Configuring the KDC

Unix Kerberos KDC (MIT or Heimdal)

The following steps use the kadmin command-line interface to create an SPN and keytab file on a Linux/Unix-based KDC server. Refer to the kadmin documentation for more information.

Run the following command to create the SPN for SingleStore, replacing host.domain.com with the fully-qualified domain name for the host.

kadmin -q "addprinc -randkey memsql/host.domain.com"

You can verify that the SPN was created successfully by running the following getprinc command.

kadmin -q "getprinc memsql/host.domain.com"

After the SingleStore SPN has been created, create the keytab file. Run the following command, replacing /path/to/memsql.keytab with the desired output path, and host.domain.com with the fully-qualified domain name for the host.

kadmin -q "ktadd -k /path/to/memsql.keytab memsql/host.domain.com"

Note the output path for the keytab file, as you will need to copy it to SingleStore aggregator nodes in future steps.

You can verify that the keytab file was created successfully by running the ktutil command.

ktutil

At the ktutil prompt, enter the path to the keytab file you just created and list its contents.

ktutil: read_kt /path/to/memsql.keytab

ktutil: list

If the keytab file was successfully added, output similar to the following will be displayed.

slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    3          memsql/host.domain.com@DOMAIN.COM
   2    3          memsql/host.domain.com@DOMAIN.COM

Note the Key Version Number (KVNO) value. If you create a new keytab file in the future, the encryption keys stored in the older keytab file will be invalidated. You can use this KVNO value to compare an older and newer keytab file for versioning purposes.

Windows Active Directory KDC

The following steps use ktpass.exe, a command-line tool for Windows versions configured with Active Directory Domain Services (AD DS). When ktpass.exe is run with the appropriate parameters, it generates a keytab file that maps an existing Active Directory user principal name (UPN) to a SingleStore service principal name (SPN) and allows Kerberos-authenticated users to connect to the cluster. Refer to the ktpass.exe documentation for more information.

Run the following command in a new command-line window with Administrator permissions, replacing any placeholder values with your own.

ktpass.exe /princ memsql/host.domain.com@DOMAIN.COM /mapuser memsqluser /pass +rndpass /out memsql.keytab /crypto all /ptype KRB5_NT_PRINCIPAL /mapop set

where:

• host.domain.com@DOMAIN.com is the fully-qualified domain name for the host

• memsqluser is the name of the Active Directory user object to bind with the SingleStore SPN