:original_name: admin_guide_000176.html

.. _admin_guide_000176:

Changing Manager's Domain Name
==============================

Scenario
--------

The secure usage scope of users in each system is called a domain. Each system must have a unique domain name. The domain name of FusionInsight Manager is generated during installation. The system administrator can change the domain name on FusionInsight Manager.

.. important::

   -  Changing the system domain name is a high-risk operation. Before performing operations in this section, ensure that the OMS data has been backed up by referring to :ref:`Backing Up Manager Data <admin_guide_000202>`.

Impact on the System
--------------------

-  During the configuration, all of the clusters need to be restarted and are unavailable during restart.

-  After the domain name is changed, the passwords of the Kerberos administrator and OMS Kerberos administrator will be initialized. You need to use the default passwords and then change the passwords. If a component user whose password is generated randomly by the system is used for identity authentication, see :ref:`Exporting an Authentication Credential File <admin_guide_000145>` to download the keytab file again.

-  After the domain name is changed, passwords of the **admin** user, component user, and human-machine user added by the system administrator before the domain name change will be reset to the same one. Change these passwords. The reset password consists of two parts: one part is generated by the system and the other is set by the user. The system generating part is **Admin@123**, which is the default password. For details about the user-defined part, see descriptions of **Password Suffix** in :ref:`Table 2 <admin_guide_000176__en-us_topic_0046737082_table66281275>`. For example, if the system generates **Admin@123** and the user sets **Test#$%@123**, the new password after reset is **Admin@123Test#$%@123**.

-  The new password must meet the password policies. To obtain the new human-machine user password, log in to the active OMS as user **omm** and run the following script:

   **sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh** *Password suffix* *user_name*

   -  *Password suffix* is a parameter set by the user. If it is not specified, the default value **Admin@123** is used.
   -  *user_name* is optional. The default value is **admin**.

   Example:

   **sh ${BIGDATA_HOME}/om-server/om/sbin/get_reset_pwd.sh Test#$%@123**

   .. code-block::

      To get the reset password after changing cluster domain name.
        pwd_min_len      : 8
        pwd_char_types   : 4
      The password reset after changing cluster domain name is: "Admin@123Test#$%@123"

   In this example, **pwd_min_len** and **pwd_char_types** indicate the minimum password length and number of password character types respectively defined in the password policies. **Admin@123Test#$%@123** indicates the human-machine user password after the system domain name is changed.

-  After the system domain name is changed, the reset password consists of two parts: one part is generated by the system and the other is set by the user. The reset password must meet the password policies. If the password is not long enough, one or multiple at signs (@) are added between **Admin@123** and the user-defined part. If there are five character types, a space is added after **Admin@123**.

   When the user-defined part is **Test@123** and the default user password policy is used, the new password is **Admin@123Test@123**. The password contains 17 characters of four types. To meet the current password policy, the new password is processed according to :ref:`Table 1 <admin_guide_000176__table172285275013>`.

   .. _admin_guide_000176__table172285275013:

   .. table:: **Table 1** Password processing

      +-------------------------+---------------------------+----------------------------------------+----------------------+
      | Minimum Password Length | Number of Character Types | Processing Against the Password Policy | New Password         |
      +=========================+===========================+========================================+======================+
      | 8 to 17 characters      | 4                         | The user password policy is met.       | Admin@123Test@123    |
      +-------------------------+---------------------------+----------------------------------------+----------------------+
      | 18 characters           | 4                         | Add an at sign (@).                    | Admin@123@Test@123   |
      +-------------------------+---------------------------+----------------------------------------+----------------------+
      | 19 characters           | 4                         | Add two at signs (@).                  | Admin@123@@Test@123  |
      +-------------------------+---------------------------+----------------------------------------+----------------------+
      | 8 to 18 characters      | 5                         | Add a space.                           | Admin@123 Test@123   |
      +-------------------------+---------------------------+----------------------------------------+----------------------+
      | 19 characters           | 5                         | Add a space and an at sign (@).        | Admin@123 @Test@123  |
      +-------------------------+---------------------------+----------------------------------------+----------------------+
      | 20 characters           | 5                         | Add a space and two at signs (@).      | Admin@123 @@Test@123 |
      +-------------------------+---------------------------+----------------------------------------+----------------------+

-  After the system domain name is changed, download the **keytab** file for the machine-machine user added by the system administrator before the domain name is changed.

-  After the system domain name is changed, download and install the client again.

Prerequisites
-------------

-  The system administrator has clarified service requirements and planned domain names for the systems.

   A domain name can contain only uppercase letters, numbers, periods (.), and underscores (_), and must start with a letter or number.

-  The running status of all components in the Manager clusters is **Normal**.

-  The **acl.compare.shortName** parameter of the ZooKeeper service of all clusters in Manager is set to default value **true**. Otherwise, change the value to **true** and restart the ZooKeeper service.

Procedure
---------

#. Log in to FusionInsight Manager.

#. Choose **System** > **Permission** > **Domain and Mutual Trust**.

#. Modify required parameters.

   .. _admin_guide_000176__en-us_topic_0046737082_table66281275:

   .. table:: **Table 2** Related parameters

      +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Parameter                         | Description                                                                                                                                                                                           |
      +===================================+=======================================================================================================================================================================================================+
      | Local Domain                      | Planned domain name of the system.                                                                                                                                                                    |
      +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Password Suffix                   | Part of the password set by the user after the password of the human-machine user is reset. This parameter is mandatory. The default value is **Admin@123**.                                          |
      |                                   |                                                                                                                                                                                                       |
      |                                   | .. note::                                                                                                                                                                                             |
      |                                   |                                                                                                                                                                                                       |
      |                                   |    This parameter takes effect only after **Local Domain** is modified. The following conditions must be met:                                                                                         |
      |                                   |                                                                                                                                                                                                       |
      |                                   |    -  The password ranges from 8 to 16 characters.                                                                                                                                                    |
      |                                   |    -  The password must contain at least three types of the following: uppercase letters, lowercase letters, numbers, and special characters (:literal:`\`~!@#$%^&*(`)-_=+|[{}];:',<.>/? and spaces). |
      +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

#. Click **OK**. Proceed with the subsequent steps only after the modification is complete.

#. Log in to the active management node as user **omm**.

#. Run the following command to update the domain configuration:

   **sh ${BIGDATA_HOME}/om-server/om/sbin/restart-RealmConfig.sh**

   The command is executed successfully if the following information is displayed:

   .. code-block::

      Modify realm successfully. Use the new password to log into FusionInsight again.

   .. note::

      After the restart, some hosts and services cannot be accessed and an alarm is generated. This problem can be automatically resolved in about 1 minute after **restart-RealmConfig.sh** is run.

7. Log in to FusionInsight Manager using the new password of user **admin** (for example, **Admin@123Admin@123**). On the dashboard, click |image1| next to the name of the target cluster and select **Restart**.

   In the displayed dialog box, enter the password of the current login user and click **OK**.

   In the displayed dialog box, click **OK**. Wait for a while until a message indicating that the operation is successful is displayed. Click **Finish**.

8. Log out of FusionInsight Manager and then log in again. If the login is successful, the configuration is successful.

9. Log in to the active management node as user **omm** and run the following command to update the configurations of the job submission client:

   **sh /opt/executor/bin/refresh-client-config.sh**

.. |image1| image:: /_static/images/en-us_image_0267694670.jpg
