question Re: Failed to enable Kerberos using Direct Active Directory using CDH 5.9.0 in Support Questions

Failed to enable Kerberos using Direct Active Directory using CDH 5.9.0

zhuw.bigdata — Tue, 06 Dec 2016 04:05:37 GMT

Reference:

http://www.cloudera.com/documentation/enterprise/latest/topics/sg_auth_overview.html#concept_zkr_5h2_bt

http://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_intro_kerb.html

http://blog.cloudera.com/blog/2014/07/new-in-cloudera-manager-5-1-direct-active-directory-integration-for-kerberos-authentication/

My question is how to configure AD OU admin user. This user has to have permissions to modify LDAP also. I just can't find anything on this. I got permission denied on ldapadd when generating the keytabs. Could someone help me on how to set this user up in both AD domain and AD LDAP?

Re: Failed to enable Kerberos using Direct Active Directory using CDH 5.9.0

zhuw.bigdata — Fri, 23 Dec 2016 20:07:32 GMT

Found this useful link:

https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_s3_cm_principal.html

If you are using Active Directory:

Create an Organizational Unit (OU) in your AD setup where all the principals used by your CDH cluster will reside.
Add a new user account to Active Directory, for example, <username>@YOUR-REALM.COM. The password for this user should be set to never expire.
Use AD's Delegate Control wizard to allow this new user to Create, Delete and Manage User Accounts.