> On Jan. 16, 2017, 3:04 a.m., Sebastian Toader wrote: > > Does this require any UI/backend api changes in order to allow users to > > change the ```principal_suffix``` later?
No UI changes are necessay. The UI will automatically pick up the prefix_suffix property and label it as "Prefix Suffix" in the Enable Kerberos wizard and the Kerberos administration page. If changed from the Kerberos administration page, Ambari will recreate the identities and keytab files. - Robert ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/55513/#review161690 ----------------------------------------------------------- On Jan. 13, 2017, 1:14 p.m., Robert Levas wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/55513/ > ----------------------------------------------------------- > > (Updated Jan. 13, 2017, 1:14 p.m.) > > > Review request for Ambari, Alejandro Fernandez, Attila Magyar, Eugene > Chekanskiy, Laszlo Puskas, and Sebastian Toader. > > > Bugs: AMBARI-19430 > https://issues.apache.org/jira/browse/AMBARI-19430 > > > Repository: ambari > > > Description > ------- > > Use common property for principal name prefix to help with customization of > unique principal names. > > All _headless_ Kerberos identities have a non-unique principal name (across > clusters). To help this issue, the cluster name is appended to these > principal names by adding "-${cluster-name|toLower()}" after the principal > name component. If the user wants to change this convention, they will need > to find all _headless_ principals and make the change. On top of that, when > adding new components, they will need to remember to make the change to new > _headless_ principal names. > > A better solution is to provide a _global_ property named "principal_suffix" > and use that in each _headless_ principal name. By default the value for this > property will be > > ``` > principal_suffix="-${cluster_name|toLower()}" > ``` > > If the user would like not use a prefix (in the event there is only a single > cluster connecting to the KDC), the value can be changed to > > ``` > principal_suffix="" > ``` > > Finally if the user would like to use some other randomizer, they can set the > value to something else. For example > > ``` > principal_suffix="_12345" > ``` > > The property is set in the Kerberos descriptor's "properties" block. For > example: > > ``` > { > "properties": { > "realm": "${kerberos-env/realm}", > ..., > "principal_suffix": "-${cluster_name|toLower()}" > }, > "identities": [ > ..., > { > "name": "smokeuser", > "principal": { > "value": "${cluster-env/smokeuser}${principal_suffix}@${realm}", > "type": "user", > "configuration": "cluster-env/smokeuser_principal_name", > "local_username": "${cluster-env/smokeuser}" > }, > ... > } > ], > "services": [ > { > ``` > > > Diffs > ----- > > > ambari-funtest/src/test/resources/stacks/HDP/2.0.8/services/HDFS/kerberos.json > d53205d > > ambari-server/src/main/resources/common-services/ACCUMULO/1.6.1.2.2.0/kerberos.json > caef123 > > ambari-server/src/main/resources/common-services/HBASE/0.96.0.2.0/kerberos.json > 636d36e > > ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/kerberos.json > f30c9e4 > > ambari-server/src/main/resources/common-services/HDFS/3.0.0.3.0/kerberos.json > 1dd801b > ambari-server/src/main/resources/common-services/SPARK/1.2.1/kerberos.json > fa6af33 > ambari-server/src/main/resources/common-services/SPARK/1.4.1/kerberos.json > e7f78cd > ambari-server/src/main/resources/common-services/SPARK2/2.0.0/kerberos.json > 20e1dc0 > ambari-server/src/main/resources/common-services/STORM/0.9.1/kerberos.json > fcfe524 > ambari-server/src/main/resources/common-services/STORM/1.0.1/kerberos.json > 3068226 > > ambari-server/src/main/resources/common-services/ZEPPELIN/0.6.0.2.5/kerberos.json > 7c4c04c > ambari-server/src/main/resources/stacks/HDP/2.0.6/kerberos.json 9579d0f > > ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/ECS/kerberos.json > 9668354 > > ambari-server/src/main/resources/stacks/HDP/2.3.ECS/services/HBASE/kerberos.json > 20b10f7 > > ambari-server/src/main/resources/stacks/HDP/2.3.GlusterFS/services/ACCUMULO/kerberos.json > 678a2b5 > > ambari-server/src/main/resources/stacks/HDP/2.3/services/ACCUMULO/kerberos.json > 0fec0ab > > ambari-server/src/main/resources/stacks/HDP/2.5/services/HBASE/kerberos.json > 9ed40ef > ambari-server/src/main/resources/stacks/HDP/2.5/services/HDFS/kerberos.json > 9000e95 > > ambari-server/src/main/resources/stacks/HDP/2.5/services/SPARK/kerberos.json > bd6c6c1 > > ambari-server/src/main/resources/stacks/HDP/2.6/services/SPARK/kerberos.json > ae0d631 > > ambari-server/src/main/resources/stacks/HDP/2.6/services/SPARK2/kerberos.json > a16e2e1 > ambari-server/src/main/resources/stacks/HDP/3.0/kerberos.json 9579d0f > ambari-server/src/main/resources/stacks/PERF/1.0/kerberos.json a2a667b > > ambari-server/src/main/resources/stacks/PERF/1.0/services/GRUMPY/kerberos.json > 3bf5fbd > > ambari-server/src/main/resources/stacks/PERF/1.0/services/HAPPY/kerberos.json > ae84eaf > > ambari-server/src/main/resources/stacks/PERF/1.0/services/HBASE/kerberos.json > 9ed40ef > > ambari-server/src/main/resources/stacks/PERF/1.0/services/HDFS/kerberos.json > 974a69c > > ambari-server/src/main/resources/stacks/PERF/1.0/services/SLEEPY/kerberos.json > 45e33f5 > > ambari-server/src/main/resources/stacks/PERF/1.0/services/SNOW/kerberos.json > 47a979a8 > > ambari-server/src/test/java/org/apache/ambari/server/controller/KerberosHelperTest.java > 91cd608 > > ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosDescriptorUpdateHelperTest.java > 5c2e74e > > ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_2_1_3.json > a9e0bcd > > ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_no_hdfs.json > dcf5bbc > > ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_simple.json > fb884b7 > > ambari-server/src/test/resources/stacks/HDP/2.0.8/services/HDFS/kerberos.json > d53205d > ambari-web/test/utils/config_test.js bb3a308 > ambari-web/test/utils/object_utils_test.js f70259c > > contrib/management-packs/hdf-ambari-mpack/src/main/resources/stacks/HDF/2.0/kerberos.json > c5ebe20 > > Diff: https://reviews.apache.org/r/55513/diff/ > > > Testing > ------- > > Manually tested new cluster, Ambari upgrade, and stack upgrade scenarios. > > > Thanks, > > Robert Levas > >
