[ https://issues.apache.org/jira/browse/AMBARI-16171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15284707#comment-15284707 ]
Josh Elser commented on AMBARI-16171: ------------------------------------- Sorry about the spam. JIRA freaked out both times I tried to attach the file. I didn't realize it actually went through the first time. > Changes to Phoenix QueryServer Kerberos configuration > ----------------------------------------------------- > > Key: AMBARI-16171 > URL: https://issues.apache.org/jira/browse/AMBARI-16171 > Project: Ambari > Issue Type: Improvement > Reporter: Josh Elser > Assignee: Josh Elser > Attachments: AMBARI-16171.001.patch, AMBARI-16171.002.patch, > AMBARI-16171.003.patch > > > The up-coming version of Phoenix will contain some new functionality to > support Kerberos authentication of clients via SPNEGO with the Phoenix Query > Server (PQS). > Presently, Ambari will configure PQS to use the hbase service keytab which > will result in the SPNEGO authentication failing as the RFC requires that the > "primary" component of the Kerberos principal for the server is "HTTP". Thus, > we need to ensure that we switch PQS over to use the spnego.service.keytab as > the keytab and "HTTP/_HOST@REALM" as the principal. -- This message was sent by Atlassian JIRA (v6.3.4#6332)