Modifying the OMS Service Configuration

Notes and Constraints

This section applies only to MRS 3.x or later.

Impact on the System

After the OMS service configuration parameters are modified, the corresponding OMS module needs to be restarted. In this case, FusionInsight Manager cannot be used. Perform this operation during off-peak hours and allocate a sufficient maintenance window.

Modifying the OMS Service Configuration

Modifying the okerberos configuration

okerberos is an OMS module that manages Kerberos authentication. It includes configuration parameters such as the KDC connection timeout, LDAP operation settings, and service ports.

1. Log in to FusionInsight Manager of the MRS cluster.

   For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.

2. Choose System > OMS.

3. Locate the row that contains okerberos and click Modify Configuration.

4. Modify the parameters according to Table 1.

   Table 1 okerberos parameters

   Parameter	Example Value	Description
   KDC Timeout (ms)	2500	Timeout duration for connecting to the Key Distribution Center (KDC), in milliseconds. The value must be an integer.
   Max Retries	3	Maximum number of retries for an application to connect to Kerberos, in seconds. The value must be an integer.
   LDAP Timeout (ms)	3000	Timeout duration for Kerberos to connect to LDAP, in milliseconds.
   LDAP Search Timeout (ms)	3000	Timeout duration for Kerberos to query user information in LDAP, in milliseconds.
   Kadmin Listening Port	21700	Port number of the Kadmin service.
   KDC Listening Port	21701	Port number of the kinit service.
   Kpasswd Listening Port	21702	Port number of the Kpasswd service.
   Reset LDAP Account Password	-	Machine-machine users (cn=krbadmin,ou=Users,dc=hadoop,dc=com and cn=krbkdc,ou=Users,dc=hadoop,dc=com) used by Kerberos to access LDAP. This is a high-risk operation. If this parameter is selected, the passwords will be replaced by random passwords. This option is available only in MRS 3.1.2 or later.

5. Click OK.

   In the displayed dialog box, enter the password of the current login user and click OK. In the displayed confirmation dialog box, click OK.

Modifying the oldap configuration

oldap is an OMS module that manages the Lightweight Directory Access Protocol (LDAP). It includes configuration parameters such as LDAP service ports, usernames, and passwords.

6. Locate the row that contains the oldap and click Modify Configuration.

7. Modify the parameters according to Table 2.

   Table 2 OLDAP parameters

   Parameter	Example Value	Description
   LDAP Listening Port	21750	Port number of the LDAP service.
   Reset LDAP Account Password	-	Machine-machine users (cn=root,dc=hadoop,dc=com and cn=pg_search_dn,ou=Users,dc=hadoop,dc=com) used by LDAP for data management, synchronization, and status check. This is a high-risk operation. If this parameter is selected, the passwords will be replaced by random passwords. This option is available only in MRS 3.1.2 or later.

8. Click OK.

   In the displayed dialog box, enter the password of the current login user and click OK. In the displayed confirmation dialog box, click OK.

9. If you reset the LDAP account password, restart the Agent Control Service (ACS).
   1. Log in to the active management node as user omm and run the following command to update the domain configuration:

      sh ${BIGDATA_HOME}/om-server/om/sbin/restart-RealmConfig.sh

      The command is successfully executed if the following information is displayed:

      Modify realm successfully. Use the new password to log into FusionInsight again.

   2. Run the following command to stop ACS:

      sh $CONTROLLER_HOME/sbin/acs_cmd.sh stop

   3. Run the following command to start ACS:

      sh $CONTROLLER_HOME/sbin/acs_cmd.sh start

Restarting the cluster

10. Log in to FusionInsight Manager of the MRS cluster.

    For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.

11. Restart the cluster. For details, see Restarting an MRS Cluster.

    Verifying the configuration changes

    • After the restart completes, log in to FusionInsight Manager and check whether you can access its pages.
    • Choose System > OMS and verify that the okerberos and oldap parameter values match the target values.
    • If you reset the LDAP account password, ensure that ACS starts properly and each service in the cluster functions normally.

FAQs

• What should I do if FusionInsight Manager is inaccessible after I modify OMS configurations?

  After modifying OMS configurations, restart the corresponding module. FusionInsight Manager is temporarily unavailable during the restart. This behavior is expected. Wait several minutes and try again. If access fails for a long time, log in to the active management node as user omm and check the OMS service status.

• What should I do if cluster services are abnormal after I reset the LDAP account password?

  Verify that ACS has restarted. Domain configuration updates take effect only after ACS restarts. If the service remains abnormal after ACS restarts, check the network connection and LDAP service status.

• Is there a required order for modifying okerberos and oldap parameters?

  The modifications of these two modules are independent, and there is no strict execution order required. However, if you must modify both modules at the same time, modify okerberos first and then oldap. After each modification, wait for the corresponding module to restart before proceeding to the next step.

Helpful Links

• For details about how to log in to MRS Manager, see Accessing MRS Manager.
• For details about how to log in to an MRS cluster node, see Logging In to an MRS Cluster Node.
• For details about how to restart a cluster, see Restarting an MRS Cluster.