To create a service principal you will use the kadmin utility. This is a command-line driven utility into which you enter Kerberos commands to manipulate the central database. To start kadmin, enter:

'kadmin $USER/admin@REALM'

To create a service principal, enter the following:

kadmin: addprinc -randkey $principal_name/$service-host-FQDN@$hadoop.realm

You must have a principal with administrative permissions to use this command. The randkey is used to generate the password.

The $principal_name part of the name must match the values in the following table.

In the example each service principal's name has appended to it the fully qualified domain name of the host on which it is running. This is to provide a unique principal name for services that run on multiple hosts, like DataNodes and TaskTrackers. The addition of the hostname serves to distinguish, for example, a request from DataNode A from a request from DataNode B.

This is important for two reasons:

Note: The NameNode, Secondary NameNode, and Oozie require two principals each.

If you are configuring High Availability (HA) for a Quorom-based NameNode, you must also generate a principle (jn/$FQDN) and keytab (jn.service.keytab) for each JournalNode. JournalNode also requires the keytab for its HTTP service. If the JournalNode is deployed on the same host as a NameNode, the same keytab file (spnego.service.keytab) can be used for both. In addition, HA requires two NameNodes. Both the active and standby NameNodes require their own principle and keytab files. The service principles of the two NameNodes can share the same name, specified with the dfs.namenode.kerberos.principal property in hdfs-site.xml, but the NameNodes still have different fully qualified domain names.

* Only required if you are setting up NameNode HA.

** For more information, see Configure Kerberos Authentication for Storm.

For example: To create the principal for a DataNode service, issue this command:

kadmin: addprinc -randkey dn/$datanode-host@$hadoop.realm

Extract the related keytab file and place it in the keytab directory of the appropriate respective components. The default directory is /etc/krb5.keytab.

kadmin: xst -k $keytab_file_name $principal_name/fully.qualified.domain.name

You must use the mandatory names for the $keytab_file_name variable shown in the following table.

* Only required if you are setting up NameNode HA.

** Only required if you are using a Knox Gateway.

For example: To create the keytab files for the NameNode, issue these commands:

kadmin: xst -k nn.service.keytab nn/$namenode-host kadmin: xst -k spnego.service.keytab HTTP/$namenode-host

When you have created the keytab files, copy them to the keytab directory of the respective service hosts.

Verify that the correct keytab files and principals are associated with the correct service using the klist command. For example, on the NameNode:

klist –k -t /etc/security/nn.service.keytab

Do this on each respective service in your cluster.