Step 3: Create the Kerberos Principal for Cloudera Manager Server
How to create a Kerberos principal for Cloudera Manager Server.
At the end of the integration process using the configuration wizard, Cloudera Manager Server will create host principals and deploy keytabs for all services configured on the cluster, which means that Cloudera Manager Server requires a principal that has privileges to create these other accounts.
If an administrator principal to act on behalf of Cloudera Manager cannot be created on the
Kerberos KDC for whatever reason, Cloudera Manager cannot create or manage principals and
keytabs for CDP services. That means these principals must be created manually on the
Kerberos KDC and then imported (retrieved) by Cloudera Manager. See
Using a custom
Kerberos keytab retrieval script for details about this process.
Creating a Principal in Active Directory
Check the Microsoft documentation for specific details for your Active Directory KDC. The general process is as follows:
- Create an Organizational Unit (OU) in your Active Directory KDC service that will contain the principals for use by the CDP cluster.
Add a new user account to Active Directory, for example,
username@EXAMPLE.COM. Set the password for the user to never expire.
- Use the Delegate Control wizard in Active Directory to grant this new user permission to Create, Delete, and Manage User Accounts in the OU created in step 1. Make sure that these permissions are only applied to that specific OU, and nowhere else.
Creating a Principal in an MIT KDC
For MIT Kerberos, administrator principals are defined
/var/kerberos/krb5kdc/kadm5.acl file on the KDC host. The
this example, principals that include the instance name
a user account as an administrator, such as
you modify the
kadm5.acl file, such as replacing
EXAMPLE.COM with your realm name, make sure to restart the
- RHEL 7
systemctl restart kadmin
service kadmin restart
Create the Cloudera Manager Server administrator principal as shown below, using
admin instance name and your realm name. If your
kadm5.acl file defines a different pattern for administrators, make
sure that the principal you create matches that pattern.
For MIT Kerberos KDC on a remote host:
For MIT Kerberos KDC on the local host:
kadmin kadmin: addprinc -pw password cloudera-scm/admin@EXAMPLE.COM
kadmin.local kadmin.local: addprinc -pw password cloudera-scm/admin@EXAMPLE.COM
Creating a Principal in Red Hat Identity Management (FreeIPA)
If you are using Red Hat IdM or FreeIPA, the wizard creates its own user account with the
necessary privileges. To do so, it requires admin credentials the first time. These admin
credentials are not stored, and are used only to create a new user and role (named
cmadminrole, respectively) and retrieve its keytab. Cloudera Manager
stores this keytab for future Kerberos operations, such as regenerating the credentials of
the CDP service accounts.
Because the wizard creates the principal it requires, you do not need to manually create an admin principal for Cloudera Manager at this time.
For additional information, refer to the Red Hat documentation:
- RHEL 7:
Linux Domain Identity, Authentication, and Policy Guide
- RHEL 6:
Identity Management Guide