Support Questions
Find answers, ask questions, and share your expertise

Kerberos authentication error with keytab

Re: Kerberos authentication error with keytab


Hi again @saranvisa,


I checked the logs and I saw that the error that I was getting on starting a service was caused from a certain process so I got in that directory and looked for the error on hdfs.keytab. When doing the klist -kt hdfs.keytab I got the principals list, tried to make a kinit with one of them and it worked well.


What I've seen is that the imported keytabs I was trying to klist were some old keytab files, modified few weeks ago, and the logs gave me the clue on which directory test the keytab files.


So we are at the same point, seems that krb5-workstation commands work fine, keytabs were generated right and the service keeps outputing the same error again and again.


Some more ideas to test?


Thank you

Re: Kerberos authentication error with keytab


We surpassed the error just configuring Cloudera to authenticate to a local KDC, we were using a KDC provided by WSO2, this problem got solved but not with the scenario it appeared first.

Re: Kerberos authentication error with keytab

New Contributor

Do you wanted to check the proper Authentication is Happenning between Cluster and AD, make sure port,

Re: Kerberos authentication error with keytab

Cloudera Employee

When you get below error message when doing kinit using a keytab file

klist: Unsupported key table format version number while starting keytab scan

Make sure that keytab file is not of zero byte 
e.g This is Zero byte keytab file and you will get the above error when trying to do kinit with it

-rw------- 1 cloudera-scm cloudera-scm 0 Aug 30 12:15 ./32-cloudera-mgmt-SERVICEMONITOR/cmon.keytab

A good keytab file will have non-zero size e.g. 778 for the below file 

-rw------- 1 cloudera-scm cloudera-scm 778 Oct 12 05:21 ./150-cloudera-mgmt-SERVICEMONITOR/cmon.keytab