Isilon User Mapping Rules with CDP / Kerberos

Question

We're trying to install CDP 7.1.7 on Isilon with OneFS 8.2.2

We found several documents that we tried to follow:

- https://infohub.delltechnologies.com/section-assets/h18730-dell-emc-powerscale-onefs-cdp-private-base-install-guide

- https://dl.dell.com/content/docu92689_PowerScale_OneFS_HDFS_Reference_Guide.pdf?language=en_US&source=Coveo

- https://infohub.delltechnologies.com/l/powerscale-onefs-user-mapping-mapping-identities-across-authentication-providers/mapping-rules-cannot-contain-user-principal-name

And more....

We also used the isilon hadoop tools and found a few bugs which we provided Pull Requests for (https://github.com/Isilon/isilon_hadoop_tools/pull/105 & https://github.com/Isilon/isilon_hadoop_tools/pull/106 ) so it seems as if thas hasn't been used in a while.

We were able to finish the basic setup but we do have issues creating the proper User Mapping Rules.

The docs say:

"You cannot use a user principal name in a user mapping rule. A user principal name (UPN) is an Active Directory domain and username that are combined into an Internet-style name with an @ sign, like an email address: jane@example.com.

If you include a UPN in a rule, the mapping service ignores it and might return an error."

Unfortunately, something doesn't quite work.

Cloudera Manager automatically created all users in Active Directory for us which means that an impala user could end up having the name "cloudera_xnTfsrendtr" in Active Directory. It does have the correct UPN set ("impala@...") but the UPN can't be used in a mapping.

This means for us that we have to create User Mapping Rules for all users manually which "join" the identities and maps one of those auto-generated users to real ones "cloudera_xnTfsrendtr" -> impala.

That is very cumbersome and the CDP / Isilon install docs don't mention this at all.

Are there updated docs anywhere/does anyone have notes on this/done this recently?

steven-matison · Answer

@larsfrancke Unfortunately I do not have the exact solution or information you need.  However,  I do have multiple customers whom have gotten their CDP on Isilon kerberized and in production.   There were some tickets on our support side leading through the kerberos setup, but the specific technical solution came from Dell's side since this is supported solution for Isilon.  My recommendation is to work with Cloudera Support to see if they have suggestions, and then work with Dell Support coming out of that.   Your Cloudera account team and Dell Partner should have access to deeper resources if both support's cannot resolve.

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.