4.2.1. Launching the Kerberos Wizard (Automated Setup)

Be sure you have Installed and Configured your KDC and have prepared the JCE on each host in the cluster.

Log in to Ambari Web and Browse to Admin > Kerberos.

Click “Enable Kerberos” to launch the wizard.

Select the type of KDC you are using and confirm you have met the prerequisites.

Provide information about the KDC and admin account.

(Optional) In the Domains field, provide a list of patterns to use to map hosts in the cluster to the appropriate realm. For example, if your hosts have a common domain in their FQDN such as host1.hortonworks.local and host2.hortonworks.local, you would set this to:
.hortonworks.local,hortonworks.local
(Optional) To manage your Kerberos client krb5.conf manually (and not have Ambari manage the krb5.conf), expand the Advanced krb5-conf section and uncheck the "Manage" option. You must have the krb5.conf configured on each host.
(Optional) to configure any additional KDC's to be used for this environment, add an entry for each additional KDC to the realms section of the Advanced krb5-conf's krb5-conf template.
```
kdc = {{kdc_host}}
kdc = otherkdc.example.com
```
(Optional) To not have Ambari install the Kerberos client libraries on all hosts, expand the Advanced kerberos-env section and uncheck the “Install OS-specific Kerberos client package(s)” option. You must have the Kerberos client utilities installed on each host.
(Optional) If your Kerberos client libraries are in non-standard path locations, expand the Advanced kerberos-env section and adjust the “Executable Search Paths” option.
(Optional) If your KDC has a password policy, expand the Advanced kerberos-env section and adjust the Password options.
(Optional) If you need to customize the attributes for the principals Ambari will create, when using Active Directory, see the Customizing the Attribute Template for more information. When using MIT KDC, you can pass Principal Attribute options in the Advanced kerberos-env section.

Proceed with the install.

Ambari will install Kerberos clients on the hosts and test access to the KDC by testing that Ambari can create a principal, generate a keytab and distribute that keytab.

Customize the Kerberos identities used by Hadoop and proceed to kerberize the cluster.

Confirm your configuration. You can optionally download a CSV file of the principals and keytabs that Ambari will automatically create.

Click Next to start the process.

After principals have been created and keytabs have been generated and distributed, Ambari updates the cluster configurations, then starts and tests the Services in the cluster.

	Note
	If your cluster includes Storm, after enabling Kerberos, you must also Set Up Ambari for Kerberos for Storm Service Summary information to be displayed in Ambari Web. Otherwise, you will see n/a for Storm information such as Slots, Tasks, Executors and Topologies.

Exit the wizard when complete.