Cloudera Docs

Create composite keytab for Ranger HA

If Kerberos is configured on your cluster, you must create a composite keytab.

  1. Log in to the Load balancer node
  2. Run kadmin.local if KDC server and LB node are same. Otherwise, login to the KDC server hosts and run the kadmin.local command
  3. Run mkdir -p /etc/security/keytabs
  4. Add spnego principal entry of the LB node using ktadd -norandkey -kt /etc/security/keytabs/ranger.ha.keytab HTTP/hostname@EXAMPLE.COM
  5. Add spnego principal entry of the node where RANGER_ADMIN is first installed using ktadd -norandkey -kt /etc/security/keytabs/ranger.ha.keytab HTTP/hostname@EXAMPLE.COM
  6. Add spnego principal entry of the node where RANGER_ADMIN is next installed using ktadd -norandkey -kt /etc/security/keytabs/ranger.ha.keytab HTTP/hostname@EXAMPLE.COM
  7. Verify /etc/security/keytabs/ranger.ha.keytab having an entry of all the required spnego principals using klist -kt /etc/security/keytabs/ranger.ha.keytab
  8. scp /etc/security/keytabs/ranger.ha.keytab file to other nodes where RANGER_ADMIN is installed
  9. Update permission to chmod 444 /etc/security/keytabs/ranger.ha.keytab
  10. Update ownership to chown ranger:hadoop /etc/security/keytabs/ranger.ha.keytab