Cloudera Security kerberos load on Windows AD

[#1]

Hi there

When we implement Cloudera Manager Security with kerberos.

and we connect to our windows AD for as KDC.

What will the impact / load be on the windows AD ?

can i get some information/numbers about that?

Thank you

[#2]

It can have significant impact.  This is why we do not document or support direct configuration against the AD server as a kerberos KDC.

Todd

[#3]

Make sure you "want" kerberos security configured.  Disable NameNode HA Auto Failover and Jobtracker HA before starting.  If HBASE is in use, you will want to review if you want to keep kerberos enabled.  Once you enable kerberos, disabling kerberos can become a complex process as you have to go into zookeeper and remove ACL's over those znode entries, while kerberos is still enabled.

Set up a your cluster KDC, on the CM server for example.  If you are on RHEL, Follow the steps here:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Ca...

Make sure to enable ticket renewal in your kdc/krb4 configs right away before starting on the steps laid out in our guide to enabling hadoop security with cloudera manager

http://www.cloudera.com/content/cloudera-content/cloudera-docs/CM4Ent/latest/Configuring-Hadoop-Secu...

[#4 · Accepted solution]

To add to this, Cloudera Manager uses the kadmin interface to generate the service principles. Windows AD does not support the kerberos kadmin interface from my understanding. You will be better off setting up a MIT based Kdc on a linux system and then configuring cross-realm trust with your AD server.

-roland