Step 3: Get or Create a Kerberos Principal for the Cloudera Manager Server
In order to create and deploy the host principals and keytabs on your cluster, the Cloudera Manager Server must have the correct Kerberos principal. Specifically, the Cloudera Manager Server must have a Kerberos principal that has administrator privileges. Typically, principals with the second component of admin in the principal name (for example, username/admin@EXAMPLE.COM) have administrator privileges. This is why admin is shown in the following instructions and examples.
- Ask your Kerberos administrator to create a Kerberos administrator principal for the Cloudera Manager Server.
- Create the Kerberos principal for the Cloudera Manager Server yourself by using the following instructions in this step.
Creating the Cloudera Manager Principal
If you are using Active Directory
- Create an Organizational Unit (OU) in your AD where all the principals used by your CDH cluster will reside.
- Add a new AD user, for example, <username>@EXAMPLE.COM. The password for this user should be set to never expire.
- Use AD's Delegate Control wizard to allow this new user to Create, Delete and Manage User Accounts.
If you are using MIT KDC
kadmin: addprinc -pw <Password> cloudera-scm/admin@EXAMPLE.COM