Failed to enable Kerberos using Direct Active Directory using CDH 5.9.0

[#1]

Reference:

http://www.cloudera.com/documentation/enterprise/latest/topics/sg_auth_overview.html#concept_zkr_5h2...

http://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_intro_kerb.html

http://blog.cloudera.com/blog/2014/07/new-in-cloudera-manager-5-1-direct-active-directory-integratio...

My question is how to configure AD OU admin user. This user has to have permissions to modify LDAP also. I just can't find anything on this. I got permission denied on ldapadd when generating the keytabs. Could someone help me on how to set this user up in both AD domain  and AD LDAP?

[#2 · Accepted solution]

Found this useful link:

https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_s3_cm_principal.html

If you are using Active Directory:

1. Create an Organizational Unit (OU) in your AD setup where all the principals used by your CDH cluster will reside.
2. Add a new user account to Active Directory, for example, <username>@YOUR-REALM.COM. The password for this user should be set to never expire.
3. Use AD's Delegate Control wizard to allow this new user to Create, Delete and Manage User Accounts.