https://lukehebert.com/tag/kerberos/Recent content in Kerberos on Luke HebertHugoen-usWed, 14 May 2025 00:00:00 +0000https://lukehebert.com/post/basic-kerberos-test-class-in-java/Wed, 14 May 2025 00:00:00 +0000https://lukehebert.com/post/basic-kerberos-test-class-in-java/A minimal Java class and JAAS configuration for testing Kerberos authentication in isolation, useful when application-level debugging is too noisy to isolate the problem.https://lukehebert.com/post/kerberos-message-stream-modified-41/Fri, 18 Feb 2022 00:00:00 +0000https://lukehebert.com/post/kerberos-message-stream-modified-41/JDK 1.8.0u242 and later introduced Kerberos referral handling per RFC 6806, which can break Active Directory name canonicalization and produce a KRB_AP_ERR_MODIFIED error. This post walks through the two configuration fixes that resolve the issue.https://lukehebert.com/post/golden-ticket-attack/Mon, 15 Nov 2021 00:00:00 +0000https://lukehebert.com/post/golden-ticket-attack/A Golden Ticket attack lets an attacker forge Kerberos tickets and impersonate any user in an Active Directory domain. Learn how the attack works and the concrete steps you can take to defend against it.https://lukehebert.com/post/resetting-ad-krbtgt-password/Fri, 05 Nov 2021 00:00:00 +0000https://lukehebert.com/post/resetting-ad-krbtgt-password/A practical guide to resetting the krbtgt account password in Active Directory, including considerations for external trusts and the Microsoft-provided reset script.https://lukehebert.com/post/kerberos-issue-tracker/Fri, 24 Sep 2021 00:00:00 +0000https://lukehebert.com/post/kerberos-issue-tracker/A quick reference for the MIT Kerberos project issue tracker, where bugs, security advisories, and feature requests for the reference Kerberos implementation are tracked and resolved.https://lukehebert.com/post/kafka-dump/Wed, 25 Aug 2021 00:00:00 +0000https://lukehebert.com/post/kafka-dump/A practical walkthrough for dumping Kafka topic data, including a generic consumer approach and a full Atlas-specific workflow covering JAAS configuration, Kerberos authentication, and log extraction.https://lukehebert.com/post/dump-kafka-atlas-topic-to-review-messages/Fri, 20 Aug 2021 00:00:00 +0000https://lukehebert.com/post/dump-kafka-atlas-topic-to-review-messages/A quick walkthrough for dumping the ATLAS_HOOK Kafka topic to inspect Atlas hook messages locally, including Kerberos authentication setup and consumer lag checks.https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Wed, 10 Feb 2021 00:00:00 +0000https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Learn how to enable Kerberos trace logging in Cloudera Manager’s credential generation scripts to diagnose authentication failures quickly.https://lukehebert.com/post/spark-token-debug/Thu, 04 Feb 2021 00:00:00 +0000https://lukehebert.com/post/spark-token-debug/Enable verbose Kerberos and token logging on Spark driver and executor nodes to capture the diagnostic data you need when authentication is failing. Covers log4j configuration files and the exact spark-submit flags to wire them in.https://lukehebert.com/post/explain-kerberos-like-im-5/Thu, 10 Dec 2020 00:00:00 +0000https://lukehebert.com/post/explain-kerberos-like-im-5/A plain-English walkthrough of how Kerberos authentication works, using a simple analogy to make the ticket-granting process click. Perfect for anyone who has stared at a KDC diagram and felt lost.https://lukehebert.com/post/ldaps-and-unicodepwd/Tue, 01 Dec 2020 00:00:00 +0000https://lukehebert.com/post/ldaps-and-unicodepwd/LDAPS is a hard requirement when setting passwords via unicodePwd on Active Directory. Non-TLS connections are rejected by AD itself, and SASL is not a supported alternative.https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/Tue, 24 Nov 2020 00:00:00 +0000https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/A quick reference for the LDAP error codes returned during Active Directory bind operations, including what each code means and how to interpret the AcceptSecurityContext error message.https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/Tue, 03 Nov 2020 00:00:00 +0000https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/A troubleshooting guide for the Kerberos error ‘Cannot find key of the appropriate type to decrypt AP REP,’ covering encryption type mismatches between keytabs and Active Directory, plus practical steps to align AES and RC4 settings.https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/Thu, 07 Sep 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/A quick reference for Kerberos enctype numbers and what they map to, so you can stop guessing which cipher a ticket is actually using.https://lukehebert.com/post/hdfs-proxy-users/Wed, 06 Sep 2017 00:00:00 +0000https://lukehebert.com/post/hdfs-proxy-users/HDFS proxy users let you configure impersonation so specific users can submit jobs or access HDFS on behalf of others. This guide covers the core-site.xml properties, host and group restrictions, and Kerberos considerations for secure clusters.https://lukehebert.com/post/ptr-records/Tue, 05 Sep 2017 00:00:00 +0000https://lukehebert.com/post/ptr-records/A valid PTR record must resolve to a name that resolves back to the original address. Multiple PTR records for a single address break name resolution and can cause Kerberos ticket verification to fail.https://lukehebert.com/post/failure-unspecified-at-gss-api-level-mechanism-level-checksum-failed/Thu, 31 Aug 2017 00:00:00 +0000https://lukehebert.com/post/failure-unspecified-at-gss-api-level-mechanism-level-checksum-failed/A quick reference for the six most common causes of the Kerberos GSS-API checksum failure error, from wrong passwords to time skew and SPNEGO canonicalization issues.https://lukehebert.com/post/crealm-and-srealm-for-java-sun-security-krb5-realm.java-realm-detection-and-pathing/Tue, 22 Aug 2017 00:00:00 +0000https://lukehebert.com/post/crealm-and-srealm-for-java-sun-security-krb5-realm.java-realm-detection-and-pathing/A look at how Java’s built-in Kerberos implementation uses cRealm and sRealm to determine the path