question Re: With Ambari AD management is it possible to have user names prefixed automatically? in Support Questions

With Ambari AD management is it possible to have user names prefixed automatically?

hkropp — Wed, 21 Oct 2015 20:17:57 GMT

Re: With Ambari AD management is it possible to have user names prefixed automatically?

TerryP — Wed, 21 Oct 2015 20:30:27 GMT

If this is for a Kerborized cluster, you can create rules in the auth_to_local setting under the REALMS configuration section of the krb5.conf file. You would have to tinker with the Advanced krb5 configuration settings in Ambari to create and propogate the rules. The rules can use the incoming AD id and manipulate it as you need. The MIT documentation has a few examples at http://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html

Re: With Ambari AD management is it possible to have user names prefixed automatically?

pcodding — Wed, 21 Oct 2015 21:01:10 GMT

@hkropp - if you're talking about automatically prefixing all AD kerberos principal names that are created, it is possible.

http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_launching_the_kerberos_wizard_automated_setup.html

See 4.2.5.1g for some description on how specific LDAP attributes can be modified on creation for each of the principals (if necessary), and 4.2.1.8 on our default prefix which is the name of the cluster.

Re: With Ambari AD management is it possible to have user names prefixed automatically?

hkropp — Wed, 21 Oct 2015 21:27:21 GMT

What about CN or sAMAccount? As I understand they will be the same as principal name, or?

Re: With Ambari AD management is it possible to have user names prefixed automatically?

pcodding — Wed, 21 Oct 2015 21:35:19 GMT

Each can be altered independently in the Attribute Template:

http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_customizing_the_attribute_template.html

When you run through the wizard you'll see the template and the CN, and sAMAccountName and where you have the opportunity to prepend, append, alter their values.