Support Questions

Find answers, ask questions, and share your expertise

Error with Kereberos configuration in sandbox

New Contributor

Trying to assist a client with the following Kerberos configuration error.

We have configured automatically Kerberos on Sandbox HDP 2.6.4as described in below how-to:

We created the Kerberos ticket using thehive.service.keytab(one of the keytabs automatically generated by HDP):

kinit –kt hive.service.keytabhive/

In order to connect to Kerberos Hive in JDBC from Windows machine, we used the following code snippet:






Connection con = DriverManager.getConnection("jdbc:hive2://localhost:10000/foodmart;principal=hive/");


}catch(Exceptione) {



In this case we obtain the following error: Login failure forhive/ keytab C:/Users/Emilio/Desktop/keytabs/ ICMP Port Unreachable

Then we tried to replace the path value specified into theloginUserFromKeytabmethod with the one of the server:"hive/","/etc/security/keytabs/hive.service.keytab");

In this case we obtain the following error: failure forhive/ keytab /etc/security/keytabs/ Unable to obtain password from user

We also tried to perform the same tests explained above using a new user. To create the new user we used thekadmintool with the command below:


After the principal creation, we added encryption to the user and then we generated a keytab file:


add_entry -password -phive-user/ 1 -e aes256-cts

add_entry -password -phive-user/ 1 -e aes128-cts

add_entry -password -phive-user/ 1 -e des3-hmac-sha1

add_entry -password -phive-user/ 1 -e arcfour-hmac

add_entry -password -phive-user/ 1 -e des-hmac-sha1

add_entry -password -phive-user/ 1 -e des-cbc-md5

add_entry -password -phive-user/ 1 -e des-cbc-crc

wkt /etc/security/keytabs/hive-user.service.keytab

Finally we created the Kerberos ticket using the newly generated keytabhive-user.service.keytab:

kinit -kt hive-user.service.keytabhive-user/

The same errors of the previous tests occur.

The last try we did was performed enabling Kerberos security manually on HDP, according to the official documentation available at the following link:

Unfortunately, the above tests behave the same way in this case too.



Hi @dedwards,

Were you able to connect to Hive via SBX CLI?

Because if you are able to connect with Kerberos to Hive via CLI then Kerberos is potentially set-up correctly in SBX and the problem is on the Windows machine connection to the SBX.

Also, are you not missing the ZK information in the JDBC connection:

Connection con = DriverManager.getConnection("jdbc:hive2://localhost:10000/foodmart;principal=hive/");

Check this Article:

Hope it helps!


Take a Tour of the Community
Don't have an account?
Your experience may be limited. Sign in to explore more.