My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company:

  1. The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with LDAP backend)
  2. We have a secondary LDAP listing, without KDC (with r/w permissions)
  3. We have Microsoft AD with LDAP, both in read-only and according to security policy no cross-realm trust from AD to Hadoop Kerberos is allowed. The AD-LDAP is in read-only mode.

And now my task is to allow users of secondary LDAP and AD-LDAP to use Hadoop, thus the dedicated KDC must know them somehow.

What I am was thinking about:

  • Maybe I can add the read-only LDAP directories as additional Kerberos backends?
  • I can install additional Kerberos that would manage those LDAPs with additional realm (e.x. @LDAP & @ADLDAP or similar). And then create a cross-realm trust. However I have write permissions only on secondary LDAP, not the AD-LDAP, thus I see no way of adding the cross-realm trust that easily there.
  • I could try to define some kind of name conversion, so that the ldapsearch allowed user would be seen as krbtgt/HADOOP@ADLDAP.
  • After long research I have found some ways, how it might work. However all of them are not plausible. Either you are Kerberized or Not. With this my question becomes absolute. – Mihail Gershkovich Jul 6 '17 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.