question How are keytabs generated from within Ambari when passwords expire? in Archives of Support Questions (Read Only)

How are keytabs generated from within Ambari when passwords expire?

sumit_nigam — Wed, 28 Jun 2017 12:17:04 GMT

Ambari creates keytabs internally because it has details of the AD it is connecting to. However, how does ambari regenerate keytabs once the passwords expire at AD end? How does it ensure that the services dependent on those keytabs do not go down? Or all services have to be shut down when a new keytab is provisioned?

Re: How are keytabs generated from within Ambari when passwords expire?

wengelbrecht — Wed, 28 Jun 2017 14:55:41 GMT

Hi @Sumit Nigam

You can tell Ambari to regenerate all keytabs for all services if you know the passwords expired on the AD/LDAP server.

Hope that helps.

Re: How are keytabs generated from within Ambari when passwords expire?

sumit_nigam — Wed, 28 Jun 2017 15:08:26 GMT

Thank you @wengelbrecht - But how does it manage all services who are using older keytab? Does it restart them?

Re: How are keytabs generated from within Ambari when passwords expire?

wengelbrecht — Wed, 28 Jun 2017 15:25:17 GMT

Correct, as the older TGT are now outdated, the services needs to be restarted to use the new keytab files and grab a new TGT. Ambari will do this for you when you regenerate the keytab files.