Kerberos

Java reads its Kerberos configuration from a fixed set of paths before falling back to the system default. Setting KRB5_CONFIG lets you point a Java application at a custom krb5.conf without touching the OS-level file.

Hadoop requires OS-level user accounts on every cluster node regardless of security configuration. This post explains why, covering both secure and simple mode, and addresses whether the requirement can be removed.

A quick two-step check to confirm the Kerberos key version number in your KDC database matches the value stored in a local keytab file. Mismatched KVNO values are a common cause of authentication failures in Hadoop and other Kerberized services.

Kerberos authentication failures can be tricky to diagnose without detailed logging. This guide walks you through enabling Kerberos event logging on a Windows machine via the registry so you can capture authentication events in the system log.

Specific JDK 1.8.0 builds (u40, u45, u91, u92) are known to break SPNEGO authentication and Hadoop web interfaces. This post documents the affected versions, the symptoms, and the recommended downgrade path.

A quick reference for enabling verbose Kerberos and Hadoop debug output on the command line, so you can see exactly where authentication is failing.