The service being installed needs to use another service's keytab. I have read the portion of the wiki about externalKerberosPrincipals, but it is not clear how that property should be used, or what changes other properties need to make. I have tried the following: 1) Adding this to the roles section "externalKerberosPrincipals" : [
{
"name" : "principal1",
"primary" : "${principal}",
"instance" : "${host}"
},
{
"name" : "principal2",
"primary" : "alice",
"instance" : "${host}"
}
] 2) Adding this to the roles.configWriter.generators "kerberosPrincipals" : [
{
"principalName" : "bluetalon_principal",
"propertyName" : "bluetalon.kerberos.principal",
"external" : "true",
"instanceWildcard" : "_HOST"
},
{
"principalName" : "bluetalon_principal2",
"propertyName" : "bluetalon.other.kerberos.principal",
"external" : "true",
"instanceWildcard" : "_HOST"
}
], The key things that need to happen for this to work are that the principal names and keytab locations need to get added to the service's site file. The reason they can't be added statically is that the principal names depend on the host and the realm e.g. alice/hostname1@EXAMPLE.COM, and the keytab location of the external service changes every time that service is restarted. Is there a way to use the sdl file to handle all of the restrictions I've mentioned?
... View more
