This article describes the setup of two separate KDCs in a Master/Slave configuration. This setup will allow two clusters to share a single Kerberos realm, which allows the principals to be recognized between clusters. A use case for this configuration is when a Disaster Recovery cluster is used as a warm standby. The high level information for the article was found at https://web.mit.edu/kerberos/krb5-1.13/doc/admin/install_kdc.html, while the details were worked out through sweat and tears.
Execute the following command to install the Master and Slave KDC if the KDC is not already installed:
yum install krb5-server
The following defines the KDC configuration for both clusters. This file, /etc/krb5.conf, must be copied to each node in the cluster.
The KDC database is then initialized with the following command, executed from the Master KDC:
shell% kdb5_util create -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'CUSTOMER.HDP',
master key name 'K/M@CUSTOMER.HDP'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: <db_password>
Re-enter KDC database master key to verify: <db_password>
An administrator must be created to manage the Kerberos realm. The following command is used to create the administration principal from the Master KDC:
shell% kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/admin@CUSTOMER.HDP with password.
WARNING: no policy specified for admin/admin@CUSTOMER.HDP; defaulting to no policy
Enter password for principal "admin/admin@CUSTOMER.HDP": <admin_password>
Re-enter password for principal "admin/admin@CUSTOMER.HDP": <admin_password>
Principal "admin/admin@CUSTOMER.HDP" created.
Host keytabs must now be created for the SLAVE KDC. Execute the following commands from the Master KDC: