question Re: using Kadmin for connectiong to AD KDC in Archives of Support Questions (Read Only)

using Kadmin for connectiong to AD KDC

gvishal — Fri, 16 Sep 2022 11:50:29 GMT

Have anyone tried kadmin (connecting to AD KDC) after kerberising the hadoop cluster using Ambari?

I am using the same credentials and it is saying “Required KADM5 principal missing while initializing kadmin interface”. What is the recommended best way to AD KDC connection? Thanks for help

Re: using Kadmin for connectiong to AD KDC

ibhatt — Tue, 27 Jun 2017 19:35:41 GMT

@Vishal Gupta You might not have added principals for kadmin/fqdn@DOMAIN as well as the legacy fallback kadmin/admin@DOMAIN. You can add them using kadmin.local

https://web.mit.edu/kerberos/krb5-1.13/doc/admin/admin_commands/kadmin_local.html

Re: using Kadmin for connectiong to AD KDC

rlevas — Tue, 27 Jun 2017 21:19:31 GMT

@Vishal Gupta

You cannot use the MIT Kerberos package's kadmin tool to manage an Active Directory - you need to use Active Directory-specific tools, or for creating accounts, a tool that can communicate to the AD using LDAP.

For an LDAP approach, see this article posted by @dvillarreal: How to create AD principal accounts using OpenLdap utilities and adding it to a keytab.

Re: using Kadmin for connectiong to AD KDC

gvishal — Wed, 28 Jun 2017 06:39:19 GMT

Thanks Robert and bhatt. This is helpful