Important:

If YARN Resource Manager HA has been enabled in a non-secure cluster, before enabling Kerberos you must clear the StateStore znode in ZooKeeper, as follows:

1. Go to the Cloudera Manager Admin Console home page, click to the right of the YARN service and select Stop.
2. When you see a Finished status, the service has stopped.
3. Go to the YARN service and select Actions > Format State Store.
4. When the command completes, click Close.

Once you are able to check all the items on this list, click Continue.

On this page, select the KDC type you are using: MIT KDC, Active Directory, or Red Hat IPA. Complete the fields as applicable to enable Cloudera Manager to generate principals/accounts for the CDH services running on the cluster.

  Note:

• If you are using AD and have multiple Domain Controllers behind a Load Balancer, enter the name of the Load Balancer in the KDC Server Host field and any one of the Domain Controllers in Active Directory Domain Controller Override. Hadoop daemons will use the Load Balancer for authentication, but Cloudera Manager will use the override for creating accounts.
• If you have multiple Domain Controllers (in case of AD) or MIT KDC servers, only enter the name of any one of them in the KDC Server Host field. Cloudera Manager will use that server only for creating accounts. If you choose to use Cloudera Manager to manage krb5.conf, you can specify the rest of the Domain Controllers using Safety Valve as explained below.
• Make sure the entries for the Kerberos Encryption Types field matches what your KDC supports.
• If you are using an Active Directory KDC, you can configure Active Directory account properties such as objectClass and accountExpires directly from the Cloudera Manager UI. You can also enable Cloudera Manager to delete existing AD accounts so that new ones can be created when Kerberos credentials are being regenerated. See Viewing or Regenerating Kerberos Credentials Using Cloudera Manager.

Click Continue to proceed.

  Note:

If you are using Red Hat IdM/FreeIPA, by default the krb5.conf file contains a line similar to the following:

default_ccache_name = KEYRING:persistent:%{uid}

CDH does not support the keyring credential cache. Comment out this line on every cluster host by adding a hash mark (#) at the beginning, like this:

#default_ccache_name = KEYRING:persistent:%{uid}

If you configure Cloudera Manager to manage the krb5.conf file, you do not need to do anything.

Choose whether Cloudera Manager should deploy and manage the krb5.conf on your cluster or not. If left unchecked, you must ensure that the krb5.conf is deployed on all hosts in the cluster, including the Cloudera Manager Server's host.

If you check Manage krb5.conf through Cloudera Manager, this page will let you configure the properties that will be emitted in it. In particular, the safety valves on this page can be used to configure cross-realm authentication. More information can be found at Configuring a Dedicated MIT KDC for Cross-Realm Trust.

Click Continue to proceed.

  Note: Enter the REALM portion of the principal in upper-case only to conform to Kerberos convention.

  Note:

Many enterprises employ policies that require all passwords to be changed after a particular number of days. If you must change the password in Cloudera Manager for the Account Manager, then:

1. In the Cloudera Manager Admin Console, select Administration > Security.
2. Go to the Kerberos Credentials tab and click Import Kerberos Account Manager Credentials.
3. In the Import Kerberos Account Manager Credentials dialog box, enter the username and password for the user that can create principals for CDH cluster in the KDC.

Enter the username and password for the user that can create principals for CDH cluster in the KDC. This is the user/principal you created in Step 3: Create the Kerberos Principal for Cloudera Manager Server. Cloudera Manager encrypts the username and password into a keytab and uses it as needed to create new principals.

If you are using Red Hat IdM/FreeIPA, enter the IPA admin credentials here. These admin credentials are not stored, and are used only to create a new user and role (named cmadin-<random_id> and cmadminrole, respectively) and retrieve its keytab. Cloudera Manager stores this keytab for future Kerberos operations, such as regenerating the credentials of the CDH service accounts.

Click Continue to proceed.

The Command Details page displays the outcome of the Import KDC Account Manager Credentials command. After it successfully completes, click Continue.

If you have not already done so, run the provided commands on each cluster host to install the Kerberos libraries.

Then, specify the privileged ports needed by the DataNode Transceiver Protocol and the HTTP Web UI in a secure cluster.

You can configure custom service principals for CDH services. Before you begin making configuration changes, see Customizing Kerberos Principals for some additional configuration changes required and limitations. If you want to use custom service principals, uncheck the box labeled Use Default Kerberos Principals, and then specify a custom principal for each service.

Click Continue to proceed.

The Command Details page displays the outcome of the Enable Kerberos command. After it successfully completes, click Continue.

The final page lists the cluster(s) for which Kerberos has been successfully enabled. Click Finish to return to the Cloudera Manager Admin Console home page.