question Re: How to create AD principals manually in Archives of Support Questions (Read Only)

How to create AD principals manually

JoeHellmers — Fri, 16 Sep 2022 10:45:00 GMT

I need to use a different AD domain for my Cloudera Managed Hadoop cluster.

Unfortunately I can't get the administrators to give my Hadoop connect user (the one you use when you click on the "Import Kerberos Account Manager Credentials" button) the permissions to create users.

Are there any instructions anywhere on creating those manually and then configuring the cluster to use them?

Thanks.

Re: How to create AD principals manually

bgooley — Fri, 21 Oct 2016 23:24:35 GMT

Hi Joe,

Cloudera Manager does support the use case where you generate your own keytabs. Please see:

http://www.cloudera.com/documentation/enterprise/latest/topics/sg_keytab_retrieval_script.html

Essentially:

- AD admins create all the keytabs and they are placed in a location on the Cloudera Manager host

- When Cloudera Manager needs one of the keytabs, the custom retrieval script will locate the keytab, copy it to a temporary location, then import into Cloudera Manager for storage in the Cloudera Manager database.

I hope that helps.

-Ben

Re: How to create AD principals manually

JoeHellmers — Thu, 27 Oct 2016 01:03:12 GMT

I was able to get my Domain admin to grant delegation on my Hadoop OU, so I didn' thave to do in manually thank goodness.