Configuring custom Kerberos principal for Atlas

Customising the Atlas Kerberos Principal is a two-step process.

Updating the Kerberos Principal.

In your Cloudera Manager instance, go to the Configuration tab and search for the Principal by entering "principal" in the search field.

For Kerberos Principal, enter the value as “atlas” and click Save Changes.
Regenerating the missing keytab.
In the Instances tab, click Actions to Selected and select Regenerate missing keytab. Click Save.

note
Updating the Atlas Kerberos Principal results in stale configurations for services. You must restart the stale services.

Warning: Cloudera Manager will not create service users / groups which are customised.

Cloudera Manager handles the mapping of the service user to the Kerberos Principal and no additional task is required. You must configure the required policies in the Ranger UI.

important
Cloudera Manager configures CDP services to use the default Kerberos principal names. Cloudera recommends that you do not change the default Kerberos principal names. If it is unavoidable to do so, contact Cloudera Professional Services because it requires extensive additional custom configuration.
If the Kerberos principal name is customized for a Knox service having a default service user name, add the following proxy configurations to Atlas Server Advanced Configuration Snippet (Safety Valve) for conf/atlas-application.properties and restart the Atlas service:
- atlas.proxyuser.<knox_principal_name>.hosts= <list of allowed hosts>. The <list of allowed hosts>can be provided as * to allow all.
- atlas.proxyuser.<knox_principal_name>.groups= <list of allowed groups>
- atlas.proxyuser.<knox_principal_name>.users= <list of allowed users>
Where <knox_principal_name> is the value of the Kerberos Principal in the Knox service. Select Clusters > Knox > Configuration and search for Kerberos Principal to display this value.

note
Custom principals are used as service users to create the required policies. You must ensure that the UNIX account associated with Custom Principals is available on all hosts and must be mapped with the appropriate groups. Else, you have appropriate auth-to-local rules present to map the Custom Principals to the service users and appropriate required policy is present in Ranger.
Specially for Atlas, if you have custom service principal, you must add the same to Kafka policies if you have not mapped auth-to-local rules in Kafka configurations. Else, you must have the Atlas service user in the Kafka policies. Note that Kafka supports auth-to-local rules with a custom property named sasl.kerberos.principal.to.local.rules
For more information, see Enable Kerberos Authentication.