Merge pull request #229550 from sreekzz/patch-150

Updated  How do I create a keytab for an HDInsight ESP cluster

Author: v-dirichards

articles/hdinsight/hdinsight-faq.yml

@@ -8,7 +8,7 @@ metadata:
   ms.service: hdinsight
   ms.custom: hdinsightactive,seoapr2020
   ms.topic: faq
-  ms.date: 07/19/2022
+  ms.date: 02/06/2023
 title: "Azure HDInsight: Frequently asked questions"
 summary: |
     This article provides answers to some of the most common questions about how to run [Azure HDInsight](https://azure.microsoft.com/services/hdinsight/).
@@ -180,13 +180,40 @@ sections:
           Create a Kerberos keytab for your domain username. You can later use this keytab to authenticate to remote domain-joined clusters without entering a password. The domain name is uppercase:
           
           ```shell
+
           ktutil
-          ktutil: addent -password -p <username>@<DOMAIN.COM> -k 1 -e RC4-HMAC
+          ktutil: addent -password -p <username>@<DOMAIN.COM> -k 1 -e aes256-cts-hmac-sha1-96
           Password for <username>@<DOMAIN.COM>: <password>
           ktutil: wkt <username>.keytab
           ktutil: q
           ```
           
+      - question: |
+          When is salting required for AES256 encryption when creating the keytab?
+        answer: |
+          If your TenantName & DomainName are different (example TenantName – [email protected] & DomainName – [email protected]), you need to add a SALT value using the -s option. 
+          
+      - question: |
+          How do I determine the proper SALT value?
+        answer: |
+          1. Use an interactive Kerberos login to determine the proper salt value for the keytab. Interactive Kerberos login will use the highest encryption by default. Tracing should be enabled to observe the salt. Below is a sample Kerberos login:
+          
+          ```shell
+          
+          $ KRB5_TRAACE=/dev/stdout kinit <username> -V
+          ```
+          2. Look through the output for the salt "......." line.
+          3. Use this salt value when creating the keytab.
+          
+          ```shell
+
+          ktutil
+          ktutil: addent -password -p <username>@<DOMAIN.COM> -k 1 -e aes256-cts-hmac-sha1-96 -s <SALTvalue>
+          Password for <username>@<DOMAIN.COM>: <password>
+          ktutil: wkt <username>.keytab
+          ktutil: q
+          ```
+ 
       - question: |
           Can I use an existing Azure Active Directory tenant to create an HDInsight cluster that has the ESP?
         answer: |
@@ -195,7 +222,7 @@ sections:
           To join VMs to a domain, you must have a domain controller. Azure AD DS is the managed domain controller, and is considered an extension of Azure Active Directory. Azure AD DS provides all the Kerberos requirements to build a secure Hadoop cluster in a managed way. HDInsight as a managed service integrates with Azure AD DS to provide security.
           
       - question: |
-          Can I use a self-signed certificate in an AAD-DS secure LDAP setup and provision an ESP cluster?
+          Can I use a self-signed certificate in an Azure AD-DS secure LDAP setup and provision an ESP cluster?
         answer: |
           Using a certificate issued by a certificate authority is recommended. But using a self-signed certificate is also supported on ESP. For more information, see:
           
@@ -204,7 +231,7 @@ sections:
           - [Tutorial: Configure secure LDAP for an Azure Active Directory Domain Services managed domain](../active-directory-domain-services/tutorial-configure-ldaps.md)
       
       - question: |
-          Can I install Data Analytics Studio (DAS) an an ESP cluster?
+          Can I install Data Analytics Studio (DAS) as an ESP cluster?
         answer: |
             No, DAS is not supported on ESP clusters.
       
@@ -239,7 +266,7 @@ sections:
           LLAP is enabled for security reasons (Apache Ranger), not performance. Use larger node VMs to accommodate for the resource usage of LLAP (for example, minimum D13V2). 
 
       - question: |
-          How can I add additional AAD groups after creating an ESP cluster?
+          How can I add additional Azure AD groups after creating an ESP cluster?
         answer: |
           There are two ways to achieve this goal:
           1- You can recreate the cluster and add the additional group at the time of cluster creation. If you're using scoped synchronization in AAD-DS, make sure group B is included in the scoped synchronization.
@@ -333,7 +360,7 @@ sections:
       - question: |
           How do I retrieve the configuration details from HDI cluster by using an Azure Active Directory user?
         answer: |
-          To negotiate proper authentication tokens with your AAD user, go through the gateway by using the following format:
+          To negotiate proper authentication tokens with your Azure AD user, go through the gateway by using the following format:
           
           * https://`<cluster dnsname>`.azurehdinsight.net/api/v1/clusters/testclusterdem/stack_versions/1/repository_versions/1