[ https://issues.apache.org/jira/browse/AMBARI-14627?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Olivér Szabó updated AMBARI-14627: ---------------------------------- Status: Open (was: Patch Available) > Ability to automate setup-security and setup-ldap/sync-ldap > ----------------------------------------------------------- > > Key: AMBARI-14627 > URL: https://issues.apache.org/jira/browse/AMBARI-14627 > Project: Ambari > Issue Type: Bug > Components: ambari-server > Affects Versions: 2.2.1 > Reporter: Krisztian Horvath > Assignee: Olivér Szabó > Fix For: 2.4.0 > > Attachments: AMBARI-14627_v5.patch > > > Currently the ambari-server setup-security command does not have any options > thus it's interactive. This makes it really hard to automate this process. > For kerberos 1 option should be enough for setting the master key. > Same for setup-ldap and sync-ldap > Example usage: > {code:java} > 1.) LDAP setup: > ambari-server setup-ldap \ > --ldap-url="ldap.apache.org389" \ > --ldap-secondary-url="" \ > --ldap-ssl="false" \ > --ldap-user-class="person" \ > --ldap-user-attr="sAMAccountName" \ > --ldap-group-class="group" \ > --ldap-group-attr="cn" \ > --ldap-member-attr="member" \ > --ldap-dn="distunguishedName" \ > --ldap-base-dn="dc=ambari01,dc=local" \ > --ldap-referral="" \ > --ldap-bind-anonym=false \ > --ldap-manager-dn="cn=hdfs,ou=ambari,dc=ambari01,dc=local" \ > --ldap-manager-password="myldappassword" \ > --ldap-save-settings \ > --truststore-type="jks" \ > --truststore-path="/var/lib/ambari-server/keys/jkskeystore.jks" \ > --truststore-password="mypass" > 2.) Ldap sync: > ambari-server sync-ldap --groups=groups.txt --ldap-sync-admin-name=admin > --ldap-sync-admin-password=admin > 3.) Setup Https: > ambari-server setup-security \ > --security-option=setup-https \ > --api-ssl=true --client-api-ssl-port=8443 \ > --import-cert-path=/var/lib/ambari-server/keys/my.crt \ > --import-key-path=/var/lib/ambari-server/keys/my.key \ > --pem-password=password > 4.) Encrypt passwords: > ambari-server setup-security --security-option=encrypt-password > --master-key=masterkey --master-key-persist=true > 5.) Setup Kerberos JAAS: > ambari-server setup-security --security-option=setup-kerberos-jaas > --jaas-principal="amb...@example.com" > --jaas-keytab="/etc/security/keytabs/ambari.keytab" > 6.) Setup TrustStore: > ambari-server setup-security \ > --security-option=setup-truststore \ > --truststore-path=/var/lib/ambari-server/keys/keystore.p12 \ > --truststore-type=pkcs12 \ > --truststore-password=password \ > --truststore-reconfigure > 7.) Import certificate to TrustStore: > ambari-server setup-security \ > --security-option=import-certificate \ > --truststore-path=/var/lib/ambari-server/keys/keystore.p12 \ > --truststore-type=pkcs12 \ > --truststore-password=password \ > --import-cert-path=/var/lib/ambari-server/my.crt \ > --import-cert-alias=myalias \ > --truststore-reconfigure > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)