I am in the process of upgrading a secure cluster from HDP 2.2.0 to 2.2.4 but this involves upgrading Ambari from 1.7 to 2.0 to start with.
The “Enable Security” wizard has changed and it now requires the entry of a KDC Admin host, a kadmin principal and a password for that.
Is that correct? Should it be asking for this? I believe that Ambari wishes to create its own users and keytab files rather than create them manually as we have done in the past. However I have two problems with this:
One is that I can’t believe that I will be ever given the admin password for my company’s security system. I basically have to ask someone else to create users and this is no exception. (Also they already exist – apart from new services like Ambari-Metrics)
Two: I don’t have a KDC Admin. I am using Centrify which is mostly AD (ie LDAP) but also provides KDC Kerberos Client services. If I want to do admin then I (or someone else) goes to a web based interface.
So can Ambari 2.0 work if it does not have a KDC Admin?