Ambari is able to configure Kerberos in the cluster to work with an existing MIT KDC (key distribution center), or existing Active Directory installation. This section describes the steps necessary to prepare for this integration.

	Note
	If you do not have an existing KDC (MIT or Active Directory), (Optional) Install a new MIT KDC. Installing a KDC on a cluster host after installing the Kerberos client might overwrite the krb5.conf file generated by Ambari.

You may choose to have Ambari connect to the KDC and automatically create the necessary Service and Ambari principals, generate and distribute the keytabs (“Automated Kerberos Setup”). Ambari also provides an advanced option to manually configure Kerberos. If you choose this option, you must create the principals, generate and distribute the keytabs. Ambari will not do this automatically (“Manual Kerberos Setup”).

Use the instructions to (Optional) Install a new MIT KDC if you do not have an existing KDC available.