E-MapReduce:Basic Kerberos operations

Prerequisites

• You have created a cluster with Kerberos authentication enabled. For details, see Create a cluster.

• You have logged on to the cluster. For details, see Log on to a cluster.

Configuration files

• krb5.conf: The client-side Kerberos configuration file.

  It specifies the KDC service location, realm names, and hostname-to-realm mappings. This file is located at /etc/krb5.conf on each E-MapReduce node.

• kdc.conf: The server-side Kerberos configuration file, which supplements krb5.conf.

  It configures KDC-related services such as krb5kdc, kadmind, and kdb5_util, and resides only on the KDC node at /var/kerberos/krb5kdc/kdc.conf.

Basic operations

Server side

• Access the kadmin CLI

  • If you are logged on to the master-1-1 node (which hosts the KDC, the Kerberos server-side program) as the root user, run the following command to directly access the kadmin CLI.

    kadmin.local

  • If you are logged on to another node or using a gateway, run the following command to access the kadmin CLI.

    kadmin -p <admin-user> -w <admin-password>

    Note

    If you use the KDC provided with E-MapReduce, the parameters are as follows:

    • <admin-user>: The value is root/admin.

    • <admin-password>: You can obtain the value of the admin_pwd parameter on the Configure tab for the Kerberos service in the E-MapReduce console.

• Manage principals

  A principal is a unique identity in Kerberos that represents a user or service and to which credentials can be assigned.

  • Create a principal

    addprinc -pw <principal-password> <principal-name>

    Parameters:

    • <principal-password>: The password for the new principal.

    • <principal-name>: The name of the new principal. The typical format for a service principal is username/hostname@realm, and the format for a user principal is username@realm.

  • Delete a principal

    delprinc <principal-name>

  • Change a principal's password

    change_password <principal-name>

  • List all principals

    listprincs

• Manage keytabs

  A keytab stores the keys for one or more principals, allowing services to obtain tickets without interactive authentication. To export a keytab file, run the following command.

  ktadd -k <keytab-path> <principal-name>

  Parameters:

  • <keytab-path>: The destination path for the keytab file.

  • <principal-name>: The name of the principal.

  Warning

  In E-MapReduce, each service maintains its own principal (for example, spark/hostname@realm) and a corresponding keytab file for internal authentication and authorization. Modifying or exporting the keytab file for such a principal invalidates the original keytab file, which disrupts service operations. Therefore, do not modify this type of principal or export its keytab file.

Client side

Related topics

For an overview of Kerberos concepts and authentication principles, see Kerberos.