between client and service realms, including hierarchical traversal and capaths configuration.https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Kerberos error 44 occurs when the keytab KVNO does not match the KDC database. This guide walks through diagnosing the mismatch and regenerating the keytab to restore authentication.https://lukehebert.com/post/server-not-found-kerberos/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-not-found-kerberos/A quick troubleshooting guide for the ‘Server not found in Kerberos database’ error, covering the four most common root causes and how to verify each one.https://lukehebert.com/post/check-hue-credentials-or-keytab-credentials-and-credential-flags-kerberos/Fri, 04 Aug 2017 00:00:00 +0000https://lukehebert.com/post/check-hue-credentials-or-keytab-credentials-and-credential-flags-kerberos/Walk through inspecting a Hue keytab file, verifying its principals with klist, and confirming that the resulting ticket carries the Renewable flag Hue requires for long-running service operations.https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/Tue, 18 Jul 2017 00:00:00 +0000https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/A practical troubleshooting guide for the Kerberos AP REP decryption error, covering the most common causes from keytab mismatches to encryption type misconfigurations.https://lukehebert.com/post/trace-kerberos-in-the-cli/Thu, 29 Jun 2017 00:00:00 +0000https://lukehebert.com/post/trace-kerberos-in-the-cli/Kerberos authentication failures can be frustrating to debug. Setting the KRB5_TRACE environment variable gives you detailed library-level logging that pinpoints exactly where the exchange breaks down.https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/A quick reference for diagnosing Kerberos authentication failures in Active Directory, covering the lockout state machine and the specific error codes (5be, 775, 18) that indicate revoked credentials or a locked account.https://lukehebert.com/post/alternate-krb5.conf-location/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/alternate-krb5.conf-location/Java reads its Kerberos configuration from a fixed set of paths before falling back to the system default. Setting KRB5_CONFIG lets you point a Java application at a custom krb5.conf without touching the OS-level file.https://lukehebert.com/post/are-unix-users-required-for-hadoop/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/are-unix-users-required-for-hadoop/Hadoop requires OS-level user accounts on every cluster node regardless of security configuration. This post explains why, covering both secure and simple mode, and addresses whether the requirement can be removed.https://lukehebert.com/post/compare-knvo-in-db-and-in-keytab-these-should-match/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/compare-knvo-in-db-and-in-keytab-these-should-match/A quick two-step check to confirm the Kerberos key version number in your KDC database matches the value stored in a local keytab file. Mismatched KVNO values are a common cause of authentication failures in Hadoop and other Kerberized services.https://lukehebert.com/post/how-to-enable-kerberos-event-logging-windows/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/how-to-enable-kerberos-event-logging-windows/Kerberos authentication failures can be tricky to diagnose without detailed logging. This guide walks you through enabling Kerberos event logging on a Windows machine via the registry so you can capture authentication events in the system log.https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Specific JDK 1.8.0 builds (u40, u45, u91, u92) are known to break SPNEGO authentication and Hadoop web interfaces. This post documents the affected versions, the symptoms, and the recommended downgrade path.https://lukehebert.com/post/kerberos-cli-debug-trace-hadoop/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cli-debug-trace-hadoop/A quick reference for enabling verbose Kerberos and Hadoop debug output on the command line, so you can see exactly where authentication is failing.https://lukehebert.com/post/kerberos-cross-realm-trust/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cross-realm-trust/Kerberos cross-realm authentication relies entirely on TGS exchanges between KDCs. Understanding the three-step ticket flow makes it easier to troubleshoot trust relationships between domains.https://lukehebert.com/post/kerberos-debug-mode-for-the-jvmsparkspnego/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-debug-mode-for-the-jvmsparkspnego/Enable Kerberos debug logging in a JVM, Spark driver, and Spark executors to troubleshoot SPNEGO and authentication issues. Covers the exact Java system properties, Spark configuration keys, and how to redirect Spark logs to stdout so Kerberos output interleaves with application logs.https://lukehebert.com/post/kerberos-shortname-mapping-auth-to-local/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-shortname-mapping-auth-to-local/A practical walkthrough of how Hadoop maps Kerberos principals to short names via the auth_to_local property, including rule syntax, acceptance filters, and common troubleshooting patterns.https://lukehebert.com/post/multiple-http-principles/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/multiple-http-principles/How to verify and manage HTTP service principal names in Active Directory using ldapsearch and setspn, including a note about Centrify’s uppercase requirement.https://lukehebert.com/post/change-nn-trash-check-point-interval-can-correct-tgt-on-nn-non-ha-with-kms/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/change-nn-trash-check-point-interval-can-correct-tgt-on-nn-non-ha-with-kms/Adjusting the NameNode trash checkpoint interval can resolve TGT renewal issues on non-HA NameNodes using KMS. This change is safe and does not affect trash retention.https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/A practical look at why the MIT krb5 KDC rejects a TGS-REQ with KRB_AP_ERR_NOT_US, including the exact validation logic and the most common root causes behind the error.