Ambari SPN creation on remote AD

sba — Fri, 06 Apr 2018 15:48:41 GMT

I need to script the HDP cluster kerberization aginst a remote Active Directory. Can anybody tell me how Ambari can create SPNs and Accounts on a remote Active Directory? Where can I find this class/script/code?

There is also something with SPN creation I can't do manually on AD, but Ambari can do it. A valid SPN format is something like SERVICE/FQDN@REALM (Ex: HTTP/server1.com@MYAD.COM, ...). But for Ambari QA SPN for instance does not have the "SERVICE/" (Ex: ambari-qa@MYCOM.FR) part on the SPN. When I try to attach similar SPNs manually on AD, WINDOWS will complain about this format!

Thanks for pointing me where I can look for these details and how Ambari could do it.

Re: Ambari SPN creation on remote AD

james_jones — Sat, 07 Apr 2018 04:24:44 GMT

The code for creating principals in AD is here:

ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ADKerberosOperationHandler.java

question Re: Ambari SPN creation on remote AD in Archives of Support Questions (Read Only)

Ambari SPN creation on remote AD

Re: Ambari SPN creation on remote AD