kdc 互信

环境：

29.3.203.53（sysops00065017） 部署KDC Namnode Datanode，KDC负责TESTA.COM域的认证

29.3.203.54（sysops00065018） 部署KDC Namnode Datanode，KDC负责TESTB.COM域的认证

确保两台机器能互相使用主机名ping通

一、

两台kdc都添加krbtgt/TESTA.COM@TESTB.COM和krbtgt/TESTB.COM@TESTA.COM

如果在TESTA.COM访问TESTB.COM上的服务，需要krbtgt/TESTB.COM@TESTA.COM

二、修改krb5.conf（红色为需要修改的地方）

TESTA.COM  29.3.203.53（sysops00065017）

[realms]

TESTA.COM = {

kdc = sysops00065017

admin_server = sysops00065017

master_kdc = sysops00065017

default_domain = .TESTA.COM

}

TESTB.COM = {

kdc = sysops00065018

admin_server = sysops00065018

master_kdc = sysops00065018

default_domain = .TESTB.COM

}

[domain_realm]

.testa.com = TESTA.COM

testa.com = TESTA.COM

.testb.com = TESTB.COM

testb.com = TESTB.COM

sysops00065017 = TESTA.COM

sysops00065018 = TESTB.COM

[capaths]

TESTA.COM = {

TESTB.COM = .

}

TESTB.COM  29.3.203.54（sysops00065018）

[realms]

TESTA.COM = {

kdc = sysops00065017

admin_server = sysops00065017

master_kdc = sysops00065017

default_domain = .TESTA.COM

}

TESTB.COM = {

kdc = sysops00065018

admin_server = sysops00065018

master_kdc = sysops00065018

default_domain = .TESTB.COM

}

[domain_realm]

.testb.com = TESTB.COM

testb.com = TESTB.COM

.testa.com = TESTA.COM

testa.com = TESTA.COM

sysops00065017 = TESTA.COM

sysops00065018 = TESTB.COM

[capaths]

TESTB.COM = {

TESTA.COM = .

}

三、修改core-site.xml（两个域都要配置）

<property>

<name>hadoop.security.auth_to_local</name>

<value>

RULE:[1:$1@$0](^.*@TESTA\.COM$)s/^(.*)@TESTA\.COM$/$1/g

RULE:[2:$1@$0](^.*@TESTA\.COM$)s/^(.*)@TESTA\.COM$/$1/g

RULE:[1:$1@$0](^.*@TESTB\.COM$)s/^(.*)@TESTB\.COM$/$1/g

RULE:[2:$1@$0](^.*@TESTB\.COM$)s/^(.*)@TESTB\.COM$/$1/g

DEFAULT

</value>

</property>

四、修改hdfs-site.xml（两个域都要配置）

<property>

<name>dfs.namenode.kerberos.principal.pattern</name>

<value>*</value>

</property>

五、          重启Namdnode\KDC服务

六、          测试

TESTA上使用hdfs/sysops00065017@TESTA.COM访问两个集群的文件：

其中TESTA的KDC日志显示

Aug 15 15:49:51 SYSOPS00065017 krb5kdc[9868](info): TGS_REQ (2 etypes {16 23}) 29.3.203.53: ISSUE: authtime 1565855227, etypes {rep=16 tkt=16 ses=16}, hdfs/sysops00065017@TESTA.COM for krbtgt/TESTB.COM@TESTA.COM

TESTB的KDC日志显示

Aug 15 15:49:50 SYSOPS00065018 krb5kdc[26655](info): TGS_REQ (2 etypes {16 23}) 29.3.203.53: ISSUE: authtime 1565855227, etypes {rep=16 tkt=16 ses=16}, hdfs/sysops00065017@TESTA.COM for hdfs/sysops00065018@TESTB.COM

TESTB上使用hdfs/sysops00065018@TESTB.COM访问两个集群的文件：

其中TESTA的KDC日志显示

Aug 15 15:51:02 SYSOPS00065017 krb5kdc[9868](info): TGS_REQ (2 etypes {16 23}) 29.3.203.54: ISSUE: authtime 1565774273, etypes {rep=16 tkt=16 ses=16}, hdfs/sysops00065018@TESTB.COM for hdfs/sysops00065017@TESTA.COM

TESTB的KDC日志显示

Aug 15 15:51:01 SYSOPS00065018 krb5kdc[26655](info): TGS_REQ (2 etypes {16 23}) 29.3.203.54: ISSUE: authtime 1565774273, etypes {rep=16 tkt=16 ses=16}, hdfs/sysops00065018@TESTB.COM for krbtgt/TESTA.COM@TESTB.COM