RFC2307 attributes and newer versions of Windows AD Server

Been seeing a few questions lately around RFC2307 and removal or deprecation post Windows Server 2008 within AD. Since Isilon multi-directory service and multiprotocol often relies heavily on this functionality, I dug a little deeper and found this excellent blog from MS on what all this means. https://blogs.technet.microsoft.com/activedirectoryua/2016/02/09/identity-management-for-unix-idmu-is-deprecated-in-windows-server/

Read more "RFC2307 attributes and newer versions of Windows AD Server"

KDC Kerberized Yarn Services Fail to Start on Isilon OneFS 8.0.1 with Ambari via WebHDFS curl calls

An issue has been seen when a KDC kerberized Hortonworks cluster attempts to start Yarn services or any other services that leverage WebHDFS to start with OneFS 8.0.1. The incorrect generation of the the krb5.conf can leave the file without a READ permission for the services handling WebHDFS calls and authentication cannot occur leading to […]

Read more "KDC Kerberized Yarn Services Fail to Start on Isilon OneFS 8.0.1 with Ambari via WebHDFS curl calls"

Tweaks to HDFS services to make them play nice with Kerberized Isilon access

If you are kerberizing a hadoop cluster against an Isilon, you’ll need to look at adding the following to the hdfs services to enable Isilon compatibility. All Distro’s 1. Add custom property hadoop.security.token.service.use_ip=false to core-site.xml When you kerberize with AD, Isilon’s cluster SPN is used and not the SCZ SPN.  (this is our odd behavior) […]

Read more "Tweaks to HDFS services to make them play nice with Kerberized Isilon access"

Increase the kerberos logging level on a client to see what is actually going on

if you are seeing issues with kerberos based hdfs client access against an Isilon cluster, increasing the kerberos logging level on the client can show you a lot more information(a lot) Change the logging level with the following: export HADOOP_ROOT_LOGGER=”TRACE,console” export HADOOP_OPTS=”-Dsun.security.krb5.debug=true”     quick example of a successful kerberized hadoop call from a kerberized […]

Read more "Increase the kerberos logging level on a client to see what is actually going on"