You are probably running into https://issues.apache.org/jira/browse/HBASE-1514.
In secure clusters, you should run the zkcli command with --auth-as-server parameter. Like this:
hbase --auth-as-server zkcli
In newer versions of HDP, the patch should be there. Otherwise, you can get this working with something like:
HBASE_OPTS="$HBASE_OPTS -Djava.security.auth.login.config=/usr/hdp/current/hbase-regionserver/conf/hbase_master_jaas.conf hbase zkcli
Please note that the jaas.conf file that you add to the HBASE_OPTS before running the zkcli command should match what you have for your master and regionservers.