I have posted the below as a jira, Ambari-23026.
I am mailing here because I want to ensure I am understanding the "issue"
and not missing the reason for this configuration. Thanks
In a Kerberized cluster some web endpoints (App Timeline Web UI,
ResourceManger Web UI, etc.) require authentication.
Any Ambari alerts checking those endpoints must then be able to
This was addressed in AMBARI-9586, however the default principal and keytab
used in the alerts.json is that of the "bare" SPNEGO principal
My understanding is that the HTTP service principal is used to authenticate
users to a service, not used to authenticate to another service.
1. Since most endpoints involved are Web UI, would it be more appropriate
to use the smokeuser in the alerts?
2. This was first observed in Ranger Audit, the YARN Ranger Plug-in showed
many access denied from HTTP user. [This post](
provided some direction as to where those requests were coming from. We
have updated the ResourceManger Web UI alert definition to use
cluster-env/smokeuser_keytab and cluster-env/smokeuser_principal_name, this
has resolved the initial HTTP access denied.
Would it also be advisable to make the change in the other secure Web UI