My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company:

  1. The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with LDAP backend)
  2. We have a secondary LDAP listing, without KDC (with r/w permissions)
  3. We have Microsoft AD with LDAP, both in read-only and according to security policy no cross-realm trust from AD to Hadoop Kerberos is allowed. The AD-LDAP is in read-only mode.

And now my task is to allow users of secondary LDAP and AD-LDAP to use Hadoop, thus the dedicated KDC must know them somehow.

What I am was thinking about:

  • Maybe I can add the read-only LDAP directories as additional Kerberos backends?
  • I can install additional Kerberos that would manage those LDAPs with additional realm (e.x. @LDAP & @ADLDAP or similar). And then create a cross-realm trust. However I have write permissions only on secondary LDAP, not the AD-LDAP, thus I see no way of adding the cross-realm trust that easily there.
  • I could try to define some kind of name conversion, so that the ldapsearch allowed user would be seen as krbtgt/HADOOP@ADLDAP.
  • After long research I have found some ways, how it might work. However all of them are not plausible. Either you are Kerberized or Not. With this my question becomes absolute. Commented Jul 6, 2017 at 16:48


You must log in to answer this question.

Browse other questions tagged .