The Unspecified Crime of the Failed Checksum

Luke Hebert

- One minute read - 210 words

If you are seeing the error “Failure unspecified at GSS-API level (Mechanism level Checksum failed),” the root cause is almost always one of the following six issues. Work through them in order and you will usually find the culprit fast.

  1. The password is wrong. A kinit command does not send the password to the KDC. It sends a hashed proof to demonstrate that the caller knows the password. If the password is wrong, the hash is wrong, and the KDC rejects the ticket with a checksum error.

  2. A keytab was present but did not work. The JVM fell back to attempting a user-level login, which then failed.

  3. The keytab is stale. It contains an older version of the credentials and cannot parse the information returned by the KDC because it lacks the current key material.

  4. Time skew. The clocks on the client, the service, and/or the KDC are out of sync beyond the acceptable tolerance.

  5. SPNEGO/REST hostname and DNS issues. Kerberos is strict about hostnames and DNS resolution, and a mismatch can trigger this error. See this Stack Overflow discussion for details on unwanted SPN canonicalization.

  6. SPNEGO/REST Java version differences. Java 8 handles SPNEGO differently from Java 6 and 7, which can cause problems. See HADOOP-11628 for a concrete example.