My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company:
- The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with LDAP backend)
- We have a secondary LDAP listing, without KDC (with r/w permissions)
- We have Microsoft AD with LDAP, both in read-only and according to security policy no cross-realm trust from AD to Hadoop Kerberos is allowed. The AD-LDAP is in read-only mode.
And now my task is to allow users of secondary LDAP and AD-LDAP to use Hadoop, thus the dedicated KDC must know them somehow.
What I am was thinking about:
- Maybe I can add the read-only LDAP directories as additional Kerberos backends?
- I can install additional Kerberos that would manage those LDAPs with additional realm (e.x.
@ADLDAPor similar). And then create a cross-realm trust. However I have write permissions only on secondary LDAP, not the AD-LDAP, thus I see no way of adding the cross-realm trust that easily there.
- I could try to define some kind of name conversion, so that the
ldapsearchallowed user would be seen as