- Subscribe to RSS Feed
- Mark Question as New
- Mark Question as Read
- Float this Question for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Script used to generate AD accounts during kerberos setup
- Labels:
-
Apache Ambari
-
Kerberos
Created on 09-18-2018 10:35 AM - edited 09-16-2022 06:43 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear Team,
Can you be so kind to help me with the location of script which creates AD accounts during automated kerberos setup via ambari. (AD team wants to review before giving us write access)
I looked at /var/lib/ambari-server/resources/scripts/kerberos_setup.sh but could not understand where we create and delete AD users.
Thanks and Best Regards,
Gagan
Created 09-18-2018 01:23 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not believe that an AD-specific script is provided with Ambari; however some of the Hortonworks support or professional services folks may have something.
The provided script may be out of date and is geared towards the MIT KDC. It will not work with an Active Directory. Active Directory would prefer that all account creation and keytab export routines be executed on the Windows server, itself. However, since AD has an LDAP interface that can be used to add new objects to the database, Ambari is able to create principals and set password. Thus giving it the ability to automate creating principals and keytab files remotely - the keytab files are actually generated by Ambari and not exported from the AD.
If you are looking for steps on how Ambari does this, take a look at the HCC article How to create AD principal accounts using OpenLdap utilities and adding it to a keytab. This is not exactly what Ambari does, but it is really close. Using details from that article, I can imagine that a script can be built to read an Ambari-provided CSV file and create the needed principals and keytab files.
Created 09-18-2018 01:23 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not believe that an AD-specific script is provided with Ambari; however some of the Hortonworks support or professional services folks may have something.
The provided script may be out of date and is geared towards the MIT KDC. It will not work with an Active Directory. Active Directory would prefer that all account creation and keytab export routines be executed on the Windows server, itself. However, since AD has an LDAP interface that can be used to add new objects to the database, Ambari is able to create principals and set password. Thus giving it the ability to automate creating principals and keytab files remotely - the keytab files are actually generated by Ambari and not exported from the AD.
If you are looking for steps on how Ambari does this, take a look at the HCC article How to create AD principal accounts using OpenLdap utilities and adding it to a keytab. This is not exactly what Ambari does, but it is really close. Using details from that article, I can imagine that a script can be built to read an Ambari-provided CSV file and create the needed principals and keytab files.
Created 09-19-2018 08:15 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the detailed answer, it is very helpful! BR//Gagan