Active directory as Directory Service and MIT kerberos as KDC

[#1]

Hi,

In my environment, Hadoop nodes are integrated with AD for authentication. AD doesn't support Kerberos. I understand that it's possible to have users + user principals serviced by AD and have only service principals serviced by a local KDC. Question is, is it possible to set up a local KDC server for both service and user principals but actual users will reside in AD ? So, I will need to host kerberos principals and manage tickets of AD users in local KDC. AD user realm and KDC realm will also be different.

Any help would be appreciated 🙂

[#2]

If the AD is not providing Kerberos service to the hosts in the cluster (as stated in the question) then there is not chance of the user requesting any TGT from the AD KDC. In that case AD may only be used as an LDAP users identity provider.