We have a working structure for our hadop where openldap was used for authentication with below structure,along with ranger and knox.
openldap root:-
dn: dc=abchadoop,dc=com,dc=za
Subtree inside openldap like below:-
dn: ou=people,dc=abchadoop,dc=com,dc=za
dn: ou=groups,dc=abchadoop,dc=com,dc=za
dn: ou=services,dc=abchadoop,dc=com,dc=za
dn: cn=ud_devtest,ou=people,dc=abchadoop,dc=com,dc=za
dn: cn=hcat,ou=services,dc=abchadoop,dc=com,dc=za
dn: cn=hive_dev,ou=groups,dc=abchadoop,dc=com,dc=za
Now we integarted kerberos with openldap as backend(same server) as backend and then picture became dirty with lot of confusions. After adding kerberos , new entries are like below in openldap:-
openldap root:-
dn: dc=abchadoop,dc=com,dc=za
Subtree inside openldap like below:-
dn: ou=people,dc=abchadoop,dc=com,dc=za
dn: ou=groups,dc=abchadoop,dc=com,dc=za
dn: ou=services,dc=abchadoop,dc=com,dc=za
dn: cn=ud_devtest,ou=people,dc=abchadoop,dc=com,dc=za
dn: cn=hcat,ou=services,dc=abchadoop,dc=com,dc=za
dn: cn=hive_dev,ou=groups,dc=abchadoop,dc=com,dc=za
kerberos:-
dn: cn=kerberos,dc=abchadoop,dc=com,dc=za
dn: cn=ABCHDP.COM,cn=kerberos,dc=abchadoop,dc=com,dc=za
--
Hadoop kerberos principals
--
dn: krbPrincipalName=ud_dvjones@ABCHDP.COM,cn=ABCHDP.COM,cn=kerberos,dc=abchadoop,dc=com,dc=za
dn: krbPrincipalName=ud_devtest@ABCHDP.COM,cn=ABCHDP.COM,cn=kerberos,dc=abchadoop,dc=com,dc=za
now i have some further confusions :-
I have realm name as ABCHDP.COM instead of abchadoop.com.sa as in most of the example over internet uses(example.com as domain name and EXAMPLE.COM as realm name) it is mandatory to have same as for both openldap root and kerberos realm??
ud_devtest was already existing with password1 when openldap was created and after kerberos installation we created one more principal with same name but here we have give different password (password2) , is there any way to sync password??
Going forward where should i create users , ldap or kerberos ??
Can someone help me in understand.