Changing the System Domain Name of an MRS Cluster

Scenarios

The secure usage scope of users in each system is called a domain. Each system must have a unique domain name. The domain name of FusionInsight Manager is generated during installation. The system administrator can change the domain name on FusionInsight Manager.

Changing the system domain name is a high-risk operation. Before performing operations in this section, ensure that the OMS data has been backed up by referring to Backing Up Manager Data (MRS 3.x and Later Versions).

Notes and Constraints

This section applies only to MRS 3.1.0 or later.

Impact on the System

During the configuration process, all clusters must be restarted and will be unavailable while the restart is in progress.
After the domain name is changed, the passwords of the Kerberos administrator and OMS Kerberos administrator will be initialized. You need to use the default passwords and then change the passwords. If a component user whose password is generated randomly by the system is used for identity authentication, see Downloading MRS Cluster User Credentials to download the keytab file again.
After the domain name is changed, passwords of the admin user, component user, and human-machine user added by the system administrator before the domain name change will be reset to the same one. Change these passwords. The reset password consists of two parts: a system-generated part and a user-defined part. The system-generated part is Admin@123, which is the default password. For details about the user-defined part, see description of Password Suffix in Table 2. For example, if the system generates Admin@123 and the user sets Test#$%@123, the new password after reset is Admin@123Test#$%@123.
The new password must meet the password policies. To obtain the new human-machine user password, log in to the active OMS as user omm and run the following script:
sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Password suffix user_name
- Password suffix is a parameter set by the user. If it is not specified, the default value Admin@123 is used.
- user_name is optional. The default value is admin.
- Commands carrying authentication passwords pose security risks. Disable historical command recording before running such commands to prevent information leakage.
Example:

sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Test#$%@123
```
To get the reset password after changing cluster domain name.
  pwd_min_len      : 8
  pwd_char_types   : 4
The password reset after changing cluster domain name is: "Admin@123Test#$%@123"
```
In this example, pwd_min_len and pwd_char_types indicate the minimum password length and number of password character types respectively defined in the password policies. Admin@123Test#$%@123 indicates the human-machine user password after the system domain name is changed.

After the system domain name is changed, the reset password consists of two parts: a system-generated part and a user-defined part. The new password must meet the password policies. If the password is not long enough, one or multiple at signs (@) are added between Admin@123 and the user-defined part. If there are five character types, a space is added after Admin@123.

When the user-defined part is Test@123 and the default user password policy is used, the new password is Admin@123Test@123. The password contains 17 characters of four types. To meet the current password policy, the new password is processed according to Table 1.

**Table 1** Password processing
Minimum Password Length	Number of Character Types	Processing Against the Password Policy	New Password
8 to 17 characters	4	The user password policy is met.	Admin@123Test@123
18 characters	4	Add an at sign (@).	Admin@123@Test@123
19 characters	4	Add two at signs (@).	Admin@123@@Test@123
8 to 18 characters	5	Add a space.	Admin@123 Test@123
19 characters	5	Add a space and an at sign (@).	Admin@123 @Test@123
20 characters	5	Add a space and two at signs (@).	Admin@123 @@Test@123

After the system domain name is changed, download the keytab file for the machine-machine user added by the system administrator before the domain name is changed.
After the system domain name is changed, download and install the client again.
After the system domain name is changed, if there is any running HetuServer compute instance, restart the instance.

Prerequisites

The system administrator has clarified service requirements and planned domain names for the systems.
A domain name can contain only uppercase letters, numbers, periods (.), and underscores (_), and must start with a letter or number, for example, DOMAINA.HW and DOMAINB.HW.
The running status of all components in the Manager clusters is Normal.
The acl.compare.shortName parameter of the ZooKeeper service of all clusters in Manager is set to default value true. Otherwise, change the value to true and restart the ZooKeeper service.

Changing the System Domain Name

Log in to FusionInsight Manager of the MRS cluster.

For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.
Choose System > Permission > Domain and Mutual Trust.

Figure 1 Domain and mutual trust

Modify required parameters.

**Table 2** Related parameters
Parameter	Example Value	Description
Local Domain	MRSTEST.COM	Planned domain name of the system.
Password Suffix	Admin@123-	Part of the password set by the user after the password of the human-machine user is reset. This parameter is mandatory. The default value is Admin@123. This parameter takes effect only after Local Domain is modified. The following requirements must be met: The password contains 8 to 16 characters. The password contains at least three types of the following: uppercase letters, lowercase letters, numbers, and the following special characters: `~!@#$%^&*()-_=+\|[{}];:',<.>/? and space.

Determine whether to set up mutual trust between managers across cluster.
- If yes, perform operations by referring to Configuring Mutual Trust Between MRS Clusters and skip subsequent steps in this section.
- If no, go to Step 5.
Click OK. Proceed with the subsequent steps only after the modification is complete.
Log in to the active management node as user omm.
Run the following command to update the domain configuration:

sh ${BIGDATA_HOME}/om-server/om/sbin/restart-RealmConfig.sh

The command is executed successfully if the following information is displayed:
```
Modify realm successfully. Use the new password to log in to FusionInsight again.  
```
After the restart, some hosts and services may be inaccessible and an alarm is generated. This issue can be automatically resolved in about 1 minute after restart-RealmConfig.sh is executed.

Log in to FusionInsight Manager using the new password of user admin (for example, Admin@123Admin@123). On the dashboard page, click or More and select Restart.

In the displayed dialog box, enter the password of the current login user and click OK.

In the displayed dialog box, click OK. Wait for a while until a message indicating that the operation is successful is displayed. Click Finish.
Log out of FusionInsight Manager and then log in again. If the login is successful, the configuration is successful.
Log in to the active management node as user omm and run the following command to update the configurations of the job submission client:

sh /opt/executor/bin/refresh-client-config.sh
If a HetuServer compute instance is running, restart the instance.
1. Log in to FusionInsight Manager as the user who is used to access the HetuServer web UI.
2. Choose Cluster > Services > HetuServer to access the HetuServer service page.
3. In the Basic Information area on the Dashboard page, click the link next to HSConsole WebUI. The HSConsole page is displayed.
4. For a running compute instance, click Stop in the Operation column. After the compute instance is in the Stopped state, click Start to restart the compute instance.