Why I'm able to access the hdfs even after kerberos ticket is expired.

[#1]

I've modified the principal maxlife to 5min, as per the theory I should not be able to access the hdfs after 5min. But for me ticket is expiring after 10min. Any idea?

WARN ipc.Client: Exception encountered while connecting to the server : 
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] 

modified maxlife using below command,

modprinc -maxlife "5minutes" hdfs-n@HWXBLR.COM

[#2 · Accepted solution]

The default value for maximum clock skew is 300 seconds, or five minutes. So by default, the kerberos server will refuse to issue tickets only if the clocks are out of sync by more than 5 minutes, hence you are allowed to access the service or renew tickets till the acceptable clock skew time. MIT ClockSkew

[#3]

thanks @krajguru for response. So it is expected behavior. Can we reduce this clock skew and is it advised to reduce it?

[#4]

@nyadav You can change this default value of 300 seconds in the [libdefaults] section of the krb5.conf file. But for security reasons, do not increase the clock skew beyond 300 seconds.