question Re: Is there any way to skip "create principal" and "create keytab" step in enable kerberos wizard while kerberizing the cluster? in Archives of Support Questions (Read Only)

Is there any way to skip "create principal" and "create keytab" step in enable kerberos wizard while kerberizing the cluster?

ajitpsonawane — Mon, 17 Jul 2017 17:45:25 GMT

Hi All,

We are trying to kerberize cluster using Centirfy with pre created AD Accounts and Keytabs . So far we are able kerberize with following approach.

Generate computer account in AD and centrify using APIs. [We can access AD or Centrify only through APIs].
Do “adjoin” after creating computer accounts in AD and CENTRIFY.

Create principals and keytabs for user and services in AD/Centrify
Place user and service keytabs on respective hosts in /etc/security/keytabs
From Ambari UI, Enable Security -> Existing Active Directory

But in reaches to point till creation of principal and gets failed. So, Is there any procedure which can skip procedure of "create principal" and "create keytabs", as it is already created and placed at respective hosts.

Re: Is there any way to skip "create principal" and "create keytab" step in enable kerberos wizard while kerberizing the cluster?

rlevas — Mon, 17 Jul 2017 22:13:53 GMT

@Ajit Sonawane

There are a few articles on HCC related to enabling Kerberos using Ambari when Centrify is involved. For example:

However if you wish to have Ambari skip creating keytab files and principals, you can use the Enable Kerberos Wizard and choose the "manual" option. This will allow Ambari to configure the services while allowing you to manually manage the underlying Kerberos infrastructure and identities (principals and keytab files).

Re: Is there any way to skip "create principal" and "create keytab" step in enable kerberos wizard while kerberizing the cluster?

ajitpsonawane — Mon, 24 Jul 2017 00:48:39 GMT

Thanks Robert for your quick reply.

Is there any REST API or Ambari Blueprint option which supports "Manual " way of kerberization.

Re: Is there any way to skip "create principal" and "create keytab" step in enable kerberos wizard while kerberizing the cluster?

rlevas — Mon, 24 Jul 2017 16:16:43 GMT

You can specify that you do not want Ambari to manage the underlying Kerberos infrastructure (MIT Kerberos library, kb5.conf, principals, and keytab files) using the API or Blueprints by setting the following configurations:

kerberos-env/kdc_type = "none"
kerberos-env/manage_identities = false
kerberos-env/install_packages = false
krb5-conf/manage_krb5_conf = false

Technically, you can pick and choose which features you want Ambari to, or not to handle; but the above setting are what the UI sets when you choose the "manual" option.

See https://github.com/apache/ambari/blob/trunk/ambari-server/docs/security/kerberos/enabling_kerberos.md#the-rest-api for more information on using the API to enable Kerberos.

Re: Is there any way to skip "create principal" and "create keytab" step in enable kerberos wizard while kerberizing the cluster?

ajitpsonawane — Tue, 19 Sep 2017 14:45:31 GMT

Thanks @Robert Levas, problem solved with your solution.