Realm and Domain Name

[#1]

What is Realm Name and Domain name in Kerberos setup.

For example:

Ldap/AD server  FQDN: ldapserver.abc.example.com

Ambari FQDN: ambari.dev.xyz.example.com

Also, should all my nodes be in time sync with Ldap server.

[#2]

By default, the name of the realm is taken to be the DNS domain name of the server in all capital letters.

foo.example.org → EXAMPLE.ORG
foo.example.com → EXAMPLE.COM
foo.hq.example.com → HQ.EXAMPLE.COM

In some configurations, this will be sufficient, but in others, the realm name which is derived will be the name of a non-existent realm. In these cases, the mapping from the server's DNS domain name to the name of its realm must be specified in the domain_realm section of the client system's krb5.conf. For example:

[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM

The configuration specifies two mappings. The first mapping specifies that any system in the example.com DNS domain belongs to the EXAMPLE.COM realm. The second specifies that a system with the exact name example.com is also in the realm

Also, time should be correct/synced in all servers.

[#3]

@nthomas thank you for your reply.

So my configuration would be:

Realm Name: ABC.EXAMPLE.COM

domain_realm:

.example.com = EXAMPLE.COM

example.com = EXAMPLE.COM

this configuration will map all my hdp nodes to this Realm correct?

All my hdp nodes (EST) should be in sync with Ldap server (UTC)

[#4]

Configuration should be like this:

Realm Name: ABC.EXAMPLE.COM

domain_realm:

.example.com = ABC.EXAMPLE.COM

example.com =  ABC.EXAMPLE.COM

Usually, the realm name should be configured when you set up AD. I would recommend checking with your AD team to get the mapping details.

Also, time should be synced.

[#5]

Hello @nthomas ,

Please correct me if i'm wrong:

 AD domain : abc.example.com

HDP DEV domain: dev.xyz.example.com

HDP PROD domain: xyz.example.com

In DEV Kerberos settings:

Realm Name : ABC.EXAMPLE.COM

KDC Host : ldapserver.abc.example.com:636

Domains: .dev.xyz.example.com,dev.xyz.example.com

In Prod Kerberos settings:

Realm Name : ABC.EXAMPLE.COM

KDC Host : ldapserver.abc.example.com:636

Domains: .xyz.example.com,xyz.example.com

[#6]

Yeah, this should work. Also, if you want to verify the complete configuration, I would recommend contacting Cloudera technical support:

==> https://my.cloudera.com/faq/support.html