Changing Manager's Domain Name

Scenario

The secure usage scope of users in each system is called a domain. Each system must have a unique domain name. The domain name of FusionInsight Manager is generated during installation. The system administrator can change the domain name on FusionInsight Manager.

• Changing the system domain name is a high-risk operation. Before performing operations in this section, ensure that the OMS data has been backed up by referring to Backing Up Manager Data.

Impact on the System

• During the configuration, all of the clusters need to be restarted and are unavailable during restart.
• After the domain name is changed, the passwords of the Kerberos administrator and OMS Kerberos administrator will be initialized. You need to use the default passwords and then change the passwords. If a component user whose password is generated randomly by the system is used for identity authentication, see Exporting an Authentication Credential File to download the keytab file again.
• After the domain name is changed, passwords of the admin user, component user, and human-machine user added by the system administrator before the domain name change will be reset to the same one. Change these passwords. The reset password consists of two parts: one part is generated by the system and the other is set by the user. The system generating part is Admin@123, which is the default password. For details about the user-defined part, see descriptions of Password Suffix in Table 2. For example, if the system generates Admin@123 and the user sets Test#$%@123, the new password after reset is Admin@123Test#$%@123.
• The new password must meet the password policies. To obtain the new human-machine user password, log in to the active OMS as user omm and run the following script:

  sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Password suffix user_name

  • Password suffix is a parameter set by the user. If it is not specified, the default value Admin@123 is used.
  • user_name is optional. The default value is admin.
  • There can be security risks if a command contains the authentication password. You are advised to disable the command recording function (history) before running the command.

  Example:

  sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Test#$%@123

  To get the reset password after changing cluster domain name.
    pwd_min_len      : 8
    pwd_char_types   : 4
  The password reset after changing cluster domain name is: "Admin@123Test#$%@123"

  In this example, pwd_min_len and pwd_char_types indicate the minimum password length and number of password character types respectively defined in the password policies. Admin@123Test#$%@123 indicates the human-machine user password after the system domain name is changed.

• After the system domain name is changed, the reset password consists of two parts: one part is generated by the system and the other is set by the user. The reset password must meet the password policies. If the password is not long enough, one or multiple at signs (@) are added between Admin@123 and the user-defined part. If there are five character types, a space is added after Admin@123.
  When the user-defined part is Test@123 and the default user password policy is used, the new password is Admin@123Test@123. The password contains 17 characters of four types. To meet the current password policy, the new password is processed according to Table 1.

  Table 1 Password processing

  Minimum Password Length	Number of Character Types	Processing Against the Password Policy	New Password
  8 to 17 characters	4	The user password policy is met.	Admin@123Test@123
  18 characters	4	Add an at sign (@).	Admin@123@Test@123
  19 characters	4	Add two at signs (@).	Admin@123@@Test@123
  8 to 18 characters	5	Add a space.	Admin@123 Test@123
  19 characters	5	Add a space and an at sign (@).	Admin@123 @Test@123
  20 characters	5	Add a space and two at signs (@).	Admin@123 @@Test@123

• After the system domain name is changed, download the keytab file for the machine-machine user added by the system administrator before the domain name is changed.
• After the system domain name is changed, download and install the client again.
• After the system domain name is changed, if there is any running HetuEngine compute instance, restart the instance.

Prerequisites

• The system administrator has clarified service requirements and planned domain names for the systems.

  A domain name can contain only uppercase letters, numbers, periods (.), and underscores (_), and must start with a letter or number, for example, DOMAINA.HW and DOMAINB.HW.

• The running status of all components in the Manager clusters is Normal.
• The acl.compare.shortName parameter of the ZooKeeper service of all clusters in Manager is set to default value true. Otherwise, change the value to true and restart the ZooKeeper service.

Procedure

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Domain and Mutual Trust.
   Figure 1 Domain and mutual trust
   

3. Modify required parameters.

   Table 2 Related parameters

   Parameter	Description
   Local Domain	Planned domain name of the system.
   Password Suffix	Part of the password set by the user after the password of the human-machine user is reset. This parameter is mandatory. The default value is Admin@123. NOTE: This parameter takes effect only after Local Domain is modified. The following conditions must be met: The password ranges from 8 to 16 characters. The password must contain at least three types of the following: uppercase letters, lowercase letters, numbers, and special characters (`~!@#$%^&*()-_=+|[{}];:',<.>/? and spaces).

4. Determine whether to set up mutual trust between managers across cluster.
   • If you need to do so, perform operations by referring to Configuring Cross-Manager Mutual Trust Between Clusters and skip subsequent steps in this section.
   • If you do not need such configuration, go to 5.

5. Click OK. Proceed with the subsequent steps only after the modification is complete.
6. Log in to the active management node as user omm.
7. Run the following command to update the domain configuration:

   sh ${BIGDATA_HOME}/om-server/om/sbin/restart-RealmConfig.sh

   The command is executed successfully if the following information is displayed:

   Modify realm successfully. Use the new password to log in to FusionInsight again.  

   

   After the restart, some hosts and services cannot be accessed and an alarm is generated. This problem can be automatically resolved in about 1 minute after restart-RealmConfig.sh is run.

8. Log in to FusionInsight Manager using the new password of user admin (for example, Admin@123Admin@123). On the dashboard, click or More and select Restart.

   In the displayed dialog box, enter the password of the current login user and click OK.

   In the displayed dialog box, click OK. Wait for a while until a message indicating that the operation is successful is displayed. Click Finish.

9. Log out of FusionInsight Manager and then log in again. If the login is successful, the configuration is successful.
10. Log in to the active management node as user omm and run the following command to update the configurations of the job submission client:

    sh /opt/executor/bin/refresh-client-config.sh

11. If a HetuEngine compute instance is running, restart the compute instance.
    1. Log in to FusionInsight Manager as the user who is used to access the HetuEngine web UI.
    2. Choose Cluster > Services > HetuEngine to go to the HetuEngine service page.
    3. In the Basic Information area on the Dashboard page, click the link next to HSConsole WebUI. The HSConsole page is displayed.
    4. For a running compute instance, click Stop in the Operation column. After the compute instance is in the Stopped state, click Start to restart the compute instance.