High Performance Computing Group

Then open windows cmd, run below command to generate keytab file:

setspn -A lsf/$cluster-name lsfsrv
ktpass -princ lsf/$cluster-name@FREE.ZONE -mapuser lsfsrv -pass $pass -out lsfsrv.keytab -ptype KRB5_NT_PRINCIPAL

Note:

• "lsfsrv" is an example, you can change this username with your rule.
• Use the real LSF cluster name to replace the $cluster-name in command.
• Use the real password of user "lsfsrv" to replace the $pass in command.

setspn -A lsf/$host-name lsfhost
ktpass -princ lsf/$host-name@FREE.ZONE -mapuser lsfhost -pass $pass -out lsfhost.keytab -ptype KRB5_NT_PRINCIPAL

Note:

• "lsfhost" is an example, you can change the username with your rule.
• Use the LSF host name to replace the $host-name in command. The value should be the execute output of "hostname -f" command in LSF host.
• Use the real password of user "lsfhost" to replace the $pass in command.

5) Add principal for LSF add-on

As like above step, add user "AC_root", "lsfgui" and run below command to add principal for LSF add-on product

setspn -A AC_root
ktpass -princ AC_root -pass $pass -out ac_root.keyta -ptype  KRB5_NT_PRINCIPAL

Note:

• "AC_root" is a fixed username, please do not change it.
• Use the real password of user "AC_root" to replace the $pass in command

setspn -A HTTP/$host-name lsfgui
ktpass -princ HTTP/$host-name@FREE.ZONE -mapuser lsfgui -pass $pass -out lsfgui.keytab -ptype KRB5_NT_PRINCIPAL

Note:

• "lsfgui" is an example, you can change the username with your rule.
• Use the LSF add-on host name to replace the $host-name in command. The value should be the execute output of "hostname -f" command in LSF add-on host, the LSF add-on host also should be a host in LSF cluster.
• Use the real password of user "lsfgui" to replace the $pass in command.

2. Configure Kerberos on LSF and add-on host
1) Run command "nmtui" to edit the Linux network setting of LSF and add-on host, use the IP of Windows Active Directory domain controller as the DNS server address, set Active Directory domain name as search domain.
2) Edit /etc/hosts, configure the mapping of hostname and IP

# The host address of Windows Active Directory domain controller host
9.110.251.125  vmwin12  vmwin12.free.zone
# The host address of LSF or add-on host
9.110.251.30  vmrhel7x  vmrhel7x.free.zone

3) Run command "yum install krb5-libs krb5-workstation krb5-devel" to install Kerberos

4) Copy all the generated keytab files from Active Directory domain controller host, run below command to merge the keytab files and generate krb5.keytab

ktutil
rkt lsfsrv.keytab
rkt lsfhost.keytab
rkt lsfgui.keytab
rkt ac_root.keytab
wkt krb5.keytab
exit

5) Copy generated krb5.keytab to /etc and configure /etc/krb5.conf as below:

For example:

• The domain name is: "free.zone"
• The Active Directory domain controller hostname is: "vmwin12.free.zone"

includedir /etc/krb5.conf.d/
[logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
[libdefaults]
  default_realm = FREE.ZONE
  default_keytab_name = FILE:/etc/krb5.keytab
  default_ccache_name = FILE:/tmp/krb5cc_%{uid}
  default_tkt_enctypes = rc4-hmac
  default_tgs_enctypes = rc4-hmac
  forwardable = true
  renewable = true
  noaddresses = true
  clockskew = 300
  udp_preference_limit = 1
[realms]
  FREE.ZONE = {
kdc = vmwin12.free.zone
admin_server = vmwin12.free.zone
  }
[domain_realm]
  .free.zone = FREE.ZONE
free.zone = FREE.ZONE

6) Reboot the host to make the configuration effective
7) Run "klist -k -t /etc/krb5.keytab" command to verify Kerberos keytab file
8) Install LSF and configure Kerberos parameter

• Edit $LSF_ENVDIR/lsf.conf, add below parameter

LSF_ADDON_HOSTS="vmrhel7x" #vmrhel7x is the host that install LSF add-on, use the real hostname to replace it
LSB_KRB_LIB_PATH="/usr/lib64/"

• Backup file "eauth" under $LSF_SERVERDIR and rename "eauth.krb5" in same directory to "eauth" to overwrite the old one

9) Install AC and configure Kerberos parameter

• Edit $GUI_CONFDIR/pmc.conf, add below parameter

ENABLE_KERBEROS=true
KrbServicePrincipal="HTTP/vmrhel7x@FREE.ZONE" #vmrhel7x is the host that install LSF add-on, use the real hostname to replace it
KrbKeyTabLocation="/etc/krb5.keytab"

• Backup file $PMC_TOP/gui/3.0/wlp/usr/servers/platform/apps/ platform.war/ WEB-INF/classes/pring-security.xml and rename spring-security.xml.krb in same directory to spring-security.xml to overwrite the old one
• Set environment variable: LSF_ADDON_SERVICENAME="AC_root"

3. Configure Windows client host
3.1 Add client into Active Directory and as a client
1) Reset SID, modify the DNS address, point to domain controller machine IP