When principals are created in Active Directory during Kerberos installation (no local KDC), what password is used for each principal?

[#1]

A client asks this question "I see objects in AD. These objects are AD user objects with the password set to next expire. Do you know what default password is used on these accounts on the AD side?"

[#2]

Terry - Are you using Ambari Wizard for kerberizing the cluster? If so, passwords are randomly generated.

Here are the pointers to code that does it -

Password is generated here -

https://github.com/hortonworks/ambari/blob/d4edf4619c1c0bb309920ba86e66012a2a2e7090/ambari-server/sr...

The above function is called from here -

https://github.com/hortonworks/ambari/blob/d4edf4619c1c0bb309920ba86e66012a2a2e7090/ambari-server/sr...

And then passed to this method for creating principal in KDC / AD -

https://github.com/hortonworks/ambari/blob/8967ed9bc8967f6f6783c16f6403a3de0a0b2792/ambari-server/sr...

[#3 · Accepted solution]

When Ambari creates passwords for accounts it generates a string of 20 characters chosen from a set of various character classes - uppercase characters, lowercase characters, digits, punctuation, and whitespace. A minimum number of instances of each character class can be configured to help meet password policies that might be applied to the KDC.

[#4]

We'll be adding this information to the documentation for the Kerberos Wizard very soon: http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_launching_...

It's important to note that these principal password are note permanently persisted within Ambari. They are only used to populate the AD password fields, and generate the appropriate key tabs.