Enabling Kerberos Authentication Using the Wizard
Minimum Required Role: Cluster Administrator (also provided by Full Administrator)
This guide describes how to use Cloudera Manager and the Kerberos wizard (introduced in Cloudera Manager 5.1.0) to automate many of the manual tasks of implementing Kerberos security
on your CDH cluster.
- Prerequisites - These instructions assume you know how to install and configure Kerberos,
you already have a working Kerberos key distribution center (KDC) and realm setup, and that you've installed the following Kerberos client packages on all cluster hosts and hosts that will be used to
access the cluster, depending on the OS in use.
OS Packages Required RHEL 7 Compatible, RHEL 6 Compatible, RHEL 5 Compatible - openldap-clients on the Cloudera Manager Server host
- krb5-workstation, krb5-libs on ALL hosts
SLES - openldap2-client on the Cloudera Manager Server host
- krb5-client on ALL hosts
Ubuntu or Debian - ldap-utils on the Cloudera Manager Server host
- krb5-user on ALL hosts
Windows - krb5-workstation, krb5-libs on ALL hosts
For more information about using an Active Directory KDC, refer the section below on Considerations when using an Active Directory KDC and the Microsoft AD documentation.
For more information about installing and configuring MIT KDC, see: - Support
- Cloudera supports the version of Kerberos that ships with each supported operating system. See CDH and Cloudera Manager Supported Operating Systems.
Continue reading:
- Step 1: Install Cloudera Manager and CDH
- Step 2: If You are Using AES-256 Encryption, Install the JCE Policy File
- Step 3: Get or Create a Kerberos Principal for the Cloudera Manager Server
- Step 4: Enabling Kerberos Using the Wizard
- Step 5: Create the HDFS Superuser
- Step 6: Get or Create a Kerberos Principal for Each User Account
- Step 7: Prepare the Cluster for Each User
- Step 8: Verify that Kerberos Security is Working
- Step 9: (Optional) Enable Authentication for HTTP Web Consoles for Hadoop Roles