I will elaborate the question How does Kerberos work? from this Question. I am unable to understand how it is doing its functions. In my case, we enabled kerberos using existing Active directory(Automated installation) . Some of these questions might sound stupid, Please bear with me. I will put all my understanding here, correct me if i am wrong. It Will use Active directory as KDC. As soon as the user login into the system, AS will generate TGT and TGS will issue a ticket with that TGT. (AS and TGS will lie in AD) It Will have to create principals and key tabs for all the service users,services, local users, AD users in this active directory.But it is only creating principals and keytabs for service users like hdfs,hive. The problem which we are facing is, it is not generating keytabs for local linux users, which is restricting them to use the services even thought they have access to those services(created policies in ranger). Questions: How do we generate key tabs for local users and AD users(which is integrated with OS using SSSD)? should we integrate AD with ambari in order to gererate keytabs for AD users ? Is AD the KDC here ? Based on what AS will issue TGT ? is it after succesfull login and Keytab for that user ? ... View more

How does Kerberos work ? Do we have to integrate it with our Existing AD ? Is this how it is able to identify users ? Can we have both AD/LDAP and Kerberos authentication seperately ? All these questions came to my mind when I was following this installation document. There is an option to use existing AD as KDC. So does this mean it is using AD authentication? I would be very grateful, if some one could help me on this. Does AD(KDC) has to be present in same machine I am enabling Kerberos ? ... View more