question Re: Service Accounts Creation in Archives of Support Questions (Read Only)

Service Accounts Creation

dsun — Thu, 01 Jun 2017 04:16:12 GMT

During the Ambari installation, if all the hosts already integrated with AD via SSSD, and all the service accounts already available in AD, will Ambari still try to create those accounts locally?

Re: Service Accounts Creation

xin_wang — Fri, 02 Jun 2017 03:26:02 GMT

@dsun yes, you can.

First, you need to ensure those service accounts are created in the AD and the cluster hosts all connect to AD and those users are valid.

Second, set ignore_groupsusers_create=true in cluster-env.xml then start install HDP

Re: Service Accounts Creation

bandarusridhar1 — Fri, 02 Jun 2017 04:04:57 GMT

@dsun

In addition to @xin.wang If all the accounts are created in AD/LDAP, if you are installing the services for the 1st time, while installing you get an option asking whether to Ambari to manage service accounts and UID's or skip managing. If you check on asking Ambari not to manage service accounts, it will automatically skip creation of local service accounts.

If Ambari is already installed now you are trying to add new service where service account in AD the run below command, which will set Ambari not create any users or groups locally:

/var/lib/ambari-server/resources/scripts/configs.sh
-u admin -p password -port 8080 set ambarihostserver.com clustername cluster-env ignore_groupsusers_create true

Hope this helped you.

Re: Service Accounts Creation

dsun — Fri, 02 Jun 2017 06:03:46 GMT

Thanks for the comments, will try it out.