question Re: How to change KDC account manager credentials after enabling Kerberos in Archives of Support Questions (Read Only)

How to change KDC account manager credentials after enabling Kerberos

zhuw.bigdata — Fri, 23 Dec 2016 20:15:05 GMT

Reference: https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_s3_cm_principal.html

Is there any way to change KDC account manager credentials after enabling Kerberos? I can’t find anywhere in CM to change the properties. If these are not in CM web UI, is it kept in JKS somewhere?

Re: How to change KDC account manager credentials after enabling Kerberos

saranvisa — Fri, 23 Dec 2016 20:30:35 GMT

@zhuw.bigdata

I hope you are done with Import KDC Acc Manager Credential already using the following steps" CM -> Administration -> Setting -> Import KDC Account Manager Credentials"

And now you want to change the credential

In your CLI, type kadmin.local (if you are in Kerberos master node) --or-- kadmin (if you are from client/remote node)

kadmin.local: ?

# Type ?, it will give you help including how to change credentials

Hope this helps

Re: How to change KDC account manager credentials after enabling Kerberos

bgooley — Thu, 29 Dec 2016 17:06:44 GMT

In older versions of Cloudera Manager (4.x I believe), the keytab file used to be stored in /etc/cloudera-scm-server as "cmf.keytab".

Now, it is stored in Cloudera Manager's database.

To create or update the KDC account manager in Cloudera Manager, you can reference this documentation:

http://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_deploy_keytab_s5.html

Re: How to change KDC account manager credentials after enabling Kerberos

bgooley — Thu, 29 Dec 2016 17:09:35 GMT

@saranvisa, You provided the right information, but I wanted to clarify that the correct step to update the Account Manager credentials was to again import credentials. Thanks for providing the solution!

Ben

Re: How to change KDC account manager credentials after enabling Kerberos

zhuw.bigdata — Sat, 04 Feb 2017 23:34:43 GMT

Since "Import Kerberos Account Manager Credentials" tab show blank for both User name and Password, I have no clue which user is used. Basically I will create a new account manager then.

Re: How to change KDC account manager credentials after enabling Kerberos

manuh — Fri, 03 Jul 2020 06:57:43 GMT

Try with the sql statement:

select VALUE from scm.CONFIGS where ATTR="kdc_admin_user";

scm is the CM database in the example.