Changing Manager's Domain Name

Scenario

The secure usage scope of users in each system is called a domain. Each system must have a unique domain name. The domain name of FusionInsight Manager is generated during installation. The system administrator can change the domain name on FusionInsight Manager.

• Changing the system domain name is a high-risk operation. Before performing operations in this section, ensure that the OMS data has been backed up by referring to Backing Up Manager Data.

Impact on the System

• During the configuration, all of the clusters need to be restarted and are unavailable during restart.
• After the domain name is changed, the passwords of the Kerberos administrator and OMS Kerberos administrator will be initialized. You need to use the default passwords and then change the passwords. If a component user whose password is generated randomly by the system is used for identity authentication, see Exporting an Authentication Credential File to download the keytab file again.
• After the domain name is changed, passwords of the admin user, component user, and human-machine user added by the system administrator before the domain name change will be reset to the same one. Change these passwords. The reset password consists of two parts: one part is generated by the system and the other is set by the user. The system generating part is Admin@123, which is the default password. For details about the user-defined part, see descriptions of Password Suffix in Table 2. For example, if the system generates Admin@123 and the user sets Test#$%@123, the new password after reset is Admin@123Test#$%@123.
• The new password must meet the password policies. To obtain the new human-machine user password, log in to the active OMS as user omm and run the following script:

  sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Password suffix user_name

  • Password suffix is a parameter set by the user. If it is not specified, the default value Admin@123 is used.
  • user_name is optional. The default value is admin.

  Example:

  sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Test#$%@123

  To get the reset password after changing cluster domain name.
    pwd_min_len      : 8
    pwd_char_types   : 4
  The password reset after changing cluster domain name is: "Admin@123Test#$%@123"

  In this example, pwd_min_len and pwd_char_types indicate the minimum password length and number of password character types respectively defined in the password policies. Admin@123Test#$%@123 indicates the human-machine user password after the system domain name is changed. Commands carrying authentication passwords pose security risks. Disable historical command recording before running such commands to prevent information leakage.

• After the system domain name is changed, the reset password consists of two parts: one part is generated by the system and the other is set by the user. The reset password must meet the password policies. If the password is not long enough, one or multiple at signs (@) are added between Admin@123 and the user-defined part. If there are five character types, a space is added after Admin@123.
  When the user-defined part is Test@123 and the default user password policy is used, the new password is Admin@123Test@123. The password contains 17 characters of four types. To meet the current password policy, the new password is processed according to Table 1.

  Table 1 Password processing

  Minimum Password Length	Number of Character Types	Processing Against the Password Policy	New Password
  8 to 17 characters	4	The user password policy is met.	Admin@123Test@123
  18 characters	4	Add an at sign (@).	Admin@123@Test@123
  19 characters	4	Add two at signs (@).	Admin@123@@Test@123
  8 to 18 characters	5	Add a space.	Admin@123 Test@123
  19 characters	5	Add a space and an at sign (@).	Admin@123 @Test@123
  20 characters	5	Add a space and two at signs (@).	Admin@123 @@Test@123

• After the system domain name is changed, download the keytab file for the machine-machine user added by the system administrator before the domain name is changed.
• After the system domain name is changed, download and install the client again.

Prerequisites

• The system administrator has clarified service requirements and planned domain names for the systems.

  A domain name can contain only uppercase letters, numbers, periods (.), and underscores (_), and must start with a letter or number.

• The running status of all components in the Manager clusters is Normal.
• The acl.compare.shortName parameter of the ZooKeeper service of all clusters in Manager is set to default value true. Otherwise, change the value to true and restart the ZooKeeper service.

Procedure

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Domain and Mutual Trust.
3. Modify required parameters.

   Table 2 Related parameters

   Parameter	Description
   Local Domain	Planned domain name of the system.
   Password Suffix	Part of the password set by the user after the password of the human-machine user is reset. This parameter is mandatory. The default value is Admin@123. NOTE: This parameter takes effect only after Local Domain is modified. The following conditions must be met: The password ranges from 8 to 16 characters. The password must contain at least three types of the following: uppercase letters, lowercase letters, numbers, and special characters (`~!@#$%^&*()-_=+|[{}];:',<.>/? and spaces).

4. Click OK. Proceed with the subsequent steps only after the modification is complete.
5. Log in to the active management node as user omm.
6. Run the following command to update the domain configuration:

   sh ${BIGDATA_HOME}/om-server/om/sbin/restart-RealmConfig.sh

   The command is successfully executed if the following information is displayed:

   Modify realm successfully. Use the new password to log into FusionInsight again.  

   

   After the restart, some hosts and services cannot be accessed and an alarm is generated. This problem can be automatically resolved in about 1 minute after restart-RealmConfig.sh is run.

7. Use the new admin username and password (for example, Admin@123Admin@123) to log in to FusionInsight Manager. In the upper right corner of Homepage, click More and select Restart to restart the cluster.

   In the displayed dialog box, enter the password of the current login user and click OK.

   In the displayed dialog box, click OK. Wait for a while until a message indicating that the operation is successful is displayed. Click Finish.

8. Log out of FusionInsight Manager and then log in again. If the login is successful, the configuration is successful.
9. Log in to the active management node as user omm and run the following command to update the configurations of the job submission client:

   sh /opt/executor/bin/refresh-client-config.sh