All Products
Search

This Product

    E-MapReduce:Connect an EMR cluster to an external KDC

    Document Center

    E-MapReduce:Connect an EMR cluster to an external KDC

    Last Updated:Aug 20, 2026

    E-MapReduce (EMR) clusters running version EMR-3.43.1 or later and EMR-5.9.1 or later support connecting to an external Key Distribution Center (KDC) during cluster creation. When you use Kerberos authentication in an EMR cluster, you can use an external KDC for unified identity management and authentication instead of the self-managed KDC created within the cluster.

    Prerequisites

    Obtain the IP addresses for the KDC and Kadmin service, and the name and password of the administrative principal.

    Note

    Ensure you provide the correct information to avoid connection errors.

    Limitations

    The external KDC must be based on MIT Kerberos.

    Considerations

    Ensure network connectivity between the EMR cluster and your external KDC. For example, TCP ports 88 and 749, and UDP port 88 must be open.

    Procedure

    For detailed instructions on creating a cluster, see Create a cluster.

    1. In the Software Configuration step of cluster creation, go to the Advanced Settings section and turn on the Kerberos Authentication toggle.

    2. Select External KDC.

      By default, Self-managed KDC is selected, which creates a KDC within the cluster. To connect to your existing KDC, provide the following information.

      Parameter

      Description

      KDC hosts

      The IP address and port of the KDC.

      If you specify multiple IP addresses, separate them with a comma. Example: 192.168.**.**:88,192.168.**.**:88.

      Important

      Ensure the EMR cluster can connect to the specified KDC address and port.

      Realm name

      The name of the Kerberos realm. Example: EMR.C-XXXXX.COM.

      Kadmin hosts

      The IP address and port of the Kadmin service.

      If you specify multiple IP addresses, separate them with a comma. Example: 192.168.**.**:749,192.168.**.**:749.

      Important

      Ensure the EMR cluster can connect to the specified Kadmin service address and port.

      Admin principal

      The name of the administrative principal for connecting to the Kadmin service. Example: root/admin.

      This principal must have administrative permissions to create principals and export keytab files.

      Admin password

      The password for the administrative principal.

      Confirm Password