Changing Manager System Domain Name

Scenario

The usage range of users in each FusionInsight Manager is called a domain. Each system must have a unique domain name. The domain name of the FusionInsight Manager is generated during installation. To change the domain name to a specific domain name, run the FusionInsight Manager command.

• Changing the system domain name is a high-risk operation. Before performing operations in this section, ensure that the OMS data has been backed up by referring to Backing Up OMS Data.

Impact on the System

• During the configuration, all of the clusters need to be restarted and are unavailable during restart.
• During the configuration, the domain names will be changed, and the passwords of Kerberos administrator and OMS Kerberos administrator will be initialized. You need to use the default passwords and change the password. If a component running user whose password is generated randomly by the system is used for identity authentication, see Exporting an Authentication Credential File to download the keytab file again.
• After the system domain name is changed, passwords of the admin user, component running user, and the Human-machine user added by the system administrator before the domain name is changed will be reset to the same. Change the passwords. The reset password consists of two parts: one part is generated by the system and the other is set by the user. The system generating part is Admin@123, which is the default password. For details about the user-defined part, see descriptions of Password Suffix in Table 2. For example, if the system generates Admin@123 and the user sets Test#$%@123, the final initial password is Admin@123Test#$%@123.
• The new password must meet the password policies. To obtain the new Human-machine user password, log in to the active OMS as user omm and run the following script:

  sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh passwd_suffix user_name

  • passwd_suffix indicates the user setting part (Admin@123 by default).
  • user_name is optional (admin by default).

  Example:

  sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Test#$%@123

  To get the reset password after changing cluster domain name.
    pwd_min_len      : 8
    pwd_char_types   : 4
  The password reset after changing cluster domain name is: "Admin@123Test#$%@123"

  In this example, pwd_min_len and pwd_char_types indicate the minimum password length and number of password character types respectively defined in the password policies. Admin@123Test#$%@123 indicates the Human-Machine user password after the system domain name is changed.

• The reset password after the inter-system domain name is changed consists of two parts: one part is generated by the system and the other is set by the user. The reset password must meet the password policy. In case of insufficient length, add one or multiple at-signs (@) between Admin@123 and user setting part. If there are five character types, add a space on the right of Admin@123.
  When the user setting part is Test@123 and default user password policy is used, the new password is Admin@123Test@123. The password contains 17 characters of four types. If the current password policy must be met, process the password according to Table 1.

  Table 1 Password processing

  Minimum Password Length	Number of Character Types	Password Policy Satisfaction	New Password
  8 to 17 characters	4	Password policies are met.	Admin@123Test@123
  18 characters	4	Add an at sign (@).	Admin@123@Test@123
  19 characters	4	Add two at signs (@).	Admin@123@@Test@123
  8 to 18 characters	5	Add a space.	Admin@123 Test@123
  19 characters	5	Add a space and an at sign (@).	Admin@123 @Test@123
  20 characters	5	Add a space and two at signs (@).	Admin@123 @@Test@123

• After the system domain name is changed, download the keytab file for the Machine-Machine user added by the system administrator before the domain name is changed.
• After the system domain name is changed, download and install the client again.

Prerequisites

• The system administrator has specified service requirements and planned domain names for the systems.

  A domain name can contain only uppercase letters, digits, dots (.), and underscores (_), and must start with a letter or a digit.

• Running Status of all services in the Manager clusters is Normal.
• The acl.compare.shortName parameter of the ZooKeeper service of all clusters in the Manager must be set to the default value true. Otherwise, change the value to true and restart the ZooKeeper service.

Procedure

1. Log in to FusionInsight Manager of a cluster.
2. Choose System > Permission > Domain and Mutual Trust.
3. Change parameters.

   Table 2 Related Parameters

   Parameter	Description
   Local Domain	Set the value to the domain name of the system.
   Password Suffix	The user sets part of the Human-Machine user after password reset. The default value is Admin@123. NOTE: This parameter is only changed Local Domain parameters to take effect. The following conditions must be met: The password ranges from 8 to 16 characters. The password must contain at least three types of the following: uppercase letters, lowercase letters, numbers, and the following special characters: `~!@#$%^&*()-_=+|[{}];:',<.>/? and space.

4. Click OK. After the modification is complete, proceed with the subsequent steps. Do not perform the subsequent steps in advance.
5. Log in to the active management node as user omm.
6. Run the following command to restart the domain update configuration:

   sh ${BIGDATA_HOME}/om-server/om/sbin/restart-RealmConfig.sh

   The command is run successfully if the following information is displayed:

   Modify realm successfully. Use the new password to log into FusionInsight again.  

   

   After restart, some hosts and services cannot be accessed and an alarm is generated. This problem can be automatically resolved in about 1 minute after restart-RealmConfig.sh is run.

7. Log in to the FusionInsight Manager as the reset user admin and password (for example, Admin@123Admin@123). On the FusionInsight Manager home page, click next to the name of the cluster to be operated and select Restart.

   In the displayed confirmation dialog box, click OK.

   In the displayed dialog box, click OK. Wait for a while until a message indicating that the operation is successful is displayed. Click Finish.

8. Log out from FusionInsight Manager and then log in to it again. If the login is successful, the configuration is successful.
9. Log in to the active management node as user omm and run the following command to update the job submission client configuration:

   sh /opt/executor/bin/refresh-client-config.sh