diff --git a/gpdb-doc/dita/admin_guide/ddl/ddl-partition.xml b/gpdb-doc/dita/admin_guide/ddl/ddl-partition.xml index 831cf77bbb76c330ce1adf7c6ac956fc87a4d95b..c5f52bbb3ad59e3f15d1f469238f9a28e97ff550 100644 --- a/gpdb-doc/dita/admin_guide/ddl/ddl-partition.xml +++ b/gpdb-doc/dita/admin_guide/ddl/ddl-partition.xml @@ -5,9 +5,9 @@

Table partitioning enables supporting very large tables, such as fact tables, by logically dividing them into smaller, more manageable pieces. Partitioned tables can improve query - performance by allowing the Greenplum Database query optimizer to scan only the - data needed to satisfy a given query instead of scanning all the contents of a large table. -

-

You run the ktpass utility an AD Domain Administrator. The utility +

You run the ktpass utility as an AD Domain Administrator. The utility expects a user account to have a Service Principal Name (SPN) defined as an AD user attribute, however, it does not appear to be required. You can specify it as a parameter to ktpass and ignore the warning that it cannot be set.

-

The Java JRE ktab utiltiy does not require an AD Domain Administrator - does not require an SPN.

+

The Java JRE ktab utility does not require an AD Domain Administrator + and does not require an SPN.

When you enter the password to create the keytab file, the password is visible on screen.

This example runs the ktpass utility to create the ketyab @@ -203,8 +203,8 @@ gpload.py -f test.yaml (Kerberos error 193) krb5_cc_default() failed

To ensure that Kerberos can find the file set the environment variable - KRB5CCNAME and run kinit.

Kerberos cannot find - your cache file.set KRB5CCNAME=%USERPROFILE%\krb5cache + KRB5CCNAME and run + kinit.

set KRB5CCNAME=%USERPROFILE%\krb5cache kinit
  • This kinit message indicates that the kinit -k -t command could not find the @@ -224,11 +224,11 @@ kinit
    • client application to log into a Greenplum Database system. For example, a Windows user can use Active Directory credentials with PGadmin III to access a Greenplum Database system. Also, for Windows applications that use ODBC, the ODBC driver can use Active Directory - credentials to connect to a Greenplum Databases system.

    + credentials to connect to a Greenplum Database system.

    Greenplum Database clients that run on Windows, like gpload, connect - with Greenplum Database directly and do not use Active Directrory. For information about + with Greenplum Database directly and do not use Active Directory. For information about connecting Greenplum Database clients on Windows to a Greenplum Database system with - Kerberos authentication. See . + Kerberos authentication, see .

    This section contains the following information.

    Prerequisites -

    These are items are required enable AD single sign-on to a Greenplum Database system.

    +

    These items are required enable AD single sign-on to a Greenplum Database system.

      -
    • The Greenplum Database system must be configured to support for Kerberos - authentication. For information about configuring Greenplum Database with Kerberos - authentication, see .
      • +
    • The Greenplum Database system must be configured to support Kerberos authentication. + For information about configuring Greenplum Database with Kerberos authentication, see + .
    • You must know the fully-qualified domain name (FQDN) of the Greenplum Database master host. Also, the Greenplum Database master host name must have a domain portion. If the system does do not have a domain, you must configure the system to use a domain.

      This @@ -253,11 +253,11 @@ kinit

      • time source to be an AD Domain Controller, or configure the master host to use the same external time source as the AD Domain Controller.
    • To support single sign-on, you configure an AD user account as a Managed Service - Account in AD. These are requirements for Kerboros authentication.
        + Account in AD. These are requirements for Kerberos authentication.
        • You need to add the Service Principal Name (SPN) attribute to the user account information because the Kerberos utilities require the information during Kerberos authentication.
          • -
        • Also, as Greenplum database have unattended startups, you must also provide the +
        • Also, as Greenplum database has unattended startups, you must also provide the account login details in a Kerberos keytab file.
        Setting the SPN and creating the keytab requires AD administrative permissions. @@ -292,7 +292,7 @@ kinit setspn -A postgres/prod1.example.local svcPostgresProd1

        You can see the SPN if Advanced Features are set in the Active Directory Users and Computers view. Find servicePrincipalName in the Attribute Editor tab and - edit it if you need to make changes.

        + edit it if necessary.

        @@ -305,7 +305,8 @@ kinit controller supports with this ktpass command:

        ktpass /?

        As an AD Domain Administrator, you can run the ktpass command to create - a keytab file. This example command creates a svcPostgresProd1.keytab with this information: + a keytab file. This example command creates the file + svcPostgresProd1.keytab with this information: ServicePrincipalName (SPN): postgres/prod1.example.local@EXAMPLE.LOCAL AD user: svcPostgresProd1 @@ -327,7 +328,7 @@ kinit Password for svcPostgresprod1@EXAMPLE.LOCAL:your_password Done! Service key for svcPostgresprod1 is saved in svcPostgresProd1.keytabIf - you use AES256-CTS-HMAC-SHA1-96 encryption, requires download and install the Java + you use AES256-CTS-HMAC-SHA1-96 encryption, you must download and install the Java extension Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for JDK/JRE from Oracle.

    @@ -361,29 +362,29 @@ Service key for svcPostgresprod1 is saved in svcPostgresProd1.keytab     .example.local = EXAMPLE.LOCAL example.com = EXAMPLE.LOCAL

    Copy the Kerberos keytab file that contains the AD user information to the Greenplum - Database master directory. This example copies svcPostgresProd1.keytab - that was created in Active Directory - Setup.

    + Database master directory. This example copies the + svcPostgresProd1.keytab that was created in Active Directory Setup.

    mv svcPostgresProd1.keytab $MASTER_DATA_DIRECTORY chown gpadmin:gpadmin $MASTER_DATA_DIRECTORY/svcPostgresProd1.keytab chmod 600 $MASTER_DATA_DIRECTORY/svcPostgresProd1.keytab

    Add this line as the last line in the Greenplum Database pg_hba.conf file. This line configures Greenplum Database authentication to use Active Directory for - authentication for connection attempt that is not matched by a previous line attempts.

    + authentication for connection any attempt that is not matched by a previous line.

    host all all 0.0.0.0/0 gss include_realm=0

    Update the Greenplum Database postgresql.conf file with the location - details for the keytab file and the principal name to use. The fully qualified hostname + details for the keytab file and the principal name to use. The fully qualified host name and the default realm from /etc/krb5.conf forms the full service principal name.

    krb_server_keyfile = '/data/master/gpseg-1/svcPostgresProd1.keytab' krb_srvname = 'postgres' -

    Create a database role for the AD user. This example logs into default database and runs - the CREATE ROLE command. The user dev1 was the user +

    Create a database role for the AD user. This example logs into the default database and + runs the CREATE ROLE command. The user dev1 was the user specified when creating the keytab file in Active Directory Setup.

    psql create role dev1 with login superuser; -

    Restart the database to use the updated the authentication information:

    +

    Restart the database to use the updated authentication information:

    gpstop -a gpstart The Greenplum Database libraries might conflict with the Kerberos workstation @@ -409,7 +410,7 @@ psql -h prod1.example.local -U dev1

    -

    Also,when you reconnect to the database, pgAdmin III prompts for a password. When +

    Also, when you reconnect to the database, pgAdmin III prompts for a password. When prompted, leave the field blank and click OK.

    This example configures Aginity Workbench for Pivotal Greenplum. When using single sign-on, you enable Use Integrated Security.

    @@ -443,8 +444,8 @@ print(my_data) Administrator:

    kvno postgres/prod1.example.local@EXAMPLE.LOCAL