legal notices