How are keytabs generated from within Ambari when passwords expire?

[#1]

Ambari creates keytabs internally because it has details of the AD it is connecting to. However, how does ambari regenerate keytabs once the passwords expire at AD end? How does it ensure that the services dependent on those keytabs do not go down? Or all services have to be shut down when a new keytab is provisioned?

[#2 · Accepted solution]

Hi @Sumit Nigam

You can tell Ambari to regenerate all keytabs for all services if you know the passwords expired on the AD/LDAP server.

Hope that helps.

[#3]

Thank you @wengelbrecht - But how does it manage all services who are using older keytab? Does it restart them?

[#4]

Correct, as the older TGT are now outdated, the services needs to be restarted to use the new keytab files and grab a new TGT. Ambari will do this for you when you regenerate the keytab files.