How to “kdestroy” user's ticket in FreeIPA (LDAP 389 Directory Server)











up vote
0
down vote

favorite












We are trying out FreeIPA (LDAP 389 Directory Server) and integrated the same to our Ambari Hadoop cluster (HDP v3.0.1).



We are able to add users and provide them access to Hadoop with help of Kinit command.



However, when deleting the users in FreeIPA GUI, the principal gets deleted. The deleted user's principal will not be there in the "kadmin" prompt when I do listprincs.



But the user will still be having a valid ticket when he does "klist" and can access Hadoop even though the principal is removed. We cannot do "kdestory" manually. Typically, when users are removed in FreeIPA, the same users should not be able to access Hadoop as well.



Can't FreeIPA handle kdestroy?



Please provide your suggestions.



Thanks,



Shesh










share|improve this question


























    up vote
    0
    down vote

    favorite












    We are trying out FreeIPA (LDAP 389 Directory Server) and integrated the same to our Ambari Hadoop cluster (HDP v3.0.1).



    We are able to add users and provide them access to Hadoop with help of Kinit command.



    However, when deleting the users in FreeIPA GUI, the principal gets deleted. The deleted user's principal will not be there in the "kadmin" prompt when I do listprincs.



    But the user will still be having a valid ticket when he does "klist" and can access Hadoop even though the principal is removed. We cannot do "kdestory" manually. Typically, when users are removed in FreeIPA, the same users should not be able to access Hadoop as well.



    Can't FreeIPA handle kdestroy?



    Please provide your suggestions.



    Thanks,



    Shesh










    share|improve this question
























      up vote
      0
      down vote

      favorite









      up vote
      0
      down vote

      favorite











      We are trying out FreeIPA (LDAP 389 Directory Server) and integrated the same to our Ambari Hadoop cluster (HDP v3.0.1).



      We are able to add users and provide them access to Hadoop with help of Kinit command.



      However, when deleting the users in FreeIPA GUI, the principal gets deleted. The deleted user's principal will not be there in the "kadmin" prompt when I do listprincs.



      But the user will still be having a valid ticket when he does "klist" and can access Hadoop even though the principal is removed. We cannot do "kdestory" manually. Typically, when users are removed in FreeIPA, the same users should not be able to access Hadoop as well.



      Can't FreeIPA handle kdestroy?



      Please provide your suggestions.



      Thanks,



      Shesh










      share|improve this question













      We are trying out FreeIPA (LDAP 389 Directory Server) and integrated the same to our Ambari Hadoop cluster (HDP v3.0.1).



      We are able to add users and provide them access to Hadoop with help of Kinit command.



      However, when deleting the users in FreeIPA GUI, the principal gets deleted. The deleted user's principal will not be there in the "kadmin" prompt when I do listprincs.



      But the user will still be having a valid ticket when he does "klist" and can access Hadoop even though the principal is removed. We cannot do "kdestory" manually. Typically, when users are removed in FreeIPA, the same users should not be able to access Hadoop as well.



      Can't FreeIPA handle kdestroy?



      Please provide your suggestions.



      Thanks,



      Shesh







      user-management ldap hadoop kerberos cloudera-manager






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 18 at 13:42









      Shesh Kumar Bhombore

      92




      92



























          active

          oldest

          votes











          Your Answer








          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "89"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














           

          draft saved


          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1093958%2fhow-to-kdestroy-users-ticket-in-freeipa-ldap-389-directory-server%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown






























          active

          oldest

          votes













          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes
















           

          draft saved


          draft discarded



















































           


          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1093958%2fhow-to-kdestroy-users-ticket-in-freeipa-ldap-389-directory-server%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Ellipse (mathématiques)

          Quarter-circle Tiles

          Mont Emei