With Ambari AD management is it possible to have user names prefixed automatically?

[#1]

If this is for a Kerborized cluster, you can create rules in the auth_to_local setting under the REALMS configuration section of the krb5.conf file. You would have to tinker with the Advanced krb5 configuration settings in Ambari to create and propogate the rules. The rules can use the incoming AD id and manipulate it as you need. The MIT documentation has a few examples at http://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html

[#2 · Accepted solution]

@hkropp - if you're talking about automatically prefixing all AD kerberos principal names that are created, it is possible.

http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_launching_...

See 4.2.5.1g for some description on how specific LDAP attributes can be modified on creation for each of the principals (if necessary), and 4.2.1.8 on our default prefix which is the name of the cluster.

[#3]

What about CN or sAMAccount? As I understand they will be the same as principal name, or?

[#4]

Each can be altered independently in the Attribute Template:

http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_customizin...

When you run through the wizard you'll see the template and the CN, and sAMAccountName and where you have the opportunity to prepend, append, alter their values.