All Products
Search

This Product

    E-MapReduce:Cross-realm mutual trust

    Document Center

    E-MapReduce:Cross-realm mutual trust

    Last Updated:Aug 20, 2026

    This topic describes how to configure cross-realm mutual trust for Kerberos to enable access between different Kerberos clusters.

    Procedure

    This topic demonstrates how to configure cross-realm mutual trust using an example where Cluster-A needs to access a service in Cluster-B. Once configured, Cluster-A can access services in Cluster-B by obtaining a ticket granting ticket (TGT) from its own key distribution center (KDC). The procedure described creates a one-way trust, which means Cluster-B cannot access services in Cluster-A. To enable two-way cross-realm mutual trust, repeat the procedure but swap the roles of the clusters.

    Step 1: Preparation

    For both Cluster-A and Cluster-B, go to the Kerberos service configuration page. From the krb5.conf file, get the kdc_hosts and realm. This example uses the following cluster information:

    • Cluster-A information:

      • hostname: master-1-1.1234.cn-hangzhou.emr.aliyuncs.com

      • realm: EMR.1234.COM

    • Cluster-B information:

      • hostname: master-1-1.6789.cn-hangzhou.emr.aliyuncs.com

      • realm: EMR.6789.COM

    Step 2: Add the cross-realm authentication principal

    1. Use SSH to log on to the master-1-1 node of Cluster-A.

    2. As the root user, run the following command.

      kadmin.local -q "addprinc -pw 123456 krbtgt/EMR.6789.COM@EMR.1234.COM"

      Parameter descriptions:

      • 123456: The initial password. You can specify a custom password.

      • EMR.1234.COM: The realm of Cluster-A.

      • EMR.6789.COM: The realm of Cluster-B.

    3. Log on to the master-1-1 node of Cluster-B and repeat the previous step to add the cross-realm authentication principal. Ensure that you use the same password and reverse the realm order in the command.

    Step 3: Configure krb5.conf

    Connect to each node in Cluster-A over SSH and modify the /etc/krb5.conf configuration file. A service restart is not required.

    • [realms]

      EMR.C-BE49B6BBAEEA****.COM = {
  kdc = 192.168.xx.xx:88
  admin_server = 192.168.xx.xx:749
}

    • [domain_realm]

      .1234.cn-hangzhou.emr.aliyuncs.com = EMR.1234.COM
.6789.cn-hangzhou.emr.aliyuncs.com = EMR.6789.COM

    • [capaths]

      EMR.1234.COM = {
   EMR.6789.COM = .
}
EMR.6789.COM = {
   EMR.1234.COM = .
}
    Note

    To run a job on Cluster-A that accesses Cluster-B, you must also restart the YARN service on Cluster-B.

    Step 4: Access services on Cluster-B

    You can now use a Kerberos ticket obtained from Cluster-A to access a service in Cluster-B.

    1. Create a test principal and generate a ticket.

      kadmin.local -q  "addprinc -pw 123456 test"
kinit test

    2. Access the HDFS service on Cluster-B.

      hdfs dfs -ls hdfs://master-1-1.6789.cn-hangzhou.emr.aliyuncs.com:9000/