[ https://issues.apache.org/jira/browse/AMBARI-15561?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15219545#comment-15219545 ]
Swapan Shridhar commented on AMBARI-15561: ------------------------------------------ Screenshot : https://issues.apache.org/jira/secure/attachment/12796258/Screen%20Shot%202016-03-31%20at%2012.45.42%20AM.png Steps to reproduce : Have HDFS, YARN, MapReduce2, Tez, Hive, Pig and ZooKeeper added. Do the kerberization. > Automate creation of Ambari Server proxy users (secure/non-secure clusters), > principal and keytab, setup of JAAS (secure clusters) > ---------------------------------------------------------------------------------------------------------------------------------- > > Key: AMBARI-15561 > URL: https://issues.apache.org/jira/browse/AMBARI-15561 > Project: Ambari > Issue Type: Improvement > Components: ambari-server > Reporter: Sandor Magyari > Assignee: Sandor Magyari > Priority: Critical > Fix For: ambari-2.4.0 > > Attachments: AMBARI-15561-v2.patch, Screen Shot 2016-03-31 at > 12.45.42 AM.png > > > The aim of this improvement is to automate the following: > - creation of proxy users for Ambari server necessary for views (Files, Hive, > Pig, Tez etc) > - creation of Ambari Server principal and keytab, and setup of JAAS which is > currently a manual step documented here: > http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.0.0/bk_Ambari_Security_Guide/content/_optional_set_up_kerberos_for_ambari_server.html > In case of a non secure cluster, Ambari proxy user will be set up for the > user account Ambari Server is running as. This is specified in > *ambari-server.properties* by *ambari-server.user* and can be adjusted by > running 'ambari-server setup'. > Stackadvisor is responsible for configuring proxy users, both for secure / > non-secure cluster, wizard or blueprint based deployments. > Therefore in case of blueprint based deployments proxy users will be only > created if "config_recommendation_strategy": "ALWAYS_APPLY" in Cluster > template. > The following proxy users will be configured by stackadvisor: > {code} > hadoop.proxyuser.${ambari_proxy_user}.groups=* > hadoop.proxyuser.${ambari_proxy_user}.hosts=* > hadoop.proxyuser.hcat.groups=* > hadoop.proxyuser.hcat.hosts=* > webhcat.proxyuser.${ambari_proxy_user}.groups=* > webhcat.proxyuser.${ambari_proxy_user}.hosts=* > yarn.timeline-service.http-authentication.proxyuser.${ambari_proxy_user}.hosts=* > > yarn.timeline-service.http-authentication.proxyuser.${ambari_proxy_user}.users=* > > yarn.timeline-service.http-authentication.proxyuser.${ambari_proxy_user}.groups=* > > {code} > For a secure (eg. securityType=KERBEROS) cluster proxy user will be setup > based on Ambari Server principal. > A new identity 'ambari-server' will be added to default kerberos descriptor > where principal name is specified which can be modified either in Kerberos > Setup wizard screen, or by submitting a custom kerberos descriptor in > Blueprint case. > By default, principal name is: > {code}ambari-server-${cluster_name}@${realm}{code} > Generate principal & keytab is set in JAAS configuration file. > Generation of Ambari Server principal and keytab can be enabled / disabled by > setting config property *create_ambari_principal* = true / false in > kerberos-env config. ('Create Ambari Principal & Keytab' on Keberos Setup > wizard screen). This is enabled by default. > There is a new functionality in Kerberos related handling of configurations > recommended by StackAdvisor, properties marked with delete flag by > StackAdvisor are removed from configuration when running Enable Kerberos > wizard. This is necessary to be able to remove old Ambari proxy users in > non-secure mode. > In a scenario where multiple Ambari servers are managing a single cluster, > only the _operation master_ Ambari server will be affected. All other Ambari > server instances will need to be manually updated. Meaning, the Ambari server > keytab file will need to be manually distributed to the _other_ Ambari server > hosts. Also, the _other_ Ambari servers' JAAS files will need to be manually > updated either by editing the {{/etc/ambari-server/conf/krb5JAASLogin.conf}} > file or by executing {{ambari-server setup-security}} and selecting option > #3, {{Setup Ambari kerberos JAAS configuration}}. -- This message was sent by Atlassian JIRA (v6.3.4#6332)