Using non default hdp service accounts, what should I know?

[#1]

I am planning to non default hdp service accounts, what should I know? for example the default service account for HDFS use is hdfs. I want to change to hdfsuser. I may use non defaults for all service account. Any gotcha I should be aware of?

[#2 · Accepted solution]

@Sunile Manjee

I have used the same, that won't be any problem. But make sure that service account id bounded to approriate groups.

Example:

uid=221(hdfsuser) gid=831(hadoop) groups=347(hdfsgroup),831(hadoop)

[#3]

@SBandaru that is great info. Can you please elaborate on what you mean by bounded to approriate groups?

[#4]

@Sunile Manjee

May I know are you trying to get service account from LDAP or create them locally?

If you are trying to create them locally, just mention the service account which you want to use in the Misc during the installation, Ambari will take care of the other things like making them part of groups.

If you trying to get them from LDAP, create a service account in LDAP and make sure that they are part of appropriate groups.

By default all service account are part of hadoop group and few service accounts have their own groups like ranger, spark, hdfs, they should also be part of those groups.

Example:

id ranger
uid=4728(ranger) gid=831(hadoop) groups=848(ranger),831(hadoop) 

[#5]

@Sunile Manjee

As @SBandaru states, you will need to make sure that proper group membership is maintained for the non-standard users. If you specify the users at cluster creation time, Ambari will take care of this for you. If you create them after the fact, then you will need to verify group membership. You may also need to modify the auth_to_local filters if the non-standard users are in AD/LDAP and you need to map them to local users.

Another thing to consider is if you run the Ambari agent as non-root. There are a number of sudo rules that need to be put in place for the ambari user that allow execution of commands as the various service accounts for purposes of starting/stopping the services, installing packages, etc. You'll need to modify the customizable users sudo entry to suit your environment.